Privacy Policy

(Regulation (EU) 2016/679 – GDPR)

1. Data Controller

The data controller of personal data is:

Bagotica, a brand operated by
Lux Collector di Yuliya Kazlouskaya,
established in Italy.

Contact email: info@bagotica.com

2. Scope

This Privacy Policy describes how personal data of users who visit or interact with the Bagotica website are collected, used and protected, in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable national legislation.

3. Categories of personal data processed

Bagotica may process the following categories of personal data:

identification and contact data;
billing and payment data;
order and transaction data;
customer communications;
data necessary for fraud prevention;
browsing data, as described in the Cookie Policy.

Bagotica does not process special categories of personal data under Article 9 GDPR.

4. Purposes and legal bases of processing

Personal data are processed for the following purposes:

a) performance of the sales contract and order management;
b) compliance with legal and tax obligations;
c) payment management;
d) fraud prevention and dispute management;
e) customer support and operational communications;
f) technical management and security of the website.

The legal bases include contract performance, legal obligations, legitimate interest of the controller and, where required, the data subject’s consent.

5. Payment methods

Payments are processed via:

bank transfer;
Stripe;
PayPal.

Bagotica does not store or directly process full payment card details.

6. Fraud prevention and identity verification

For security and fraud prevention purposes, Bagotica may request additional identity verification.

Such data are used exclusively for these purposes and retained for a limited and proportionate period.

7. Data retention

Personal data are retained:

for the time necessary to perform the contract;
for periods required by tax and accounting laws;
for limited periods related to security and customer support purposes.

8. Data disclosure

Personal data may be disclosed only where necessary to third parties such as:

payment service providers;
legal and tax advisors;
technical and IT service providers.

Such parties act as data processors or independent controllers in accordance with the GDPR.

9. Transfers outside the EU

Any transfer of personal data outside the European Union is carried out in compliance with the safeguards provided by the GDPR, including adequacy decisions or standard contractual clauses.

10. Data subject rights

Data subjects may exercise their rights under Articles 15–22 GDPR by contacting the data controller at the email address provided.

11. Cookies and similar technologies

The use of cookies and similar technologies is governed by the ePrivacy Directive and applicable national legislation.
For further details, please refer to the Cookie Policy.

12. Updates

This Privacy Policy may be updated from time to time.
The updated version will be published on the website and will be effective upon publication.