Privacy policy

Last updated: 10 November 2026

This notice explains how Le Boudoir Roma collects and uses the personal data of people who visit www.leboudoiroma.com, shop online, sign up for our newsletter or contact us. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 (Privacy Code), as amended by Legislative Decree 101/2018.

1. Data controller

Le Boudoir di Federica Bartolucci – sole proprietorship
Via dei Banchi Nuovi 25, 00186 Rome (RM), Italy
VAT no. IT12023381002 – REA RM-1346153
Email: contact@leboudoiroma.com – Tel. +39 06 9054 6930

2. What data we collect

  • Data you provide: first and last name, email address, phone number, shipping and billing address, any tax details needed for an invoice, and the content of the messages you send us.
  • Order data: products purchased, amounts, order history, returns and refunds. Payment card details are handled directly by the payment providers: we never see or store them.
  • Browsing data: IP address, browser and device type, pages visited, products added to the cart, collected through cookies and similar technologies (see section 7).

3. Why we process your data and on what legal basis

  • Handling orders, payments, shipping, returns and customer service – performance of the sales contract (Art. 6.1.b GDPR).
  • Managing your customer account, if you choose to create one – performance of a contract (Art. 6.1.b).
  • Answering your requests by email, phone, WhatsApp or in the boutique – pre-contractual measures and contract (Art. 6.1.b).
  • Complying with legal obligations (accounting and tax) – legal obligation (Art. 6.1.c).
  • Sending you our newsletter with new arrivals, promotions and boutique events – only with your consent (Art. 6.1.a), which you can withdraw at any time using the "unsubscribe" link in every email.
  • Reminding you of an unfinished checkout, improving the site, preventing fraud and keeping it secure – our legitimate interest (Art. 6.1.f).
  • Analytics and personalised advertising through analytics and marketing cookies – only with your consent (Art. 6.1.a), given through the cookie banner.

The data needed to place an order is mandatory: without it we cannot complete the sale. All other data is optional.

4. Who we share data with

Your data is processed by us and, on our behalf, by providers acting as processors or as independent controllers:

  • Shopify (Shopify International Ltd., Ireland), the platform that hosts our online store and handles checkout, customer accounts, service emails and newsletter sign-up forms;
  • payment providers: Shopify Payments and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.), which process payment data as independent controllers;
  • couriers and shipping services, to deliver your orders;
  • Google (Google Ireland Ltd.), for Google Analytics statistics, subject to your consent;
  • Meta (Meta Platforms Ireland Ltd.), for measurement and advertising on Facebook and Instagram, subject to your consent, and for WhatsApp if you contact us through it;
  • advisers (e.g. our accountant) and public authorities, where required by law.

We never sell or publicly disclose your data.

5. Transfers outside the European Union

Some providers (such as Shopify, Google and Meta) may also process data outside the EU, for example in the United States and Canada. Such transfers rely on European Commission adequacy decisions (including the EU-U.S. Data Privacy Framework) or on the Standard Contractual Clauses approved by the Commission.

6. How long we keep your data

  • Order data and tax documents: 10 years, as required by Italian civil and tax law.
  • Customer account: until you ask us to delete it.
  • Newsletter: until you withdraw your consent (unsubscribe).
  • Enquiries: for as long as needed to handle them, and no longer than 24 months.
  • Cookies: for the duration shown in the cookie banner, and no longer than 13 months for analytics and marketing cookies.

7. Cookies

The site uses technical cookies that the store needs to work (cart, checkout, language, security); these do not require consent. Analytics cookies (Google Analytics) and marketing cookies (Meta) are only set if you accept them through the banner shown on your first visit. You can change your choices at any time from the cookie banner or in your browser settings.

8. Your rights

At any time you may request access to your data, rectification, erasure, restriction of processing and data portability, and you may object to processing based on legitimate interest and to marketing. You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, write to contact@leboudoiroma.com or use the tools on our personal data requests page. We will reply within 30 days.

If you believe your data is being processed unlawfully, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority in your country of residence.

9. Minors

The site is not intended for children under 14 and we do not knowingly collect their data. Purchases are reserved for people with legal capacity to enter into contracts.

10. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS) and certified payment providers (PCI DSS).

11. Changes

This notice may be updated. The current version is always published on this page, with the date of the last update.