PRIVACY POLICY

1. Introduction

This Privacy Policy explains how ERREVU' S.R.L. ("we", "us", "our"), operating the Nail Design Library brand, collects, uses, shares and protects personal data when you visit this website, contact us, or purchase our digital products.

We process personal data in accordance with Regulation (EU) 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018 where applicable, Italian Legislative Decree 196/2003 as amended, and other applicable data protection laws, including the California Consumer Privacy Act as amended ("CCPA/CPRA") for residents of California.

2. Data Controller

ERREVU' S.R.L. Registered office: Italy VAT No. / Tax Code: IT02063590471 REA No.: PT — 612652 PEC: srlerrevu@pec.it

Privacy enquiries: info@naildesignlibrarystore.com Support: support@naildesignlibrarystore.com

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. Enquiries may be addressed to the contacts above.

3. Personal Data We Collect

Data you provide directly

• Identification and contact data: first name, last name, email address, and where required for billing, postal address, country and telephone number.
• Order data: products purchased, order number, date and amount of the transaction, currency, tax country.
• Business data, where applicable: company name, VAT number.
• Communications: the content of messages sent through our contact form or by email, including any information you choose to include.
• Marketing preferences: your consent to receive commercial communications, and your subsequent choices.

Data collected automatically

• Technical data: IP address, browser type and version, device type, operating system, screen resolution, language and time zone settings.
• Usage data: pages visited, time spent, referring source, links clicked, actions taken on the website.
• Cookie and similar technology data, as described in our Cookie Policy.

Payment data Payment card and account details are collected and processed directly by our payment providers. We do not receive or store full payment card details. We receive only confirmation of the transaction and limited data such as the payment method used and the last digits of the card.

We do not knowingly collect special categories of personal data as defined in Article 9 GDPR, and you should not send us such data.

4. Purposes and Legal Bases

Purpose	Legal basis
Processing and fulfilling your order, delivering the download, providing customer support	Performance of a contract (Art. 6(1)(b) GDPR)
Issuing invoices, complying with tax, accounting and consumer law obligations	Legal obligation (Art. 6(1)(c) GDPR)
Recording your express consent to immediate delivery and waiver of the right of withdrawal	Legal obligation and performance of a contract
Responding to enquiries sent through the contact form or by email	Performance of a contract or legitimate interest (Art. 6(1)(f) GDPR)
Sending marketing emails about our products	Consent (Art. 6(1)(a) GDPR), or legitimate interest for soft opt-in to existing customers where permitted
Analytics and measurement of website performance	Consent, where required, for non-essential cookies
Advertising, retargeting and measurement on third-party platforms	Consent (Art. 6(1)(a) GDPR)
Preventing fraud, abuse and unauthorised distribution of our files; securing the website	Legitimate interest (Art. 6(1)(f) GDPR)
Establishing, exercising or defending legal claims, including enforcement of licence terms	Legitimate interest and legal obligation

Where we rely on legitimate interest, we have assessed that our interest is not overridden by your rights and freedoms. You may object at any time as described in section 9.

5. Provision of Data

Providing identification, contact and billing data is necessary to complete a purchase. Without it we cannot process your order or deliver the products.

Providing data for marketing purposes is optional, and refusal has no consequence on your ability to purchase.

6. Recipients and Data Processors

We do not sell your personal data. We share it only with the following categories of recipients, who act as processors on our behalf or as independent controllers where indicated:

• E-commerce platform and hosting: Shopify Inc., which hosts this store and processes order and customer data on our behalf.
• Payment providers: the payment service providers enabled at checkout, acting as independent controllers for payment data under their own privacy policies.
• Digital delivery and file hosting providers: used to host and deliver the downloadable files.
• Email and marketing service providers: used to send transactional and, where consented, commercial emails.
• Analytics providers: used to measure website performance and usage.
• Advertising platforms: including Meta Platforms, Inc. and other advertising networks, where you have consented to advertising cookies, acting as independent or joint controllers under their own policies.
• Professional advisers: accountants, tax advisers and lawyers, where necessary.
• Public authorities: where required by law or to defend a legal claim.

An updated list of processors may be requested at info@naildesignlibrarystore.com.

7. International Transfers

Some of our providers are established outside the European Economic Area, including in the United States and Canada.

Where personal data is transferred outside the EEA or the UK, we ensure an adequate level of protection through one or more of the following: an adequacy decision of the European Commission or the UK Government; Standard Contractual Clauses adopted by the European Commission, together with supplementary measures where necessary; or another lawful transfer mechanism under Chapter V GDPR.

A copy of the relevant safeguards may be requested at info@naildesignlibrarystore.com.

8. Retention

We retain personal data only as long as necessary for the purposes for which it was collected:

• Order, billing and tax data: for the period required by Italian tax and accounting law, currently ten years from the end of the relevant financial year.
• Consent records relating to the waiver of the right of withdrawal: for the same period, as evidence of compliance.
• Customer support correspondence: up to 24 months from the last contact, unless required longer for a legal claim.
• Marketing data: until you withdraw consent or unsubscribe, and in any event no longer than 24 months from your last interaction, subject to periodic review.
• Analytics and advertising data: for the retention periods set out in our Cookie Policy and in the policies of the relevant providers.

After these periods, data is deleted or irreversibly anonymised, save where retention is required to establish, exercise or defend a legal claim.

9. Your Rights

Subject to applicable law, you have the right to:

• access your personal data and obtain a copy of it;
• rectify inaccurate or incomplete data;
• erase your data, where one of the grounds in Article 17 GDPR applies;
• restrict processing in the cases set out in Article 18 GDPR;
• object to processing based on legitimate interest, and at any time and without justification to processing for direct marketing;
• data portability, for data processed by automated means on the basis of consent or contract;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• not be subject to decisions based solely on automated processing producing legal effects concerning you. We do not carry out such processing.

To exercise these rights, write to info@naildesignlibrarystore.com. We will respond within one month, extendable by two further months for complex requests. We may ask for information reasonably necessary to verify your identity.

You may also lodge a complaint with a supervisory authority, in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country of residence or workplace.

10. Additional Rights for California Residents

If you are a resident of California, you have the right to know what personal information we collect and how it is used and shared; to request deletion or correction of your personal information; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.

We do not sell personal information for money. However, the use of advertising and analytics cookies may constitute a "sale" or "sharing" under the CCPA/CPRA. You may opt out at any time by adjusting your cookie preferences on this website or by writing to info@naildesignlibrarystore.com.

We do not knowingly collect or sell the personal information of consumers under 16 years of age.

11. Additional Rights for UK Residents

If you are located in the United Kingdom, the rights described in section 9 apply to you under the UK GDPR. You may lodge a complaint with the Information Commissioner's Office (www.ico.org.uk).

12. Marketing Communications

If you consent, we may send you emails about our products, updates and offers. Every email includes an unsubscribe link, and you may also unsubscribe by writing to info@naildesignlibrarystore.com.

Where permitted by applicable law, we may send commercial communications about similar products to customers who have already purchased from us, on the basis of legitimate interest, with the same right to object at any time.

13. Cookies

This website uses cookies and similar technologies. Detailed information on the cookies used, their purposes and duration, and how to manage your preferences, is set out in our Cookie Policy.

Non-essential cookies are only installed after you have given consent through the cookie banner. You may modify or withdraw your preferences at any time.

14. Security

We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure, including encrypted connections, access controls and the selection of providers offering adequate guarantees.

No transmission over the internet can be guaranteed as completely secure. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, the individuals concerned, in accordance with Articles 33 and 34 GDPR.

15. Minors

Our products and this website are directed to adults. We do not knowingly collect personal data from persons under 18 years of age. If you believe that a minor has provided us with personal data, contact us at info@naildesignlibrarystore.com and we will delete it.

16. Third-Party Links

This website may contain links to third-party websites and platforms. We are not responsible for their privacy practices. We recommend that you read the privacy policy of each site you visit.

17. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our processing activities or in applicable law. The version published on this page is the version in force, and the date of the last update is shown at the top. Where changes are material, we will inform you by appropriate means.

18. Contact

ERREVU' S.R.L. info@naildesignlibrarystore.com support@naildesignlibrarystore.com PEC: srlerrevu@pec.it

ERREVU' S.R.L. — VAT No. IT02063590471