Privacy policy
Oleaviva – Privacy Policy
Last updated: November 2025
1. About this Privacy Policy
This Privacy Policy explains how Oleaviva di Rizza Chiara ("Oleaviva", "we", "us", "our") collects, uses, discloses and protects personal data when you:
- visit or use our website www.oleaviva.com and any related subdomains (the "Site"); - purchase our products through the Site; or
- otherwise interact with us (for example, by contacting our customer support or subscribing to our newsletter).
This Policy should be read together with our Terms of Service and our Cookie Policy, which provide further details about how we use cookies and similar technologies.
When we use the term "personal data" we mean any information relating to an identified or identifiable natural person, as defined by applicable data protection laws such as the EU General Data Protection Regulation (GDPR) and the UK GDPR.
2. Data controller and contact details
For the purposes of the GDPR and UK GDPR, the data controller is:
Oleaviva di Rizza Chiara
Via Emanuele Filiberto 4
20149 Milano (MI) – Italy
Email: hello@oleaviva.com
If you have any questions about this Privacy Policy or about how we process your personal data, you can contact us using the email address above.
3. Personal data we collect
The categories of personal data that we collect depend on how you interact with us and with the Site.
3.1 Information you provide to us directly
We collect the information you provide when you:
- place an order on the Site;
- create or update an account;
- contact us (for example, by email or contact form);
- subscribe to our newsletter or marketing communications;
- take part in surveys, promotions or similar initiatives.
This information may include:
- Identification and contact details: first and last name, email address, telephone number, billing address, shipping address.
- Order and transaction data: details of the products you purchase, order number, purchase date, payment status, chosen shipping method, order notes.
- Payment information: we receive confirmation from our payment providers that a payment has been made or refused and certain limited details (for example, the last digits of the card, type of payment method). We do not receive or store full card numbers or CVV codes, which are processed securely by our payment providers.
- Account data: username or email used for login, hashed password, account preferences. - Communications and support data: content of messages, feedback, reviews and any information you choose to include when you contact us or interact with us.
3.2 Information collected automatically
When you visit the Site, we automatically collect certain information about your device and how you use the Site, for example:
- IP address;
- browser type and version, operating system, device type;
- language settings;
- country or approximate location inferred from IP address;
- pages visited, time and duration of visit, links clicked, referring URL (page from which you came to our Site); - identifiers associated with cookies or similar technologies.
We collect this information using cookies, pixels, tags and similar technologies. For more details on the cookies we use and how you can manage your preferences, please see our Cookie Policy.
3.3 Information from third parties
We may receive personal data about you from third parties, for example:
- from our payment providers, for the purposes of processing payments and preventing fraud; - from carriers and logistics partners, in relation to the delivery status of your orders;
- from analytics and advertising partners (for example, Google, Meta) in the form of aggregated or pseudonymised data about how users interact with our ads and with the Site;
- from social media platforms, if you interact with our official accounts or share our content.
4. Purposes and legal bases for processing
Where the GDPR or UK GDPR applies, we rely on specific legal bases to process your personal data. The main purposes and related legal bases are:
- To perform a contract with you or take steps at your request before entering into a contract: - to allow you to place orders and purchase our products;
- to process payments and manage billing;
- to arrange shipping and delivery;
- to manage returns, refunds and customer service;
- to manage your account on the Site.
- To comply with legal obligations:
- to comply with tax and accounting obligations;
- to respond to requests from public authorities;
- to respect applicable consumer protection laws;
- to manage your privacy and marketing preferences in line with legal requirements.
- Our legitimate interests, provided that your interests and fundamental rights do not override them: - to operate, maintain and improve the Site, our services and our business;
- to protect the security of the Site, our systems, our business and other users;
- to prevent, detect and investigate fraud and abuse;
- to understand how the Site is used and how our campaigns perform (for example, through aggregated analytics);
- to send marketing communications to existing customers about products similar to those already purchased, where permitted by law.
- Your consent:
- to send you newsletters or other marketing communications when you are not an existing customer and such consent is required;
- to use certain analytics, advertising or social media cookies and similar technologies, in jurisdictions where consent is required (for example, in the EEA and UK);
- to use certain data for personalised marketing, where required.
You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You can do this, for example, by:
- clicking the "unsubscribe" link in marketing emails; or
- contacting us at hello@oleaviva.com.
5. Marketing communications
If you choose to subscribe to our newsletter or to receive marketing communications, we may send you emails about:
- new products, special editions or limited releases;
- offers, promotions and discounts;
- content about olive oil, recipes and related topics;
- events or collaborations.
You can stop receiving marketing emails at any time by:
- clicking the "unsubscribe" link in the email; or
- contacting us at hello@oleaviva.com.
If you unsubscribe, we will stop using your email address for marketing, but we may still need to contact you for non-marketing purposes (for example, updates about your orders or important information about your account).
6. Cookies and similar technologies
We use cookies and similar technologies to make the Site work, to understand how it is used and, where permitted, to personalise content and advertising.
- Strictly necessary cookies are used to provide the core functionalities of the Site (for example, cart, checkout, account login). These cookies do not require your consent.
- Other cookies (for example, analytics or advertising cookies) are used only with your consent where required by law (for example, in the EEA and UK).
For more information on the types of cookies we use, the purposes for which we use them and how you can manage your preferences, please refer to our Cookie Policy.
7. Sharing your personal data
We do not sell your personal data. We only share your data with third parties in the following situations:
- Service providers (data processors):
- Our ecommerce platform provider (for example, Shopify), which hosts the online store and helps us manage orders and payments.
- Payment service providers and banks.
- Carriers, logistics and warehousing providers.
- IT and hosting providers.
- Email and marketing service providers.
- Analytics and advertising partners that help us understand how our Site and campaigns perform.
These providers may only process your personal data on our instructions and are required to protect it appropriately.
- Professional advisors and authorities:
- Lawyers, accountants, auditors and consultants, where necessary for legitimate business purposes and subject to confidentiality obligations.
- Public authorities, regulators, law enforcement or courts, where we are required to share information by law or where sharing is necessary to protect our rights or the rights of others.
- Business transfers:
- In connection with any merger, acquisition, sale of assets, reorganisation or similar transaction, your personal data may be transferred to the relevant third parties, subject to appropriate safeguards and in accordance with applicable law.
8. International data transfers
We are based in Italy, but some of our service providers may be located outside the European Economic Area (EEA) or the United Kingdom, or may store data on servers in other countries.
Where we transfer personal data to countries that do not provide the same level of data protection as the EEA or UK, we take appropriate measures to protect your data, for example by:
- relying on an adequacy decision by the European Commission or UK authorities (where applicable); or - entering into contracts with the recipient that include Standard Contractual Clauses or other approved safeguards.
You can contact us at hello@oleaviva.com if you would like more information about international transfers and the safeguards we use.
9. Data retention
We keep your personal data only for as long as necessary for the purposes for which it was collected, or as required by law.
In particular, we generally retain:
- order and invoicing data for the period required by tax and accounting laws (often 10 years in Italy); - account data for as long as your account is active and for a reasonable period thereafter if needed to manage any disputes;
- marketing data (for example, your email address for newsletters) until you withdraw your consent or unsubscribe, or after a period of inactivity;
- logs and analytics data for periods that are appropriate and proportionate to the purposes for which we use them.
10. Your rights (EEA and UK)
If you are in the EEA or the UK, you have certain rights in relation to your personal data, subject to conditions and exceptions set out in the law. These include the right to:
- access your personal data and receive a copy;
- request the correction of inaccurate or incomplete data;
- request the deletion of your data in certain circumstances ("right to be forgotten");
- request the restriction of processing in certain circumstances;
- object to processing based on our legitimate interests, including profiling;
- object at any time to the use of your data for direct marketing;
- withdraw your consent where processing is based on consent;
- receive your personal data in a structured, commonly used and machine-readable format, and transmit it to another controller (data portability), where technically feasible.
To exercise your rights, you can contact us at hello@oleaviva.com. We may need to verify your identity before responding to your request.
You also have the right to lodge a complaint with your local data protection authority, in particular in the country where you habitually live or work, or where you believe that your rights have been infringed.
11. Additional information for US residents
We do not specifically tailor this Privacy Policy to any particular US state law, but we aim to be transparent and to give you meaningful choices about your personal data.
If you are a resident of the United States, depending on your state, you may have certain rights, such as:
- the right to request access to the personal information we hold about you;
- the right to request deletion of your personal information, subject to certain exceptions; - the right to request correction of inaccurate personal information;
- the right to receive information about how we use and share your data.
We do not knowingly sell or share your personal information for cross-context behavioural advertising in the sense in which those terms are used in certain US state privacy laws. If this changes in the future, we will update this Policy and, where required, provide you with appropriate choices.
You can exercise any applicable rights by contacting us at hello@oleaviva.com. We may need to verify your identity before responding.
12. Security
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These measures include, for example, access controls, encryption in transit where appropriate, and limiting access to personal data to those who have a business need to know it.
However, no system is completely secure. You are responsible for keeping your account credentials and password confidential and for taking reasonable steps to protect your own information online.
If we become aware of a personal data breach that may pose a high risk to your rights and freedoms, we will notify you and the competent authorities where required by law.
13. Minors
The Site is not intended for individuals under the age of 18 and we do not knowingly collect personal data from minors. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at hello@oleaviva.com and we will take appropriate steps to delete the information.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example to reflect:
- changes in how we use personal data;
- changes in our products or services;
- changes in applicable laws or regulatory guidance.
When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, we may provide additional notice (for example, by email or by a notice on the Site).
We encourage you to review this Privacy Policy periodically.
15. Contact us
If you have any questions, comments or requests regarding this Privacy Policy or our privacy practices, you can contact us at:
Oleaviva di Rizza Chiara
Via Emanuele Filiberto 4
20149 Milano (MI) – Italy
Email: hello@oleaviva.com