Privacy Policy

1. Data Controller

Sword Academy SSD (an Italian amateur sports club), registered at Via Varesina 90A, 22079 Villa Guardia (CO), Italy (VAT IT04251530137), is the data controller for personal data collected through this website (shop@sword.academy).

2. Data Collected

We collect the following personal data solely for order fulfilment purposes:

• First and last name
• Email address
• Shipping address (street, city, postal code, country)
• Phone number (optional; the courier needs it for Express shipping)

Payment data is handled exclusively by Stripe, Inc. and is never transmitted to our servers.

Only if you accept, we also collect browsing data through Google Analytics: see section 9.

3. Purpose of Processing

Data is processed to:

• Process and ship your order via Printful
• Send an order confirmation email (via Resend)
• Comply with Italian tax and accounting obligations
• Only with your consent: visit and sales statistics, and measuring our campaigns (section 9)

4. Legal Basis

Processing is necessary for the performance of a contract (Art. 6(1)(b) GDPR) and to comply with legal obligations (Art. 6(1)(c) GDPR). The statistics in section 9 rely on your consent (Art. 6(1)(a) GDPR).

5. Data Recipients

• Printful, Inc. — production and order fulfilment (USA, with adequate safeguards under Art. 46 GDPR)
• Stripe, Inc. — payment processing (USA, DPF certified)
• Resend, Inc. — transactional email delivery (USA, with adequate safeguards under Art. 46 GDPR)
• Google Ireland Limited — statistics with Google Analytics, only with your consent (section 9)

6. Data Retention

Order data is retained for 10 years in accordance with Art. 2220 of the Italian Civil Code and Italian tax law.

7. Your Rights

Under the GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your data. To exercise your rights, write to shop@sword.academy.

8. Complaints

You have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

9. Cookies and Statistics

We use essential technical cookies, for example to remember your selected language or to keep you signed in to a members area, and, only if you accept, Google Analytics cookies.

Google Analytics is a service of Google Ireland Limited that we use for visit and sales statistics and to measure our campaigns. It runs in Consent Mode: until you accept in the banner, it stores no cookies and sends Google only anonymous, aggregate signals that don’t identify you. If you accept, it uses analytics cookies, also valid on sword.academy, the club’s website, to tell visits apart and link them to purchases. Your IP address is not stored, and the data stays in Google Analytics for at most 14 months. Google processes the data on our behalf and under its own privacy policy (policies.google.com/privacy), and may transfer it to the United States under the EU-US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can give or withdraw at any time from “Cookie preferences” at the bottom of every page.

Traffic statistics are also collected in aggregate and anonymously, server-side, without cookies. Payment takes place on Stripe’s hosted checkout page, which is subject to Stripe’s own privacy and cookie policies.

10. Club Contacts

If a club joins the service described in our Terms for Clubs, we process the data of its contact persons (name, role in the club, email address and any other contact details provided) and the content of our correspondence, to handle the request, previews, publication and removal of products, and the logo licence. Legal basis: performance of our agreement with the club and our legitimate interest in communicating with its representatives (Art. 6(1)(b) and (f) GDPR). We keep this data for as long as the service runs and, after the last product is removed, for 10 years (the ordinary Italian limitation period) to protect rights arising from the licence and the orders. We do not share it with third parties other than the providers of the email services we use. The rights listed in section 7 apply.

11. Members Area

Some clubs have an area reserved for their members, which you enter with the club’s Google account (for example @sword.academy). When you sign in, Google gives us only the account’s email address, which we use to check that it belongs to the club’s domain. We don’t store it: it only sits in a signed technical cookie that keeps you signed in for one hour and then expires. Legal basis: performance of the service you request (Art. 6(1)(b) GDPR).