Privacy Policy

Owner: LUNETOS, Via da completare, Italy, VAT number da completare.

To exercise your rights or for any questions regarding data processing, write to privacy@lunetos.market. If a Data Protection Officer is appointed, their contact details are published at this same address.

Account data: first name, last name, email address, encrypted password, preferred language and currency, profile picture if uploaded.

Listing and catalog data: texts, photographs of items and their markings, prices, measurements, and declared conditions.

Order and shipping data: delivery address, order number, amounts, payment status, courier, tracking number, delivery outcome.

Payment data: transaction identifiers, outcomes, last four digits and card network provided by the payment provider. We do not receive or store the full card number.

Communications: messages exchanged between buyer and seller, support requests, evidence attached to disputes.

Technical and usage data: IP address, device and browser type, pages visited, searches performed, interactions with sponsored ads (views and clicks), security logs.

Optional data: fit measurements and preferences; images used by the try-on feature are processed locally on your device and are not uploaded to our servers or stored.

We do not request special categories of data under art. 9 GDPR. If an optical prescription or health-related data is spontaneously indicated in an advertisement or message, we request its removal.

Account creation and management, listing publication, order management, protected payments, shipments, disputes, and refunds: performance of the contract (Art. 6.1.b GDPR).

Service communications related to accounts, listings, orders, and disputes, including email and push notifications: contract performance (Art. 6.1.b).

Formal review of listings, moderation, prevention of fraud, counterfeiting and abuse, platform security: legitimate interest in maintaining a safe and reliable environment (Art. 6.1.f).

Invoicing of sponsorships, accounting, tax and anti-money laundering compliance, response to competent authorities: legal obligation (art. 6.1.c).

Measurement of sponsored ad performance, aggregate statistics, and service improvement: legitimate interest (art. 6.1.f) for essential measures; consent (art. 6.1.a) for non-essential cookies and analytics tools.

Newsletter and promotional communications: consent (art. 6.1.a), revocable at any time via the unsubscribe link or notification preferences.

Browser or app push notifications: consent expressed via system permission, revocable from device settings.

We communicate data only to parties necessary for the service, bound by agreements pursuant to Art. 28 GDPR: platform hosting and database provider, payment service provider (Stripe, which also acts as an independent data controller for its anti-fraud and anti-money laundering obligations), shipping and label provider (Sendcloud) and appointed carriers, transactional email and push notification sending provider.

To the other party of a transaction, we communicate the data essential to conclude it: to the seller, the buyer's name and delivery address; to the buyer, the seller's public name and shipping tracking data.

We may communicate data to judicial authorities, law enforcement agencies, and rights holders when required by a legal obligation or to assert a right in court.

Some providers may process data outside the EEA. In such cases, the transfer takes place on the basis of an adequacy decision by the European Commission or Standard Contractual Clauses, accompanied where necessary by supplementary measures.

You can request a copy of the applied guarantees by writing to privacy@lunetos.market.

Account data: for the duration of the account and for 12 months from closure, to manage late disputes and security obligations.

Order, payment, and billing data: 10 years from the conclusion of the transaction, as required by civil and tax law.

Listings and related photographs: until deletion by the user; model catalog data, devoid of personal references, may be retained for historical and statistical purposes.

Dispute messages and materials: 24 months from case closure.

Technical and security logs: up to 12 months.

Data collected based on consent: until revocation.

You can exercise your rights of access, rectification, erasure, restriction, data portability, and objection to processing based on legitimate interest (articles 15-22 GDPR) at any time, in addition to revoking any consents given.

Requests should be sent to privacy@lunetos.market and will receive a response within one month, extendable by two months for complex requests. Some information may be retained even after a deletion request when there is a legal obligation or the need to defend a right in court.

If you believe that the processing violates the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) (www.garanteprivacy.it) or with the supervisory authority of your country of habitual residence.

We use automatic controls on images and listing data, and anti-fraud systems on payments. These controls can temporarily suspend a listing or an order, but every definitive decision on removals, suspensions, and disputes is subject to human review.

The sorting of search results depends on relevance to the query, selected filters, requested sorting, and, in spaces marked with the label “Sponsored”, on paid sponsorship purchased by the seller. We do not profile users to determine prices.

We use technical cookies necessary for authentication, security, language, currency, and the functioning of the cart and payment: they do not require consent.

Non-essential cookies and measurement/statistical identifiers are activated only with your prior consent, which you can modify or revoke at any time from the site's cookie settings.

The installable version of the platform (PWA) stores data on the device for offline operation: you can remove them by uninstalling the app or clearing site data from your browser.

The platform is reserved for adults. We do not knowingly process data of minors under 18; if we detect an account belonging to a minor, we close it and delete the associated data.

We adopt appropriate technical and organizational measures: encryption in transit, role-based access controls, data isolation per user at database level, logging of administrative activities, and private storage of uploaded files.

We may update this policy; relevant changes are communicated to registered users. The current version is always the one published at https://lunetos.com/privacy.