This Privacy Policy explains how [TO FILL — Company legal name] ("Morro", "we", "us") collects, uses, discloses and protects your personal data when you visit trymorro.com (the "Site") or purchase our products. It is drafted in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable national laws.
1. Data controller
- Company: [TO FILL — legal name]
- Registered office: [TO FILL — full address]
- VAT / Tax ID: [TO FILL]
- Contact email: [TO FILL — e.g. privacy@trymorro.com]
2. Personal data we collect
- Identity & contact: name, email, shipping and billing address, phone number.
- Order data: products purchased, order value, delivery status.
- Payment data: processed directly by Shopify Payments / Stripe. We do not store card numbers.
- Technical data: IP address, browser, device, pages viewed, referral source.
- Marketing preferences: newsletter subscription status, cookie consent choices.
3. Purposes and legal bases
- Contract performance (Art. 6(1)(b) GDPR): to process orders, deliver products, handle returns and customer support.
- Legal obligation (Art. 6(1)(c)): tax, accounting and consumer-protection duties.
- Consent (Art. 6(1)(a)): marketing emails, analytics and advertising cookies.
- Legitimate interest (Art. 6(1)(f)): fraud prevention, site security, service improvement.
4. Retention
Order and invoice data are kept for 10 years for tax purposes. Marketing consent is kept until withdrawn. Analytics data are anonymized after 14 months. Support conversations are kept for 24 months.
5. Recipients & processors
Personal data may be shared with the following categories of recipients, acting as data processors under Art. 28 GDPR:
- Shopify Inc. — e-commerce platform (Canada, adequacy decision).
- Shipping carriers — [TO FILL — e.g. DHL, GLS, BRT].
- Payment providers — Stripe, PayPal, Shopify Payments.
- Email & marketing tools — [TO FILL — e.g. Klaviyo, Mailchimp].
- Analytics — Google Analytics 4, only with your consent.
- Hosting — Cloudflare, Lovable.
6. International transfers
Some processors are located outside the EEA (mainly USA). Transfers are protected by Standard Contractual Clauses (Art. 46 GDPR) or by the EU-US Data Privacy Framework.
7. Your rights
You can exercise the following rights at any time by writing to [TO FILL — privacy email]:
- Access, rectification, erasure ("right to be forgotten")
- Restriction and objection to processing
- Data portability
- Withdraw consent (without affecting past processing)
- File a complaint with the Garante per la Protezione dei Dati Personali (garanteprivacy.it) or your local supervisory authority
8. Cookies
Details on cookies and tracking technologies are provided in our Cookie Policy. You can change your preferences at any time from the "Cookie preferences" link in the footer.
9. Changes
We may update this Policy. Material changes will be announced on this page with a new "Last updated" date.