Privacy policy

Last updated: 31 October 2026

Data controller

ATHESIS S.r.l. a socio unico, owner of the DryHeat brand – registered office: via Marie Curie 15, 39100 Bolzano (BZ), Italy – operational office: via Forno Bianco 6/A, 37060 Maccacari (VR), Italy – VAT IT02556450217 – email info@dryheat.it – tel. +39 0442 590099.

This notice, provided under Article 13 of Regulation (EU) 2016/679 (GDPR), explains how we process your personal data when you visit the site, create an account, buy, subscribe to the newsletter or write to us. The store runs on the Shopify platform.

What data we process

Contact data: name, shipping and billing address, email, phone.
Order data: products bought, amounts, returns, exchanges, order history.
Payment data: payment method and outcome. Full card numbers are handled by the payment providers, not by us.
Account data: login email, saved addresses and order history.
Communications: the content of the emails and messages you send us.
Reviews: name, text, rating and any photos you choose to publish.
Browsing data: IP address, device, browser, pages visited, products viewed and added to the cart. Technical cookies needed to run the store are always active; statistics and marketing cookies and tools, including the Meta and Google tools described below, only if you consent in the cookie banner.

Why we process it, on what legal basis and for how long

Purpose	Legal basis	Retention
Managing orders, payments, shipping, returns and refunds	Performance of the contract (Art. 6.1.b GDPR)	For the duration of the relationship, then 10 years for accounting and tax records (Art. 2220 Italian Civil Code)
Meeting tax and accounting obligations	Legal obligation (Art. 6.1.c GDPR)	10 years from recording
Managing the customer account	Performance of the contract (Art. 6.1.b GDPR)	Until you ask us to delete it
Customer service and legal guarantee of conformity	Performance of the contract and legal obligation (Art. 6.1.b and 6.1.c GDPR)	26 months from delivery (Art. 133 Italian Consumer Code)
Sending newsletters and marketing communications	Consent (Art. 6.1.a GDPR), which you can withdraw at any time	Until you unsubscribe
Email asking for a review after purchase	Legitimate interest in knowing your opinion of the product (Art. 6.1.f GDPR); you can object from the link in the email	Until the review is sent or you object
Publishing your review on the site	Consent, given by submitting the review (Art. 6.1.a GDPR)	As long as the review stays published; we remove it on request
Necessary technical cookies (cart, checkout, security, remembering your cookie choices)	Needed to provide the service you request (Art. 122 Italian Privacy Code) and legitimate interest (Art. 6.1.f GDPR)	For the duration of each cookie shown in Shopify's cookie list
Site usage statistics (Shopify and Google Analytics)	Consent given in the banner (Art. 6.1.a GDPR)	Until you withdraw consent; in Google Analytics detailed data is kept for 14 months at most
Measuring how our ads perform and showing you DryHeat ads on Facebook, Instagram, Google and YouTube (Meta Pixel, Meta Conversions API, Google tag)	Consent given in the banner (Art. 6.1.a GDPR)	Until you withdraw consent, and in any case no longer than the duration of each cookie; retention at Meta and Google is set out in their privacy policies
Site security, fraud prevention, legal defence	Legitimate interest (Art. 6.1.f GDPR)	As long as needed to handle any dispute, and no longer than the limitation periods

After these periods the data is deleted or anonymised. Providing the data needed for the order is mandatory: without it we cannot complete the sale.

We do not take decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. Orders flagged by Shopify's fraud analysis are reviewed by a person.

Advertising and statistics: Meta and Google

We use these tools only if you consent to statistics or marketing cookies in the banner. Without your consent they do not place cookies on your device and do not receive from us any data about your browsing or purchases.

Meta Pixel and Meta Conversions API (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland). They record actions such as viewing a page, adding to cart and purchasing, with order value and products, and send them to Meta from your browser and, to make them more reliable, directly from our store. To match these actions to your Facebook or Instagram account, Meta may also receive your email and phone number in encrypted (hashed) form. We use this to see which ads work and to show DryHeat ads to interested people. For the collection and transmission of this data to Meta we are joint controllers with Meta under Meta's Controller Addendum; Meta is an independent controller for any further processing, described in its privacy policy.
Google tag, Google Analytics and Google Ads (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). They measure how the site is used and which ads on Google and YouTube bring visits and purchases. We use Google Consent Mode, linked to the banner, so your choices are respected. More information in Google's privacy policy and on how Google uses information from partner sites.
Product catalogue. We send Meta and Google the list of our products with prices and availability, to show them on Facebook, Instagram and Google Shopping. This contains no personal data.

You can give, refuse or withdraw consent at any time from the «Cookie preferences» link at the bottom of every page. You can also manage the ads you see from your Meta and Google account settings.

Who we share data with

Shopify, which hosts the store, runs the checkout, sends emails and provides site statistics, processing data on our behalf. For some functions Shopify acts as an independent controller: see the Shopify Consumer Privacy Policy.
Payment providers and couriers, to collect payment and deliver.
Meta and Google, only with your consent, as described in the previous section.
Judge.me, to request and publish reviews.
Tools we use to run the store: Matrixify to import and export data, and artificial intelligence assistants connected to the store (ChatGPT by OpenAI and Claude by Anthropic) to manage catalogue and content.
Advisers and authorities, when required by law.

Providers process data as processors, following our instructions, unless stated otherwise. We do not sell your data.

Transfers outside the European Union

Some providers, including Shopify, Meta, Google, OpenAI and Anthropic, may process data outside the European Economic Area, for example in Canada or the United States. In that case the transfer is made to countries covered by a European Commission adequacy decision, including the EU-US Data Privacy Framework for participating US companies, or on the basis of the Standard Contractual Clauses approved by the Commission.

Your rights

You can ask us at any time to access, correct or delete your data, restrict its processing, receive it in a portable format and object to processing based on legitimate interest. You can withdraw consent whenever you like, without affecting processing carried out before. For promotional emails, use the unsubscribe link in every message; for cookies, the «Cookie preferences» link at the bottom of the site.

To exercise your rights write to info@dryheat.it. We reply within one month. For data collected with the Meta Pixel you can contact us or Meta. If you believe the processing breaches the law you can lodge a complaint with the Italian Garante per la protezione dei dati personali or the supervisory authority of your country.

Minors

The store is not aimed at people under 18 and we do not knowingly collect their data. If you are a parent and think your child has given us personal data, write to us and we will delete it.

Security

We take appropriate technical and organisational measures to protect data. No system is one hundred percent secure, so please do not share your account login details with anyone.