Privacy Policy

1. Introduction

This Privacy Policy explains how Ambassador Global S.r.l. (hereinafter "VC Gallery", "we", "us", "our") collects, uses, discloses, and protects your personal data when you visit our website vcgallery.it and its subdomains (the "Site"), place an order, request a quotation, apply for our Trade Program, subscribe to our newsletter, contact us, or otherwise interact with our services.

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), Italian Legislative Decree No. 196/2003 as amended by Legislative Decree No. 101/2018 (Italian Data Protection Code), and the guidelines issued by the Italian Data Protection Authority (Garante per la protezione dei dati personali).

2. Data Controller

The Data Controller is:

Ambassador Global S.r.l., a limited liability company incorporated under Italian law, with registered office at Via Valata 34/3, 33080 Zoppola (PN), Italy, registered with the Companies Register of Pordenone, VAT number IT01961190939, LEI code 8156008150680A6AD528, ATECO classification 46.47.30 (wholesale of lighting equipment).

Operational address and showroom: Via Filippo Turati 3, 20121 Milano (MI), Italy.

Privacy contact: [email protected]
Telephone: +39 392 381 0531

We have not appointed a formal Data Protection Officer (DPO) as we are not required to do so under Article 37 GDPR. All privacy-related requests are handled by our internal privacy contact at [email protected].

3. Types of Personal Data We Collect

3.1 Data you provide directly

• Identity and contact data: first name, last name, email address, telephone number, delivery address, billing address.
• Order and transaction data: purchased products, order value, order date, invoice details, delivery preferences, communications about your order.
• Account data: if you create a customer account, your login credentials (email and password, the latter stored in encrypted form by Shopify), order history, saved addresses, wishlist items.
• Trade Program data: if you apply to our Trade Program for architects, interior designers, hospitality operators and other professionals, we collect additional information including your business name, professional role, portfolio references or website, VAT number (P.IVA), business address, project scope, and supporting documentation. This information is necessary to verify eligibility and to issue commercial documents.
• Communications data: the content of messages you send through our contact form, quote request form, trade application form, WhatsApp, email, live chat, or telephone.
• Marketing consent data: your consent to receive our newsletter and marketing communications, and any withdrawal of such consent.
• Review data: if you leave a review on Trustpilot, Google, Judge.me or another platform after your purchase, we may receive the content of your review and any identifiers you choose to share.

3.2 Data collected automatically

When you browse the Site, we and our service providers collect the following data through cookies, pixels, tags, server logs and similar technologies:

• Device and browser data: IP address, browser type and version, operating system, device type, screen resolution, language settings, referring URL.
• Usage data: pages visited, time spent on pages, click paths, scroll depth, search queries within the Site, products viewed, items added to cart, items removed from cart, checkout progress, session recordings and heatmaps (via Microsoft Clarity), form interactions.
• Advertising and attribution identifiers: cookies and identifiers set by advertising platforms (Google Ads, Meta, TikTok, Pinterest, Microsoft Advertising) to measure ad performance and enable retargeting.
• Marketing automation identifiers: identifiers set by our marketing automation platform (HubSpot) to link your interactions across the Site, forms, chat and email.

3.3 Data received from third parties

• Payment status data from our payment processors (Shopify Payments, PayPal): the fact and status of your transaction, the last four digits of your card, and card brand. We do not receive or store your full card number.
• Shipping status data from our carriers (DHL and freight forwarders): tracking events, delivery confirmations, delivery incidents.
• Advertising performance data from advertising platforms: aggregated and conversion-level statistics about how you interacted with our advertisements.
• Public professional information for Trade Program applicants: publicly available information about your professional activity that helps us verify your application.

4. Purposes and Legal Bases of Processing

We process your personal data for the following purposes and on the following legal bases under Article 6 GDPR.

Where processing is based on your consent, you may withdraw your consent at any time (see Section 8). Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Where processing is based on our legitimate interest, you have the right to object (see Section 8). We conduct a balancing test before relying on legitimate interest and can provide you with a summary of that assessment on request.

5. Cookies and Similar Technologies

5.1 What we use

Our Site uses cookies and similar tracking technologies. We manage cookie consent through a banner powered by the Pandectes GDPR Compliance app for Shopify. The banner is displayed on your first visit and lets you accept or manage your preferences.

Important transparency notice. At the time of publication of this Policy, some analytics, marketing and advertising cookies and pixels are set on your device on page load, before you make a consent choice. We are working to reconfigure our consent tool so that all non-essential cookies are blocked until you give consent. In the meantime, you can withdraw or modify your consent at any time through the "Cookie preferences" link accessible from the cookie banner, and you can also block or delete cookies directly through your browser settings. If you withdraw consent, we will stop the corresponding processing going forward and delete or anonymise the associated identifiers where technically possible.

5.2 Categories of cookies used

Strictly necessary cookies are required for the Site to function (shopping cart, checkout, currency selection, login session, security, load balancing, consent state). These do not require your consent.

Examples set by our Site: cart_currency, localization, _shopify_essential, _shopify_s, _shopify_y, _pandectes_gdpr, __cf_bm (Cloudflare bot management).

Analytics cookies measure how visitors use the Site so we can improve it. These require your consent.

Examples: _ga, _ga_CPBZYE3J1L (Google Analytics 4); _shopify_analytics, Shopify Monorail (Shopify analytics); _clck, _clsk, CLID, MUID, ANONCHK, MR, SM (Microsoft Clarity, including session recording and heatmaps); HubSpot __hstc, __hssc, __hssrc, hubspotutk (HubSpot analytics and identity).

Marketing and advertising cookies are used to deliver personalised advertising, measure ad performance, retarget visitors, and build audiences. These require your consent.

Examples: _gcl_au, cookies set by pagead2.googlesyndication.com and googletagmanager.com for Google Ads conversion ID AW-16624549803; _fbp, fr, cfz_facebook-pixel (Meta Pixel); _ttp (TikTok Pixel); _pin_unauth, _pinterest_ct_ua (Pinterest Tag); SRM_B, MUID, MR on .bing.com (Microsoft Advertising); _shopify_marketing, _shop_app_essential; HubSpot advertising and forms pixels (hsadspixel.net, hs-banner.com, hsforms.com).

Chat and live support cookies enable our live chat and AI-assisted chat features. These are treated as marketing cookies and require your consent.

Examples: messagesUtk, cfz_hubspot, cfzs_hubspot.

Retention periods for individual cookies range from the current session to 24 months, depending on the specific cookie. You can view the detailed retention of each cookie in your browser's developer tools or through our cookie preference centre.

5.3 How to manage cookies

You can manage cookies as follows:

• Open the "Cookie preferences" link available from the cookie banner or in the footer of any page of the Site.
• Configure your browser to block cookies, delete existing cookies, or receive a warning before a cookie is stored. Instructions are available in your browser's help documentation (Chrome, Firefox, Safari, Edge and others provide their own controls).
• Opt out of interest-based advertising through industry tools such as Your Online Choices, Google Ads Settings, Meta Ad Preferences and equivalent settings on TikTok, Pinterest and Microsoft.

Please note that blocking strictly necessary cookies may prevent parts of the Site from functioning correctly, in particular the shopping cart and checkout.

6. AI-Assisted Chat

Our Site offers a chat function that combines human agents and AI-assisted responses (approximately half of interactions are handled with AI assistance, the other half by our human team). The AI is used as a tool to understand your question and prepare relevant answers; final responses are supervised by our team, and no fully automated decision producing legal effects concerning you or similarly significantly affecting you is taken through this channel (Article 22 GDPR does not apply). The AI does not have the goal of collecting your personal data; where personal data is entered into the chat, we treat it in accordance with this Policy.

You can always request to speak with a human agent by asking directly in the chat, or by contacting us at [email protected] or +39 392 381 0531.

7. Recipients and Categories of Processors

We share your personal data with the following categories of recipients, all of whom act as processors on our behalf under Article 28 GDPR (unless indicated otherwise) and are bound by written data-processing agreements.

• E-commerce platform: Shopify International Limited (Ireland), which hosts our Site, order database and customer accounts.
• Payment service providers: Shopify Payments (operated by Stripe Payments Europe Ltd, Ireland) and PayPal (Europe) S.à r.l. et Cie S.C.A. (Luxembourg). Payment providers act as independent controllers for the purpose of processing your payment and complying with financial-services regulations.
• Shipping carriers: DHL Express and its affiliated companies for lighting and small-parcel shipments; freight forwarders and logistics partners engaged case-by-case for furniture deliveries. Carriers act as independent controllers when carrying out delivery services under their own transport contract.
• Marketing automation and CRM: HubSpot Ireland Limited (Ireland), for newsletter delivery, forms, live chat, CRM and marketing analytics. HubSpot EU data residency is used where available (region-EU endpoints).
• Advertising platforms: Google Ireland Limited (Google Ads, Google Analytics 4, Google Tag Manager), Meta Platforms Ireland Limited (Meta Pixel), TikTok Technology Limited (TikTok Pixel), Pinterest Europe Limited (Pinterest Tag), Microsoft Ireland Operations Limited (Microsoft Advertising / Bing Ads and Microsoft Clarity). These platforms typically act as joint controllers with us for the collection of data through their pixels and as independent controllers for their own uses of the data.
• Session analytics: Microsoft Ireland Operations Limited (Microsoft Clarity) for session recording and heatmaps.
• Reviews platforms: Trustpilot A/S (Denmark), Google Ireland Limited (Google reviews), Judge.me (Ireland). Reviews platforms act as independent controllers for the reviews they publish.
• IT infrastructure and security: Cloudflare Ireland Limited for bot management, DDoS protection and content delivery.
• Professional advisors: accountants, tax advisors, and lawyers, where necessary for the establishment, exercise or defence of legal claims or the compliance with legal obligations.
• Public authorities: where required by law, including tax authorities, courts, law-enforcement authorities and regulators.

We do not sell your personal data to third parties.

8. International Data Transfers

Some of our recipients are established outside the European Economic Area (EEA) or process data through infrastructure located outside the EEA, in particular in the United States (Meta, TikTok, Pinterest, Microsoft, Google, HubSpot US infrastructure where applicable, Shopify).

Where a transfer takes place, we rely on one of the following safeguards under Chapter V of the GDPR:

• Adequacy decisions issued by the European Commission (for example, the EU-U.S. Data Privacy Framework where the recipient is certified);
• Standard Contractual Clauses (SCCs) adopted by the European Commission, complemented by supplementary technical and organisational measures where necessary;
• Derogations under Article 49 GDPR in specific, limited situations such as your explicit consent or the performance of a contract you requested.

You can request a copy of the transfer safeguards applicable to any specific processor by writing to [email protected].

9. Retention

We retain your personal data for as long as necessary for the purposes described in this Policy and in accordance with applicable legal, accounting and tax requirements.

Indicative retention periods:

• Order, invoice and accounting records: 10 years from the end of the fiscal year, in accordance with Article 2220 of the Italian Civil Code and Italian tax legislation.
• Customer accounts: for the duration of the account plus 24 months of inactivity, after which we delete or anonymise inactive accounts.
• Trade Program records: for the duration of the professional relationship plus 10 years after its termination, for accounting and legal-defence purposes.
• Contact, quote and support inquiries not leading to a contract: 24 months from the last interaction.
• Marketing consent and newsletter subscribers: until you withdraw consent or unsubscribe, plus a short technical retention (up to 12 months) to prove compliance with opt-out.
• Cookie identifiers and analytics data: as indicated in Section 5, up to 24 months.
• Session recordings (Microsoft Clarity): in line with Clarity's default retention, generally up to 13 months.
• Server and security logs: up to 12 months, unless a longer retention is necessary for a security investigation.

At the end of the applicable retention period we delete, anonymise, or securely archive the data. Where longer retention is required for the establishment, exercise or defence of legal claims, we keep only the data strictly necessary for that purpose.

10. Your Rights

Subject to the conditions and exceptions set out in the GDPR, you have the following rights:

• Right of access (Article 15): obtain confirmation as to whether we process your personal data and, if so, receive a copy.
• Right to rectification (Article 16): obtain the correction of inaccurate or incomplete data.
• Right to erasure (Article 17), also known as the "right to be forgotten", in the cases provided by law.
• Right to restriction of processing (Article 18) in the cases provided by law.
• Right to data portability (Article 20): receive the data you provided to us in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
• Right to object (Article 21) to processing based on our legitimate interest, including profiling, and in particular to object to direct marketing at any time.
• Right to withdraw consent (Article 7(3)) where processing is based on consent, at any time and without giving a reason. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right not to be subject to a decision based solely on automated processing (Article 22). As explained in Section 6, we do not use fully automated decision-making that produces legal effects concerning you.
• Right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it) or with the supervisory authority of your country of residence, place of work, or place of the alleged infringement.

To exercise any of these rights, please write to [email protected]. We will respond without undue delay and in any event within one month of receipt, extendable by two further months where necessary given the complexity and number of requests. We may ask you to provide reasonable information to confirm your identity before acting on your request.

There is no charge for exercising your rights, unless your requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act.

11. Marketing Communications and Withdrawal

If you have consented to receive our newsletter or other marketing communications, you can withdraw your consent at any time by:

• clicking the "unsubscribe" link at the bottom of any marketing email we send;
• managing your preferences in your customer account;
• writing to [email protected].

Withdrawal takes effect promptly. We may keep a limited record of your unsubscribe request to prove compliance with your choice.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include HTTPS/TLS encryption of the Site, access controls, authentication requirements for our team, logging and monitoring, backups, and vendor selection based on their security posture. No system is completely secure, and we cannot guarantee absolute security.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Italian Data Protection Authority within 72 hours as required by Article 33 GDPR and, where the risk is high, we will also inform you directly under Article 34 GDPR.

13. Children

Our Site is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact [email protected] and we will delete the data.

14. Links to Third-Party Sites

Our Site may contain links to third-party websites (for example, our official brand partners, designer portfolios, review platforms, or social media). We are not responsible for the privacy practices of those third parties. We recommend that you review their privacy policies before providing them with personal data.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. The updated version will be posted on this page with a revised "Last updated" date. Where the changes are material, we will notify you by a prominent notice on the Site or, where appropriate, by email.

16. Contact

For any question about this Privacy Policy or to exercise your rights, please contact:

Ambassador Global S.r.l. (VC Gallery)
Privacy contact: [email protected]
Telephone: +39 392 381 0531
Showroom and correspondence address: Via Filippo Turati 3, 20121 Milano (MI), Italy
Registered office: Via Valata 34/3, 33080 Zoppola (PN), Italy