Cart0 item(s) - 0.00€ 0

  • Your shopping cart is empty!

Privacy Policy

Privacy Policy – Kite Wild

Last updated: 18/05/2026

This privacy policy is provided pursuant to Articles 12, 13 and, where applicable, 14 of Regulation (EU) 2016/679 (“GDPR”) and describes how the ecommerce website Kite Wild, available at https://kitewild.com, processes the personal data of users who browse the website and/or purchase sports products online.

1. Data Controller

The Data Controller is:

SAND SRL SOC. SPORTIVA DILETTANTISTICA
Via per Campeggio, Porto Pollo
07020 Palau (OT), Italy
VAT No./Tax Code: IT02899260901
Privacy email: shop@kitewild.com

The Data Controller may be contacted for any request relating to the processing of personal data and the exercise of privacy rights.

2. Categories of personal data processed

The website processes the following categories of personal data.

Browsing data: IP address, online identifiers, technical data relating to the browser and device, pages visited, date and time of access, data collected through technical cookies and, subject to consent, through Google Analytics 4.

Data for purchases and order management: first name, last name, email address, telephone number, billing address, shipping address, order-related data, purchased products, amounts, order and shipping status.

Payment data: in the case of bank transfer, the data necessary to reconcile the payment; in the case of PayPal, transaction data, payment outcome and identifiers communicated by PayPal. The website does not process or store PayPal credentials, full payment card data or equivalent payment instruments managed directly by the payment provider.

Communication data: data contained in requests sent by email, contact forms, customer support requests or other communications with the Data Controller.

The website does not intentionally process special categories of personal data pursuant to Article 9 GDPR, nor data relating to criminal convictions and offences pursuant to Article 10 GDPR.

3. Purposes and legal bases of processing

Personal data is processed for the following purposes.

a) Website browsing and technical operation

Browsing data and technical cookies are processed to ensure the proper functioning of the website, security, session management, page display and use of the shopping cart.

Legal basis: the legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR and, where the processing is necessary to provide a service requested by the user, Article 6(1)(b) GDPR. Consent is not required for technical cookies, without prejudice to the obligation to provide information under the applicable legislation.

b) Ecommerce order management

The data provided during the purchase process is processed to receive, confirm, process and deliver orders, manage the shopping cart, communicate order updates and fulfil contractual obligations.

Legal basis: performance of a contract or pre-contractual measures requested by the data subject, pursuant to Article 6(1)(b) GDPR.

c) Payments

The data is processed to receive and verify payments made by bank transfer or PayPal.

Legal basis: performance of the contract pursuant to Article 6(1)(b) GDPR; compliance with legal and tax obligations pursuant to Article 6(1)(c) GDPR.

For payments made through PayPal, some personal data may be processed directly by PayPal in accordance with its privacy policy and as an independent data controller or according to the role applicable from time to time to the services provided. PayPal states in its privacy policy that the processing of data shared directly with third parties is also governed by the privacy policies of those parties and that data may be communicated to service providers, partners and payment network entities.

d) Invoicing, accounting and legal obligations

The data is processed for the issuance of tax documents, accounting records and administrative, tax and civil law compliance.

Legal basis: compliance with a legal obligation pursuant to Article 6(1)(c) GDPR.

Accounting records and invoices must be retained for ten years pursuant to Article 2220 of the Italian Civil Code.

e) Shipping and delivery of products

First name, last name, address, telephone number and order data may be communicated to couriers and logistics providers in order to deliver the purchased products and send any shipping notifications.

Legal basis: performance of the contract pursuant to Article 6(1)(b) GDPR.

f) Customer support and request management

Data voluntarily provided by the user is processed to respond to information requests, after-sales support requests, complaints, returns, warranties and communications relating to orders.

Legal basis: performance of the contract or pre-contractual measures pursuant to Article 6(1)(b) GDPR; legitimate interest of the Data Controller in properly managing received requests pursuant to Article 6(1)(f) GDPR.

g) Protection of the Data Controller’s rights

Data may be processed to establish, exercise or defend a legal claim in judicial or extrajudicial proceedings, and to prevent fraud, abuse or unlawful use of the website.

Legal basis: legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR.

h) Statistics and measurement through Google Analytics 4

The website uses Google Analytics 4 to obtain aggregated statistics on website usage, understand page performance and improve the user experience.

The Data Controller declares that it does not use Google Analytics 4 for remarketing, retargeting or advertising profiling, and that it does not send newsletters.

Where required, Google Analytics 4 is used only with the user’s prior consent through the cookie banner. Consent may be withdrawn at any time through the cookie management panel available on the website.

Legal basis: consent of the data subject pursuant to Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code for the use of non-technical cookies or tracking tools.

The Italian Data Protection Authority’s Guidelines on cookies and other tracking tools require information and online consent where necessary; Google also states that GA4 provides controls for user/event data retention and dedicated privacy settings.

4. Nature of data provision

The provision of data necessary for purchase, payment, invoicing and shipping is required in order to conclude and perform the sales contract. Failure to provide such data prevents the Data Controller from processing the order.

The provision of the telephone number is necessary for the operational management of the order, any urgent communications and shipping notifications.

The provision of data for statistical purposes through Google Analytics 4 is optional. Failure to give consent does not prevent browsing the website or purchasing products.

5. Methods of processing

Personal data is processed using electronic, IT and telematic tools, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality pursuant to Article 5 GDPR.

The Data Controller adopts appropriate technical and organisational measures pursuant to Article 32 GDPR to protect data against unauthorised access, loss, destruction, disclosure or unauthorised alteration.

6. Recipients of personal data

Personal data may be communicated to the following categories of recipients:

  • providers of the ecommerce platform, hosting, technical maintenance and IT security services;
  • payment service providers, including banks and PayPal;
  • couriers, shipping companies and logistics operators;
  • tax, accounting, legal and administrative consultants;
  • providers of management, invoicing and document retention systems;
  • Google Ireland Limited and/or Google group companies for Google Analytics 4, within the limits of the adopted settings;
  • public, tax, judicial or administrative authorities, where required by law.

Entities that process data on behalf of the Data Controller are appointed, where necessary, as data processors pursuant to Article 28 GDPR. Some entities, such as banks, PayPal, couriers or authorities, may act as independent data controllers according to their respective privacy policies.

7. Transfers of data outside the European Economic Area

Personal data is mainly processed within the European Economic Area.

The use of services provided by entities belonging to international groups, such as Google and PayPal, may involve transfers of data to countries outside the EEA. In such cases, the transfer takes place on the basis of an adequacy decision of the European Commission, standard contractual clauses, supplementary measures or other instruments provided for by Articles 44 et seq. GDPR, as applicable.

The European Commission recognises Standard Contractual Clauses as a tool for transferring personal data to third countries; PayPal states that, operating in several countries, data may be transferred to and processed outside the user’s country of residence; Google indicates specific measures and controls for data and privacy in the EU in relation to Google Analytics.

8. Retention periods

Personal data is retained for the time necessary to achieve the purposes for which it was collected and, subsequently, for the period required by legal obligations or for the protection of the Data Controller’s rights.

In particular:

  • data relating to orders, payments, invoicing and accounting: up to 10 years, subject to any further need to protect rights;
  • data relating to support requests or communications: for the time necessary to manage the request and, as a rule, no longer than [12/24] months, unless further retention is necessary;
  • technical security data: for the time strictly necessary for the technical management and security of the website;
  • data collected through Google Analytics 4: according to the retention settings configured in the GA4 property, to be verified and indicated in the Cookie Policy. Google indicates configurable periods for GA4, for example 2 or 14 months for standard properties.

9. Cookies and tracking tools

The website uses technical cookies necessary for the functioning of the website and, subject to the user’s consent, Google Analytics 4 for statistical purposes.

The website does not use cookies or tracking tools for remarketing, retargeting or the sending of personalised commercial communications, unless otherwise indicated in the future and subject to updating this policy and obtaining consent where necessary.

Cookies are managed through a dedicated cookie banner and preference panel. The user may accept, reject or modify their preferences at any time.

For detailed information on cookies, duration, providers and categories, please refer to the website’s Cookie Policy: [insert Cookie Policy link].

10. Newsletter and marketing communications

The Data Controller declares that the website does not send newsletters and does not carry out direct email marketing activities.

Any communications sent to the user relate exclusively to the order placed, payment, shipping, customer support or other aspects strictly connected to the contractual relationship.

Should newsletters or promotional communications be activated in the future, the Data Controller will update this policy and collect specific prior consent where necessary.

11. Automated decision-making and profiling

The Data Controller does not use users’ personal data for automated decision-making processes that produce legal effects or similarly significant effects on the data subject pursuant to Article 22 GDPR.

The website does not carry out advertising profiling, remarketing or retargeting activities.

12. Children’s data

The website and ecommerce services are not specifically intended for minors. If the Data Controller becomes aware that it has collected personal data relating to minors without an appropriate legal basis, it will delete such data within the limits provided by law.

13. Rights of the data subject

The data subject may exercise at any time the rights provided for by Articles 15-22 GDPR, including:

  • right of access to personal data;
  • right to rectification;
  • right to erasure;
  • right to restriction of processing;
  • right to data portability;
  • right to object;
  • right to withdraw consent, where processing is based on consent;
  • right not to be subject to a decision based solely on automated processing, where applicable.

The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise their rights, the data subject may contact the Data Controller at the following contact details:

Email: shop@kitewild.com
Address: SAND SRL SOC. SPORTIVA DILETTANTISTICA, Via per Campeggio, Porto Pollo, 07020 Palau (OT), Italy

The Italian Data Protection Authority specifies that the data subject may submit a request to the controller without particular formalities, for example by email or letter.

14. Complaint to the Supervisory Authority

The data subject has the right to lodge a complaint with the Italian Data Protection Authority pursuant to Article 77 GDPR if they believe that the processing of their personal data is carried out in breach of the applicable legislation.

The Italian Data Protection Authority identifies the complaint as a tool to report a violation of personal data protection legislation and request an investigation by the Authority.

15. Changes to this policy

The Data Controller reserves the right to modify or update this Privacy Policy at any time, including as a result of regulatory, technical or organisational changes.

Users are invited to consult this page periodically. In the event of significant changes, the Data Controller may highlight them on the website or through other appropriate channels.

Update cookies preferences