Privacy policy

Privacy Policy

Last updated: 9 October 2026

This policy explains how we process the personal data of people who visit zepter.fashion, create an account, buy or contact us, under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003.

1. Data controller

Over Manufacturer S.R.L., Via Rimini 37, 59100 Prato (PO), Italy – VAT and Tax code 14159900969 – REA PO-627018. Email: info@overtailor.com – PEC: overmanufacturersrl@pec.it. Zepter Fashion is a brand sold by the Controller.

2. Data we process

Identity and contact data: name, shipping and billing addresses, email, phone.
Order data: products bought, amounts, returns, refunds, order history.
Payment data: payment method and transaction outcome. Full card details are processed by Shopify Payments and PayPal: we do not receive or store them.
Account data: login details, preferences, saved addresses.
Communications: content of messages sent by email, WhatsApp or contact form, including withdrawal requests.
Browsing data: IP address, device and browser type, pages visited, also collected through cookies (see section 7).

3. Purposes and legal bases

Managing orders, payments, shipping, returns, withdrawals and guarantee claims; managing your account – performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR).
Tax, accounting and legal obligations (e.g. invoicing, consumer protection) – legal obligation (Art. 6(1)(c)).
Customer service and replies to requests – performance of a contract or legitimate interest in replying (Art. 6(1)(b)/(f)).
Fraud prevention and website security – legitimate interest (Art. 6(1)(f)).
Promotional emails about products similar to those already bought – legitimate interest (Art. 130(4) Legislative Decree 196/2003); you can object at any time using the unsubscribe link in every email.
Newsletter and marketing – consent (Art. 6(1)(a)), which you can withdraw at any time.
Analytics and marketing cookies – consent collected through the cookie banner.
Establishing or defending legal claims – legitimate interest (Art. 6(1)(f)).

Providing the data needed for an order is mandatory: without it we cannot conclude and perform the contract. Providing other data is optional.

4. Recipients

Data are processed by the Controller's authorised staff and shared, only as far as necessary, with:

Shopify International Limited (Ireland), provider of the e-commerce platform, acting as processor; for some features (e.g. Shop Pay, fraud prevention) Shopify acts as an independent controller – see the Shopify privacy policy;
payment service providers (Shopify Payments, PayPal), acting as independent controllers for the transactions;
couriers and logistics providers, for deliveries and returns;
tax, accounting and legal advisers;
email, customer service and hosting providers;
public authorities, where required by law.

We do not sell personal data.

5. Transfers outside the European Economic Area

Some providers (for example Shopify and its affiliates) may process data outside the EEA, in particular in Canada and the United States. In these cases transfers are based on European Commission adequacy decisions or on the Standard Contractual Clauses approved by the Commission.

6. Retention

Order and invoice data: 10 years from recording, as required by Article 2220 of the Italian Civil Code and tax law.
Account data: until you or we, at your request, delete the account.
Customer service communications: as long as needed to handle the request and up to 24 months after it is closed, unless a dispute is pending.
Marketing: until you withdraw consent or unsubscribe.
Cookies: for the duration shown in the cookie banner.

If there is a dispute, data may be kept until it is resolved.

7. Cookies

The website uses technical cookies needed for it to work (cart, checkout, security), which do not require consent, and, only with your consent, analytics and marketing cookies. You can accept, reject or change your preferences at any time through the cookie banner.

8. Your rights

You can at any time request access to your data, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interest (Articles 15-22 GDPR). You can withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. To exercise your rights write to info@overtailor.com or to the PEC address overmanufacturersrl@pec.it; we will reply within 30 days.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the EU country where you live.

9. Minors

Our services are not intended for people under 18 and we do not knowingly collect their data. A parent or guardian who believes a minor has given us personal data can ask for it to be deleted using the contact details above.

10. Security

We use appropriate technical and organisational measures to protect data, including encrypted connections (HTTPS) and access limited to authorised staff. No system, however, is completely secure.

11. Automated decision-making

We do not take decisions based solely on automated processing that produce legal effects concerning you, except for automated anti-fraud checks on payments carried out by payment providers.