Skip to content

Document · version 2026-09

Privacy Policy

How Parea Sons processes the personal data of those who visit this site, create an account on it, or send us an order enquiry, under Articles 13 and 14 of Regulation (EU) 2016/679 and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

Draft pending approval. This text is a faithful and complete description of what the site does today; it has not yet been through legal review, which is the last step before publication.

1 · Who processes your data

The data controller is Parea Sons S.r.l., registered and operating office at Via dei Carretti 1, 25040 Corte Franca (BS), Italy, VAT and tax number 02787750989, entered in the Brescia Companies Register under REA no. BS-478251, in the person of its legal representative for the time being.

For anything concerning your data you can write to [email protected] or to our certified email address [email protected].

Data Protection Officer (DPO): none has been appointed, because none of the three cases in article 37 of the Regulation applies — we are not a public authority, our processing does not require regular and systematic monitoring of data subjects on a large scale, and we do not process special categories of data on a large scale. The assessment behind this conclusion is written down and kept on file, and is reviewed whenever something changes: should one of those three conditions ever apply, a DPO will be appointed and this line will change.

2 · Your account

When you create an account we collect your email address, a password, your first name and surname, and — only if you choose to give it — a courtesy title. They let you sign in and let us recognise you: the legal basis is the performance of the service contract formed on registration (Art. 6(1)(b)).

Your password is not stored: we keep only a non-reversible cryptographic hash of it, computed with a different salt for every person. The original password cannot be recovered from our database, and not even we can read it.

The courtesy title is optional: you can leave it blank and the account works exactly the same. We do not use it to profile you.

When you register we send a verification link to the address you gave, to check that it is yours. The link expires after three days.

3 · Order enquiries

This site does not sell and does not take payment: from your bag you send an enquiry, and a person replies with availability, timings and confirmed prices. To do that we process your first name, surname, email address and — if you give them — telephone and organisation, together with the message you write and the list of garments that interest you, with their colours, sizes and quantities.

The legal basis is the performance of pre-contractual measures taken at your request (Art. 6(1)(b)): without this data we cannot reply to you, which is why the form asks for it.

An enquiry can be sent without an account. If you do have one, the enquiry stays linked to it and you will find it again in My Account.

We take your choices exactly as you made them, but the prices and garment names are rebuilt by our server from the catalogue rather than accepted from your browser: it is a security measure, and its effect is that the enquiry on record is the true one.

The form also has an optional box for receiving updates: it is separate, it starts unticked, and leaving it unticked changes nothing about the reply you receive. If you tick it, a message reaches you asking for confirmation, and until you open it we write you nothing else: how this works is in section 4.

3ter · Buying, and paying

When the shop is open, you can place an order from your bag and pay for it by card. To do that we process your first name, surname, email address, your telephone number if you give it, your delivery address and — if you ask for an invoice — your tax details, together with the garments ordered, with colour, size, quantity and price.

The legal basis is performance of the contract (art. 6.1.b) for the order, delivery, withdrawal and refund, and a legal obligation (art. 6.1.c) for keeping accounting records.

Your card details never pass through this site. The payment page belongs to Stripe Payments Europe Ltd, an Irish company we appoint as processor: only they see the number, expiry date and security code, and we neither see nor store them. Intra-group transfers to the United States take place under the standard contractual clauses and their adherence to the Data Privacy Framework.

Inside every order we keep the exact text of the conditions of sale you accepted, with its version and in the language you read it in — as we do for consents, and for the same reason: article 51(7) of the Italian Consumer Code requires us to give you confirmation of the contract on a durable medium, and a link to a web page is not one, because we can rewrite that page.

You can buy without an account. If you have one, the order stays linked to it and you will find it in My Account; if you later delete the account, the order remains but loses its link to you — it is an accounting record, not an accessory to your account.

To ship, we give your name and address to the carrier, which is GLS. If you withdraw, we also process the date of your declaration and — only if you write it — the reason: you are not required to give one, and the form says so.

3bis · The site assistant

At the bottom right there is a panel that answers questions about the garments, the colours, the sizes and the linen. An artificial intelligence system answers, not a person, and the panel says so before you can write: this is what art. 50 of Regulation (EU) 2024/1689 requires, in force since 2 August 2026.

We process the text of the questions you write and the language of the page. We do not ask who you are, we use no cookies for this, and we do not link questions to an account. The legal basis is our legitimate interest (art. 6.1.f) in assisting you while you browse the site.

The conversation is not kept. It lives in the page you opened and disappears when you close the panel: it does not reach our database and it does not stay on your device. That is why there is no history to ask us for.

To compose the answer, the question passes through Mistral AI SAS, a French company with infrastructure in the European Union, acting as data processor. Mistral keeps the traffic for a maximum of thirty days solely to monitor abuse, then deletes it.

The assistant takes no orders, records nothing, and must never ask you for payment details, passwords or identity documents: if it does, do not comply and write to us. To speak to a person, the panel has the Write to a person link, which leads to the enquiry form.

The assistant's answers are for information: what counts is the catalogue, the product page and what a person confirms to you.

4 · Consents, and how we prove them

If you choose to receive them, we process your email address to send you updates on our collections and, separately, to offer you selections based on your interests. The legal basis is your consent (art. 6.1.a), which is freely given, specific to each of the two purposes and withdrawable at any time — from My Account or from the link at the foot of every message — without having to give a reason and with no consequence for your account or your enquiries.

The two consents are separate and start switched off: the account is created identically without ticking either, as Art. 7(4) requires.

The letter is confirmed twice. When you ask to receive it — from the form at the foot of the pages, from registration or from an enquiry — we send you a message with a link to open, and until you open it we send you nothing else. It protects you before it protects us: without this second confirmation, anybody could subscribe anybody else's address. The link is valid for three days. If you have already confirmed your account address by opening the verification message, that confirmation counts for the letter too and we do not ask you for another.

For every subscription we keep a register under the same rule as consents: when you asked for it, when you confirmed it, when you withdrew it, with the exact text and the language of each occasion. At the foot of every letter there is the link to stop receiving it: one click, no explanation to give, no password to type. If you delete your account, the subscription and its register are deleted with it.

So that we can prove consent was given — as Art. 7(1) requires — we keep an append-only register: we do not update a row when you change your mind, we write a new one, with the date, the version of the document then in force and the exact text you were shown at that moment. We also record which language you read it in, because what has to be proved is the text you read, not its translation.

5 · Cookies and what is stored on your device

This site uses no profiling cookies, no analytics, no tracking pixels and no measurement tools, neither our own nor anyone else's. There is nothing to accept, which is why you will not find a cookie banner: none is needed.

The only two things the site writes to your device are:

  • a technical session cookie, called ps_sessione, which is created only when you sign in and keeps the session open. It is readable only by our server and not by other scripts (HttpOnly), it does not travel to other sites (SameSite=Lax), and it expires after thirty days or when you sign out.
  • the favourites and bag lists, in the browser's local storage (localStorage). They stay on your device: they are not sent to us and we do not keep them, and they are erased by clearing the site's data from your browser. They become ours only at the moment you press send on an order enquiry, and from then on section 3 applies to them.

Both are strictly necessary to provide services you asked for yourself, and for that reason they require no prior consent (Art. 122 of the Italian Electronic Communications Code and the Italian DPA's guidelines of 10 June 2021).

6 · How long we keep it

  • Account data: for as long as the account exists. If you ask us to delete it, we remove the data within thirty days.
  • Consent register: ten years from the last entry, including after withdrawal. That is the ordinary limitation period, and the time within which we might have to prove that consent was given. Assumption to be confirmed.
  • Register of subscriptions to the letter: ten years from the last entry, like the register of consents, whose rule it follows. If you delete your account, though, this goes too: there is no document to keep here, there is your email address — and keeping it in order to prove a consent to somebody who has just asked us to disappear would be the opposite of what you asked for.
  • Order enquiries: ten years. An enquiry is a commercial document — it records what was asked for on that day, at that price — and it survives the deletion of an account, but in that case it loses its link to the person.
  • Orders, deliveries and withdrawals: ten years from the date of the order. It is the longest period on the whole site, and it is not our choice: article 2220 of the Italian Civil Code imposes it for accounting records. For the same reason it does not shorten if you delete your account: the order remains, unlinked from you.
  • Sessions: thirty days, then they expire on their own. Changing your password closes all of them at once.
  • Tax documents arising from an order, if any: for the period required by tax law, currently ten years.

7 · Who we share it with

We do not sell your data and we do not pass it to third parties for their own purposes. We do not use it for behavioural advertising and we do not hand it to intermediaries.

The following may process it on our behalf and on our instructions, each appointed as a processor under Art. 28:

  • the hosting provider, which holds the database and the server's technical logs;
  • the email service provider, for the verification link, the replies to enquiries and the updates to those who asked for them;
  • Stripe Payments Europe Ltd, an Irish company, which runs the payment page and receives your name, email address and delivery address. Only they see your card details (section 3ter);
  • GLS, the carrier that delivers the parcel, which receives your name, your address and — if you gave it — your telephone number, so it can get in touch if nobody is there;
  • Mistral AI SAS, a French company with infrastructure in the European Union, which composes the answers of the site assistant (section 3bis) and keeps the traffic for at most thirty days solely to monitor abuse.

Technical logs. Like every web server, the one hosting this site records the requests it receives: IP address, date and time, resource requested and outcome. They serve the security and sound running of the service, and the legal basis is our legitimate interest in keeping it up and safe from abuse (Art. 6(1)(f)). We do not cross-reference them with your account and we do not use them to profile you. Assumption to be confirmed: content and retention depend on the hosting contract.

Transfers outside the European Economic Area: we make none. Our suppliers are chosen because they process the data within the European Union. If that were ever to change, we would say so here — naming the country and the safeguard, an adequacy decision or standard contractual clauses — before it happened.

8 · Your rights

At any time you may ask us to:

  • tell you whether we process data concerning you and give you a copy of it (art. 15);
  • correct it, if it is wrong or incomplete (art. 16);
  • erase it (art. 17);
  • restrict its processing (art. 18);
  • give it to you in a machine-readable format, or transmit it to another controller (art. 20);
  • object to processing based on legitimate interest (art. 21).

You may also withdraw your consents at any time from My Account or by writing to us. Withdrawal takes effect from that moment onwards and does not make unlawful what was done before.

Requests go to [email protected]. We reply within one month; if the request is complex that period may be extended by two months, and we will tell you beforehand if so. We charge nothing for replying.

If you believe the processing breaches the Regulation you may complain to the Italian Data Protection Authority (garanteprivacy.it) or to the supervisory authority of the country where you live, or bring proceedings before a court.

9 · How we keep it safe

The measures we take, concretely (Art. 32):

  • passwords are not stored, only their cryptographic hash, with a different salt for each one and a comparison that reveals nothing even from the time it takes;
  • of the session code the database keeps only a hash: anyone reading the database could not use an open session;
  • repeated sign-in attempts from the same connection are throttled;
  • a wrong email address and a wrong password give exactly the same answer, so as not to reveal who is registered;
  • the pages cannot be framed by other sites, and requests that change anything must originate from this site.

10 · Automated decisions

We do not take decisions concerning you based solely on automated processing and producing legal effects on you (art. 22).

If you give the second consent, the selections we show you may be chosen on the basis of your interests: this is profiling for commercial purposes, it does not affect your rights, and it stops when that consent is withdrawn.

11 · Minors

The service is intended for adults. On registration you declare that you are at least 18 years old. If we become aware that an account belongs to a minor, we delete it.

12 · Changes

If we change this document we publish a new version with its own date. Where the change concerns purposes for which you have given consent, we ask you again rather than taking it as given.

Version 2026-09 · last revised 15 September 2026