Legal Information

Privacy Policy

Data Controller
Level Audio di Andreas Wagner – sole proprietorship (impresa individuale)
Via Osvaldo Marzano 2
70125 Bari, Italy
VAT ID: IT08910090722
E-mail: shop@levelaudio.it

1. General Principles

We respect your privacy and protect your personal data in compliance with the EU General Data Protection Regulation (GDPR). This Privacy Policy explains what data we collect on www.levelaudio.it, for what purposes, how long it is stored, and with whom it may be shared.

2. Hosting and Server Logs

Our website is hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). When you access our site, the server automatically stores log files (e.g. IP address, browser type, access time). This processing is based on Art. 6 (1)(f) GDPR (legitimate interest in the secure and stable operation of the website and in aggregated counts of our ordering process, such as how many visitors reach the checkout). Logs are deleted after a maximum of 30 days.

3. Data We Collect

We collect and process personal data when you:

contact us by e-mail, via the contact form or via WhatsApp, or request a price,
place an order in our online store,
subscribe to our newsletter,
visit our website (cookies, analytics, tracking).

The legal bases are Art. 6 (1)(b) GDPR (contract performance), Art. 6 (1)(a) GDPR (consent), Art. 6 (1)(c) GDPR (legal obligations, e.g. keeping invoices) and Art. 6 (1)(f) GDPR (legitimate interest in security and optimization).

6. Analytics and Advertising Tools

Own visitor statistics (without consent, with shortened IP address)
For each visit, our shop system stores in our own database a visitor number, date and time, the first page visited and the page you came from, your IP address in shortened form only (for IPv4 addresses without the last of the four number blocks, for IPv6 addresses at most the first 48 bits) as well as browser, operating system and browser language as your browser reports them with every request. The visitor number is stored in the “PrestaShop-…” cookie of our shop system; the entry “lvlJsGast” in your browser’s local storage also contains it and remembers that your browser has already been reported – this is how we tell real visits from automated access. If you are logged in to your customer account or add items to your cart, the visitor number is linked to your customer account or your cart. The view counter of our blog stores for each article view the date and time, a checksum calculated from your IP address and browser information, your customer number if applicable and your IP address, which we shorten after one day at the latest. We use these data for visitor statistics, such as the number of visits and the share of visits with an order, and to distinguish real visits from automated access; we do not share them with third parties. The legal basis is our legitimate interest in measuring the use of our shop (Art. 6 (1)(f) GDPR). In doing so, we rely on the cookie guidelines of the Italian data protection authority of 10 June 2021 (point 7.2), under which such analytics entries may be used without consent under certain conditions (Art. 122 (1) Codice privacy), and we do not ask for consent; shortening the IP address is one of our safeguards. You can object to this processing at any time: via the link Turn off statistics for this browser (it sets the cookie “lvl_statistik”; we then no longer record visits from this browser), via your browser’s “Global Privacy Control” signal, which we treat the same way, or as described in section 10. The data on individual visits and the blog views are deleted after 14 months at the latest.

Google Analytics
We use Google Analytics (Google Ireland Ltd.) to analyze website usage. Cookies may be set, and data such as visited pages, approximate location (anonymized) and session duration may be processed. IP addresses are stored in anonymized form only. Processing occurs solely with your consent (Art. 6 (1)(a) GDPR). Analytics data are retained for 14 months.

Google Ads Conversion Tracking
We use Google Ads to measure the performance of our advertising campaigns. Google may set cookies if you have given consent. After a purchase, and likewise only with your consent, we transmit your e-mail address, name, phone number and address to Google in hashed form (SHA-256) so that Google can attribute the purchase to an ad (enhanced conversions). Conversion data are deleted or anonymized after 90 days.

Contentsquare
With your consent we use the analytics tool Contentsquare, provided by Content Square SAS, 7 rue de Madrid, 75008 Paris, France, to understand how our pages are used. Cookies are set and your IP address, information about your browser and operating system, the pages you visit as well as mouse and touch movements, clicks, scrolling and time spent are recorded; individual visits may be stored as session recordings. What you type into form fields is not recorded. Content Square SAS processes the data as our processor, stores it in data centers in Ireland and deletes it after 13 months at the latest. For maintenance and support, companies of the Contentsquare group and their service providers may also access the data from countries outside the EU, for example the USA; such transfers are based on the European Commission’s Standard Contractual Clauses or adequacy decisions and, for the USA, also on the EU-U.S. Data Privacy Framework, under which Content Square, Inc. is certified. Processing occurs solely with your consent (Art. 6 (1)(a) GDPR); you may withdraw it at any time (see section 5).

8. Orders and Payments

To process your orders we store contact, delivery and payment-related data. This is necessary to fulfill the contract (Art. 6 (1)(b) GDPR). Without these data we cannot process your order.

PayPal and credit card: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. You can find out how PayPal processes your data in the PayPal Privacy Statement.
Apple Pay / Google Pay: processed through PayPal or the respective provider
PrestaShop Checkout payment module: name, e-mail address, phone number, billing and delivery address, the ordered items with amounts and, after dispatch, the tracking number are transmitted to PayPal via servers of PrestaShop SA, Paris, France. For this purpose we show a PayPal button for direct purchase on product pages and, depending on the country, a notice about paying later or in instalments with PayPal; in the cart this notice and the logos of the payment methods; at checkout the payment buttons. On these pages your browser loads program code from PrestaShop and PayPal regardless of your choice in the cookie banner; your IP address, technical information about your browser and the page visited are transmitted to PrestaShop and PayPal, and PayPal creates entries in your browser storage (see our Cookie Policy). At checkout this is necessary for the payment (Art. 6 (1)(b) GDPR). On product pages and in the cart you can order directly via the PayPal button; we therefore regard the entries in your browser storage needed for this as strictly necessary (Art. 122 (1) Codice privacy, see section 5), and the transmission to PrestaShop and PayPal there is based on our legitimate interest in offering you direct purchase with PayPal and information about the payment options right there (Art. 6 (1)(f) GDPR).

We do not store complete credit-card details on our servers. Accounting-related data (e.g. invoices) are retained for 10 years where statutory retention obligations apply (Art. 6 (1)(c) GDPR, in particular Art. 2220 of the Italian Civil Code and tax retention obligations), and otherwise until the ordinary limitation period of 10 years has expired (Art. 2946 of the Italian Civil Code), in order to establish, exercise or defend legal claims (Art. 6 (1)(f) GDPR).

9. Contact and Inquiries

If you contact us by e-mail, via the contact form or via WhatsApp, we process the data you provide and your message to handle your inquiry (Art. 6 (1)(b) GDPR for questions about a purchase, otherwise Art. 6 (1)(f) GDPR). For the contact form, our shop system also stores your IP address and your browser’s identification string (user agent). Inquiries that you assign to an order in the contact form (by selecting the order number, possible with a customer account) are kept together with the order documents (see section 8). All other contact form inquiries are deleted no later than 24 months after the last message; if you have ordered from us, no later than 24 months after the last message or your last order, whichever is later. We keep e-mails and WhatsApp messages as business correspondence for up to 10 years (Art. 2220 of the Italian Civil Code; Art. 6 (1)(c) and (f) GDPR); this also applies to the copy of a contact form message that reaches us by e-mail.

WhatsApp
For users in Europe, the WhatsApp service is provided by WhatsApp Ireland Limited, Ireland, under its own privacy policy; in doing so it receives in particular your phone number and connection data. If you do not want this, please write to us by e-mail.

Translation of e-mails in Italian
E-mails in Italian sent to Andreas Wagner’s personal mailbox and his replies to them are translated automatically. For this purpose, Anthropic Ireland, Limited, Ireland, processes the content of these e-mails as our processor (Art. 28 GDPR); data may be transferred to the USA on the basis of standard contractual clauses of the EU Commission (Art. 46 GDPR). The legal basis is our legitimate interest in answering inquiries in the sender’s language (Art. 6 (1)(f) GDPR).

Price requests
If you request a special price on a product page via “Ask For Price”, we store your e-mail address, the item, the discount code sent and your IP address in order to send you the offer and to limit misuse (Art. 6 (1)(b) and (f) GDPR). These data are deleted after 12 months at the latest.

10. Your Rights

You have the right to:

access your data (Art. 15 GDPR)
rectify inaccurate data (Art. 16 GDPR)
erase data (Art. 17 GDPR)
restrict processing (Art. 18 GDPR)
be informed about the recipients to whom we have communicated a rectification, erasure or restriction (Art. 19 GDPR)
data portability (Art. 20 GDPR)
object to processing (Art. 21 GDPR)
not be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR)
withdraw your consent at any time with effect for the future, without affecting the lawfulness of processing before the withdrawal (Art. 7 (3) GDPR)
lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) – in particular in the EU member state where you live or work or where the alleged infringement took place, or with the Italian supervisory authority responsible for us, Garante per la protezione dei dati personali

Right to object
Where we process your data on the basis of our legitimate interest (Art. 6 (1)(f) GDPR), you may object at any time on grounds relating to your particular situation; we will then no longer process the data unless we demonstrate compelling legitimate grounds which override your interests or the processing serves the establishment, exercise or defense of legal claims. You may object to the use of your data for marketing at any time without giving reasons (Art. 21 GDPR).

To exercise these rights, please contact shop@levelaudio.it.

11. Data Security

Our website uses HTTPS encryption. Technical and organizational measures are in place to protect data against unauthorized access, loss or manipulation.

Google reCAPTCHA
To protect our forms and customer accounts against spam and automated abuse, we use Google reCAPTCHA on the contact, registration and login pages and at checkout. The provider is Google Cloud Italy S.r.l., Milan, Italy, which processes the data as our processor. When you open these pages, your browser loads program code from Google; your IP address and technical information from your browser are transmitted to Google, and reCAPTCHA sets the cookie “_GRECAPTCHA” and entries in your browser storage (see Cookie Policy) in order to assess the risk of automated access. Under its contractual terms, Google uses this information only to provide and secure the service and not for personalized advertising. We base this processing on our legitimate interest in protecting our shop and our forms against abuse (Art. 6 (1)(f) GDPR). reCAPTCHA is loaded on these pages regardless of your choice in the cookie banner.

12. Data Retention Periods (Summary)

Server logs: 30 days
Newsletter and Klaviyo: newsletter subscription until you unsubscribe; data at Klaviyo up to 24 months after your last activity – we then also delete an unused newsletter subscription there; after unsubscribing a block flag remains (see section 7)
Order / invoice data: 10 years (see section 8)
Customer account: until you delete your account or request its deletion (order data then as above)
E-mails and WhatsApp messages: as business correspondence for up to 10 years (Art. 2220 of the Italian Civil Code)
Contact form inquiries (stored in the shop): if assigned to an order, same as the order documents; otherwise up to 24 months after the last message (if you have ordered: after the last message or order, whichever is later)
Price requests: up to 12 months
Details from uncompleted guest orders (name, e-mail address, address, cart): up to 24 months after the last activity
Analytics / marketing data (Google): up to 14 months
Own visitor statistics and blog view counter: up to 14 months (IP address shortened, in the blog view counter after one day at the latest)
Cookie choice (cookie “cookie_law”): 12 months if accepted, 6 months if declined

13. Updates

We may update this Privacy Policy when required. The current version is always available at levelaudio.it/en/content/13-privacy-policy.