Privacy policy

Draft under review. The highlighted fields must be completed by the owner and the text checked by a legal adviser before final publication.

1. Data controller

The data controller is [TO COMPLETE: registered name and address], trading as Astrabyss Watches · VAT no. IT09487381213 · Italy · email lab@astrabyss.it · phone and WhatsApp +39 388 157 5268.

For any question about your personal data, write to lab@astrabyss.it.

2. What data we collect

Request form. When you press "Send request", the site sends the fields to our server function, which passes the message to FormSubmit (formsubmit.co), the delivery service that emails it to the lab's mailbox. FormSubmit acts as our data processor and handles the submission only on our instructions; we do not keep a database of requests. The data is: name and surname, email address, chosen reference or part, bracelet or strap, delivery address and any notes.

Email and WhatsApp. If you write to us directly, we receive your contact details and whatever you include in the message.

Orders. To fulfil an order we process billing and shipping details, phone number for the courier, the order itself and its payment status. Card or PayPal details are entered on the payment provider's secure page and are never seen or stored by the lab.

Browsing data. Like every website, the servers of our hosting provider record technical data needed to deliver the pages and keep them secure (IP address, date and time, page requested, browser). The approximate country derived from the IP address is used, without being stored by us, only to show the site in Italian or English on the first visit.

We do not use analytics, advertising or profiling tools. See the cookie policy.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
Replying to your requests and preparing the order confirmation	Pre-contractual steps taken at your request, art. 6(1)(b)
Assembling, shipping and delivering the watch, handling returns, warranty and servicing	Performance of the contract, art. 6(1)(b)
Invoicing, accounting and tax obligations	Legal obligation, art. 6(1)(c)
Site security and defence of legal claims	Legitimate interest, art. 6(1)(f)

We do not send newsletters or marketing messages. If we ever do, we will ask for your consent first.

Providing the data is optional, but without it we cannot reply to your request or process the order.

4. How long we keep it

• Requests not followed by an order: for the time needed to answer, then for no longer than [TO COMPLETE: retention period, e.g. 24 months].
• Order, invoicing and accounting data: 10 years, as required by Italian law (art. 2220 Civil Code).
• Data needed for the warranty and servicing of a numbered watch: for the duration of the warranty and of any service relationship.
• Technical server logs: kept by the hosting provider for a short period, under its own policy.

5. Who receives the data

Data is processed by the lab's staff and, only as far as needed, by:

• the hosting provider of the site (Vercel Inc.);
• the form delivery service (FormSubmit, formsubmit.co), which emails the request to the lab;
• the email provider of the lab (Google Workspace, Google Ireland Ltd.);
• the courier (UPS) for shipping and delivery;
• payment providers (card circuits, PayPal, the lab's bank) for payments and refunds;
• the lab's accountant and tax advisers;
• public authorities, where required by law.

Data is never sold or disclosed for marketing.

6. Transfers outside the EU

Some of the providers above (for example Vercel and FormSubmit) are based in the United States. Transfers take place under the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses (art. 45 and 46 GDPR).

7. Your rights

At any time you can ask for access to your data, its rectification or erasure, the restriction of processing, data portability, or object to processing based on legitimate interest (articles 15–22 GDPR). Where processing is based on consent, you can withdraw it at any time. Write to lab@astrabyss.it: we reply within one month.

You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the EU country where you live or work.

No decisions are taken by automated means or profiling.

8. Changes

We may update this policy. The current version is always on this page, with its date.

Draft of 1 October 2026