Privacy Policy

PRIVACY POLICY

This notice is provided pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ("Regulation" or "GDPR") and Italian Legislative Decree No. 196 of 30 June 2003 ("Personal Data Protection Code" or "Privacy Code"). This notice is addressed to all natural persons who visit and/or use the Website, whether as mere Users or also as Customers, registered or not registered (hereinafter also "Data Subjects").

I) GENERAL PART

Art. 1 - Definitions

1.1 Unless otherwise expressly specified, the terms used in this Privacy Policy have the meaning attributed to them pursuant to Art. 2 of the T&C, as amended, which is hereby incorporated by reference in its entirety. The current version of the T&C is published at teburu.com and is accessible from the Website footer.

Art. 2 - Identity and Details of the Data Controller

2.1 The data controller is Xplored S.r.l. (VAT No. 01783080995), represented by its Sole Director and legal representative, Dr. Davide Garofalo, with registered office in Genoa (GE), Via San Vincenzo 79/2B, registered with the Genoa Register of Companies under R.E.A. No. GE - 435389, email: [email protected], certified email (PEC): [email protected] ("Xplored" or "Controller").

Art. 3 - Methods of Processing

3.1 Xplored collects only and exclusively the personal data necessary to fulfil the specific purposes for which such data is processed.

3.2 In relation to the purposes indicated below, the data collected is processed in compliance with the principles of lawfulness, fairness and transparency.

3.3 Xplored carries out periodic checks to verify the accuracy of the data in its possession and, where necessary, to update, rectify or erase it when inaccurate;

3.4 Xplored processes Data Subjects' data in such a way as to ensure its integrity and security, protecting it against unauthorised or unlawful processing and against accidental loss, destruction or damage, through the adoption of appropriate technical and organisational measures, which may be demonstrated upon request.

3.5 Data Subjects' data is processed both on paper and by electronic means.

Art. 4 - Disclosure and Transfer of Personal Data

4.1 Xplored reserves the right to disclose Data Subjects' personal data:

  • a) to its employees and collaborators, duly appointed and trained; such disclosure serves to ensure greater speed and efficiency of the service requested by Data Subjects;
  • b) to third parties – such as, by way of example and without limitation, debt collection companies, professionals, consultants, credit institutions and companies operating in the IT sector; such disclosure is aimed at ensuring compliance with a legal obligation and/or the protection of a right or legitimate interest of the Controller;
  • c) in the cases identified under Arts. 19, 24 and 29 of this Privacy Policy.

4.2 Outside the cases referred to in paragraph 4.1 above, disclosure to third parties is made only where one of the conditions of lawfulness provided for by applicable law is met.

4.3 Xplored also reserves the right to transfer Data Subjects' personal data to other countries of the European Union and/or to third countries and/or to international organisations that guarantee an adequate and consistent level of protection in light of the requirements of applicable law. In particular, transfers to countries outside the European Union and/or to international organisations shall take place only in accordance with the provisions of Articles 44 et seq. of the Regulation.

4.4 The disclosures and transfers referred to in paragraphs 4.1, 4.2 and 4.3 above take place in strict compliance with applicable law and ensuring broad protection of the rights of each data subject.

Art. 5 - Rights of Data Subjects and Procedure for Submitting a Request to Exercise Them

5.1 Data Subjects are recognised and guaranteed the rights set out in Articles 12 et seq. of the Regulation, as specified in more detail below.

5.2 In order to enable Xplored to respond promptly, each Data Subject must submit their request to exercise the rights referred to in the following articles, or even only one of them, to the following email address: [email protected].

Art. 6 - Right of Access

6.1 In accordance with the provisions of Art. 15 of the Regulation, each Data Subject has the right to obtain from the Controller confirmation as to whether or not personal data concerning them is being processed and, if so, access to the following information: a) purposes of the processing; b) categories of personal data concerned; c) recipients to whom the personal data has been or will be disclosed; d) retention period or the criteria used to determine it; e) rights that may be exercised and how to exercise them, such as: the right to request rectification and/or erasure of the data and/or restriction of processing, the right to object to processing, and the right to lodge a complaint with a supervisory authority; e) origin of the personal data collected; f) existence of automated decision-making, including profiling.

6.2 Where the right of access is exercised, Xplored shall provide a copy of the personal data undergoing processing and/or of the information requested.

Art. 7 - Right to Rectification and Erasure

7.1 Pursuant to Art. 16 of the Regulation, each Data Subject may request and obtain the rectification and/or completion of their personal data when inaccurate and/or incomplete.

7.2 Each Data Subject also has the right to request and obtain the erasure of their personal data where, alternatively: a) the data is processed unlawfully; b) the data is no longer necessary in relation to the purposes of the processing; c) the data must be erased to comply with a legal obligation to which the Controller is subject; d) the data was collected pursuant to Art. 8, paragraph 1, of the Regulation; e) the Data Subject has withdrawn the consent previously given as the legal basis for the processing or has objected to the processing pursuant to Art. 21 of the Regulation.

7.3 The request for erasure may also be made by the Data Subject through the "Delete User" function available in the personal area of the Website. Upon activation of this function, the Controller shall proceed to erase all personal data associated with the account for which there is no separate and residual legal basis justifying its retention. Erasure shall be completed without undue delay and, in any event, within 30 (thirty) days of receipt of the request, subject to the need to complete the technical deletion cycles from backup systems, of which the Data Subject shall be informed at the time of the request.

7.4 Notwithstanding the request for erasure, the Controller may continue to retain and process, to the extent strictly necessary, the Data Subject's personal data for which one of the exceptions provided for in Art. 17, paragraph 3, of the Regulation applies. In particular, the Controller is entitled to retain the data necessary to comply with legal obligations (including tax and accounting obligations) as well as the data necessary for the establishment, exercise or defence of legal claims in court. Data retained for such purposes may not be used for purposes other than those justifying its retention and, in particular, may not be used for account management or for marketing or profiling purposes concerning the Data Subject.

7.5 In the cases referred to in paragraph 7.4 above, the retained data shall be processed on a restricted basis pursuant to Art. 18 of the Regulation: it shall remain in the Controller's system exclusively for retention purposes, isolated from ordinary operations and not accessible except for the purposes that justify its continued retention, until the applicable retention period has expired.

7.6 The Controller may also continue to process, even after the request for erasure, data that has been irreversibly anonymised, that is, rendered permanently incapable of identifying the Data Subject, even indirectly. Such data, no longer constituting personal data within the meaning of Art. 4 of the Regulation, may be used for statistical purposes or to improve the performance of the Product or, more generally, of the services offered by Xplored, without this constituting processing contrary to the request for erasure received.

7.7 At the time of the request for erasure, the Controller shall provide the Data Subject with a response indicating: a) the data that will be erased immediately; b) the data that will be retained in restricted form pursuant to paragraph 7.5 above, with an indication of the relevant legal basis and the applicable retention period; c) the data that will be processed in anonymised form pursuant to paragraph 7.6 above; d) the expected timeframe for completion of the erasure operations. This communication fulfils the transparency obligation provided for in Art. 13 of the Regulation and enables the Data Subject to be fully aware of the practical consequences of exercising their right.

Art. 8 - Right to Restriction of Processing

8.1 Each Data Subject may obtain from the Controller restriction of processing where one of the cases referred to in Art. 18 of the Regulation applies.

Art. 9 - Right to Object to Processing

9.1 In accordance with the provisions of Art. 21 of the Regulation, each Data Subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them pursuant to Art. 6, paragraph 1, letter e) or f) of the Regulation, including profiling based on those provisions.

9.2 The Controller shall no longer process the personal data of the Data Subject making the request, unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or for the establishment, exercise or defence of legal claims in court.

Art. 10 - Right to Data Portability

10.1 Pursuant to Art. 20 of the Regulation, each Data Subject has the right to receive the personal data concerning them in a structured, commonly used and machine-readable format, or to request that such data be transmitted to another controller in an interoperable medium.

Art. 11 - Right to Lodge a Complaint with a Supervisory Authority

11.1 Where a User considers that the processing carried out by Xplored infringes the provisions of the GDPR, they may lodge a complaint with the competent supervisory authority, that is, the one located in the Member State where they habitually reside or work or in the place where the alleged infringement occurred.

II) PROCESSING OF DATA FOLLOWING REGISTRATION ON THE WEBSITE

Art. 12 - Scope of Application

12.1 This Title II) governs the processing of personal data provided to Xplored by the User who has decided to register on the Website, in the manner prescribed by Art. 4.B) of the T&C.

Art. 13 - Purposes and Legal Basis of the Processing

13.1 The processing of personal data collected for the reasons referred to in Art. 12 above is aimed at enabling Xplored:

  • a) to create and associate with the User a personal account, which allows the User: to access special discounts reserved only for the most loyal registered Users; to receive personalised or reserved promotions; to keep track of their gaming activity; to view the history of orders placed through the Store; to manage their personal data; to manage their commercial communication preferences; and to use the electronic withdrawal function as provided for in Art. 17.1 of the T&C. The creation of the User's personal account by Xplored constitutes the fulfilment of the request made to that effect by the User upon registration on the Website and, accordingly, the related processing of personal data is justified by the Controller's need to perform the contract to which the Data Subject is party and/or pre-contractual measures taken at the Data Subject's request;
  • b) to comply with the legal obligations incumbent upon it under applicable law and, in particular, under tax and administrative legislation; in this case, the legal basis for the processing is, precisely, compliance with a legal obligation to which the Controller is subject.

Art. 14 - Nature of the Personal Data and Provision Thereof

14.1 The following are processed:

  • a) in the case of registration through the dedicated form pursuant to Art. 4.4, letter a) of the T&C: the nickname, email address and login password provided by the User; together with any additional data that the User decides to enter, at their discretion, in the restricted area, including after registration, such as first name, surname, place of residence and date of birth;
  • b) in the case of registration through a Google or Apple account pursuant to Art. 4.4, letter b) of the T&C: the minimum identification data transmitted by the provider upon authentication. Authentication data is managed by the relevant provider chosen by the User, to whose privacy policy full reference is made, including for the rules applicable to any processing of the personal data of a User who registers through an Apple account using the anonymous relay address.

14.2 The provision of such data is not mandatory, but it is strictly necessary for Xplored to provide the service requested by the User; it follows that any refusal by the User to provide the data referred to in paragraph 14.1 above makes it impossible for Xplored to create the User's personal account and for the User to access the functions reserved for registered Users only, pursuant to the combined provisions of Art. 13.1, letter a) of this Privacy Policy and Art. 8.3 of the T&C.

14.3 The additional data that the User decides to enter in their restricted area after registration, as identified in the second sentence of Art. 14.1, letter a), namely first name, surname, place of residence and date of birth, is excluded from the application of paragraph 14.2 above. Its provision is in fact merely optional and does not affect the creation or functioning of the User's personal account.

Art. 15 - Retention Period of Personal Data

15.1 Solely with regard to the provisions of this Title II), Xplored retains the personal data of each registered User for as long as necessary to pursue the purposes referred to in Art. 13 above and, in any event, for a period of not less than 10 (ten) years from the date of registration on the Website.

15.2 If a dispute arises with the registered User during the retention period referred to in paragraph 15.1 above, Xplored reserves the right to retain the User's login credentials and related personal data until any settlement of the dispute or until the judgment becomes final.

15.3 Any processing carried out after the end of the retention periods referred to in the preceding paragraphs shall be preceded by a new notice in accordance with the provisions of the Regulation.

III) PROCESSING OF DATA FOR THE PERFORMANCE OF THE CONTRACT

Art. 16 - Scope of Application

16.1 This Title III) governs the processing of the personal data of each Customer, whether registered or not registered, which Xplored collects, stores and processes in order to manage and follow up on the purchase process described in more detail in Part IV of the T&C.

Art. 17 - Purposes and Legal Basis of the Processing

17.1 The processing of personal data collected for the reasons referred to in Art. 16 above is aimed at enabling Xplored:

  • a) to conclude and perform the Contract entered into with the Customer and, therefore: to receive the Order and to take note of the Product chosen by the Customer, as well as of the shipping and payment methods chosen by the Customer; to disclose the personal data provided by the Customer to the Shopify platform so that it may fulfil the order, receive the payment, issue the receipt referred to in Art. 10 of the T&C and manage the process following electronic withdrawal pursuant to Art. 17.1, letter a) of the T&C, as well as to the Fulfillment Providers for the shipping and delivery of the Product to the address indicated by the Customer, in accordance with Arts. 11-12 and 13 of the T&C; to manage the critical shipping situations provided for in Art. 14 of the T&C; to manage and process, where possible, the Customer's withdrawal notices and related refunds in accordance with Part VI of the T&C; and, in addition, to comply with further obligations ancillary or connected to the Contract; in this case, the legal basis for the processing is the performance of a contract to which the Data Subject is party and/or pre-contractual measures taken at the Data Subject's request.
  • b) to comply with the legal obligations incumbent upon it under applicable law and, in particular, under tax and administrative legislation; in this case, the legal basis for the processing is, precisely, compliance with a legal obligation to which the Controller is subject.
  • c) to also carry out anonymous and aggregated processing of the data under a), consisting of the technical and statistical evaluation of the preferences expressed by Customers both with regard to the Products and to ancillary services (such as shipping and payment), as well as of withdrawal cases and cases of critical order management, with a view to improving the efficiency of the Products offered on the market, of those to be created in the future and, in general, of the services provided by Xplored to its Customers; in this case, the legal basis is the Controller's legitimate interest.

Art. 18 - Nature of the Personal Data and Provision Thereof

18.1 The following are processed: first name, surname, email address, shipping and billing address and the transaction data provided in the Order by the Customer, whether or not registered on the website.

18.2 With reference to the purposes referred to in Art. 17.2 above, the provision of such data is not mandatory, but it is strictly necessary for Xplored to perform the Contract; it follows that any refusal by the Customer to provide the data referred to in paragraph 18.1 above makes it impossible to perform the Contract and/or to comply with the related legal obligations.

Art. 19 - Disclosure and Transfer of Personal Data

In addition to the cases provided for in Art. 4 above, and solely for the purposes and processing operations referred to in this Title III), Xplored discloses Customers' personal data (first name, surname, email address, shipping and billing address, transaction data):

  • a) to the Shopify platform, so that, within the framework of the contractual arrangements referred to in Art. 8.B) of the T&C and its appointment as data processor pursuant to Art. 28 GDPR, it handles the order processing and payment stages provided for in Part IV of the T&C, as well as the management of the process following the exercise of the right of withdrawal by a Customer who has used the electronic withdrawal function pursuant to Art. 17.1, letter a) of the T&C; such disclosure is therefore necessary for the proper performance of the Contract. Transfers of personal data to Shopify relating to Customers resident in the European Economic Area, the United Kingdom and Switzerland take place in compliance with the safeguards provided for by the GDPR, through Shopify's Binding Corporate Rules or the 2021 Standard Contractual Clauses. The competent supervisory authority for the processing carried out by Shopify is the Irish Data Protection Commission.
  • b) to its Fulfillment Providers, so that, within the framework of the contractual arrangements entered into and their appointment as data processors pursuant to Art. 28 GDPR, they handle, including through subcontracting, the shipping and delivery stages of the Products pursuant to Part V of the T&C; such disclosure is therefore necessary for the proper performance of the Contract.

Within the logistics chain, the integration applications with the Fulfillment Providers (SGG, QML and Aetherworks) technically access certain Customer data, including geolocation information, IP address, browser and operating system, through the Shopify API scopes required for the integration. Xplored has verified with the Fulfillment Providers that such data is neither used nor retained in the normal fulfilment process. These applications are appointed as data processors pursuant to Art. 28 GDPR within the framework of the contractual arrangements with Xplored.

Art. 20 - Retention Period of Personal Data

20.1 Solely with regard to Art. 17.1, letters a) and b) above, Xplored retains the Customer's personal data for the entire period necessary for the performance of the Contract and for compliance with the related legal obligations.

20.2 Once these purposes have been pursued, Xplored retains Customers' personal data for the maximum retention period provided for by law and, in any event, for a period of not less than 10 years. In the event of a dispute with the Customer, Xplored retains the Customer's personal data until any settlement of the dispute or until the judgment becomes final.

20.3 As regards the operations referred to in Art. 17.1, letter c), the data shall be retained in anonymised and aggregated form until the performance evaluation of Xplored's Products and services has been completed.

20.4 Any processing carried out after the end of the retention periods referred to in the preceding paragraphs shall be preceded by a new notice in accordance with the provisions of the Regulation.

IV) PROCESSING OF DATA NECESSARY TO PROVIDE CUSTOMER SERVICE

Art. 21 - Scope of Application

21.1 This Title IV) governs the processing of the personal data of each User and/or Customer, which Xplored collects, stores and processes in order to manage the customer service described in more detail in Art. 21 of the T&C.

Art. 22 - Purposes and Legal Basis of the Processing

22.1 The processing of personal data collected for the reasons referred to in Art. 21 above is aimed at enabling Xplored to handle support requests submitted by Users and/or Customers through the ticketing system via the following channel: https://teburu.zendesk.com/hc/en-us.

22.2 This customer service, described in more detail in Art. 21 of the T&C, is an ancillary service to the purchase of the Product made by the User and/or Customer and is therefore one of the obligations undertaken by Xplored upon entering into the Contract. The legal basis for the processing of the data necessary to provide this service is therefore the performance of a contract to which the Data Subject is party and/or pre-contractual measures taken at the Data Subject's request.

Art. 23 - Nature of the Personal Data and Provision Thereof

23.1 The following are processed: first name, surname, contact details, Order details, and in general all information provided by the User and/or Customer through the ticketing system.

23.2 With reference to the purposes referred to in Art. 22 above, the provision of the data is not mandatory, but it is strictly necessary for Xplored to handle the support requests received from the User and/or Customer; it follows that any refusal by the User and/or Customer to provide the data referred to in paragraph 23.1 above makes it impossible to perform the service.

Art. 24 - Disclosure and Transfer of Personal Data

24.1 In addition to the cases provided for in Art. 4 above, and solely for the purposes and processing operations referred to in this Title IV), Xplored discloses the personal data and, in general, all information (first name, surname, contact details, Order details, etc.) provided by the User and/or Customer in order to use the support service, to the Zendesk platform (accessible at the following link: https://teburu.zendesk.com/hc/en-us), so that, within the framework of the contractual arrangements and its appointment as data processor pursuant to Art. 28 GDPR, it handles the pre- and post-sales support stages provided for in Art. 21 of the T&C; such disclosure is therefore necessary for the proper provision of the customer support service.

Art. 25 - Retention Period of Personal Data

25.1 Solely with regard to Art. 22 above, Xplored retains the personal data of the User and/or Customer for the entire period necessary to handle the support request received.

25.2 Once these purposes have been pursued, Xplored retains Customers' personal data for the maximum retention period provided for by law and, in any event, for a period of not less than 2 years in the case of a User and 10 years in the case of a Customer. In the event of a dispute with the User and/or Customer, Xplored retains the personal data until any settlement of the dispute or until the judgment becomes final.

25.3 Any processing carried out after the end of the retention periods referred to in the preceding paragraphs shall be preceded by a new notice in accordance with the provisions of the Regulation.

V) PROCESSING OF BACKERS' DATA

Art. 26 - Scope of Application

26.1 This Title V) governs the processing of the personal data of those who have participated in the crowdfunding campaign relating to one or more products designed and currently being developed by Xplored, by making a pledge on the Gamefound platform ("Backers"), in accordance with the general terms applied by Gamefound and available at the following link [•].

Art. 27 - Purposes and Legal Basis of the Processing

27.1 Having received the disclosure of the Backers' personal data referred to in paragraph 28.1 below, Xplored processes it in order to:

  • a) deliver to each Backer the funded product, through the shipping and delivery services provided by the aforementioned Fulfillment Providers; manage the critical shipping situations provided for in Art. 14 of the T&C; manage the pre- and post-sales support service described in more detail in Art. 21 of the T&C; and, in addition, comply with further obligations ancillary or connected to the Contract; in this case, the legal basis for the processing is the performance of a contract to which the Data Subject is party and/or pre-contractual measures taken at the Data Subject's request.
  • b) comply with the legal obligations incumbent upon it under applicable law and, in particular, under tax and administrative legislation; in this case, the legal basis for the processing is, precisely, compliance with a legal obligation to which the Controller is subject.
  • c) also carry out anonymous and aggregated processing of the data under a), consisting of the technical and statistical evaluation of the preferences expressed by Backers both with regard to crowdfunding campaigns and to ancillary services (such as shipping and payment), as well as of cases of critical order management, with a view to improving the efficiency of the products offered on the market, of those to be created in the future and, in general, of the services provided by Xplored; in this case, the legal basis is the Controller's legitimate interest.

Art. 28 - Nature of the Personal Data

28.1 The following are processed: the personal data provided by Backers upon registration on Gamefound and participation in the crowdfunding campaign, which Gamefound itself discloses to Xplored for the pursuit of the purposes referred to in Art. 27 above; namely: first name, surname, email address, shipping and billing address, and transaction data.

Art. 29 - Disclosure and Transfer of Personal Data

29.1 In addition to the cases provided for in Art. 4 above, and solely for the purposes and processing operations referred to in this Title V), Xplored discloses Backers' personal data:

  • a) to its Fulfillment Providers, so that, within the framework of the contractual arrangements entered into and their appointment as data processors pursuant to Art. 28 GDPR, they handle, including through subcontracting, the shipping and delivery stages of the Products pursuant to Part V of the T&C; such disclosure is therefore necessary for the proper performance of the Contract;
  • b) to the Zendesk platform, so that, within the framework of the contractual arrangements and its appointment as data processor pursuant to Art. 28 GDPR, it handles the pre- and post-sales support stages provided for in Art. 21 of the T&C; such disclosure is therefore necessary for the proper provision of the support service.

Art. 30 - Retention Period of Personal Data

30.1 Xplored retains Backers' personal data for the entire period necessary to achieve the purposes referred to in Art. 27.1, letter a) above and to comply with the related legal obligations.

30.2 Once these purposes have been pursued, Xplored retains Customers' personal data for the maximum retention period provided for by law and, in any event, for a period of not less than 10 years. In the event of a dispute with Backers, Xplored retains their personal data until any settlement of the dispute or until the judgment becomes final.

30.3 As regards the operations referred to in Art. 17.1, letter b), the data shall be retained in anonymised and aggregated form until the performance evaluation of the products and services has been completed.

30.4 Any processing carried out after the end of the retention periods referred to in the preceding paragraphs shall be preceded by a new notice in accordance with the provisions of the Regulation.

VI) PROCESSING OF DATA FOR MARKETING PURPOSES

Art. 31 - Scope of Application

31.1 This Title VI) governs the processing of the personal data provided by Users upon registration for the newsletter service.

Art. 32 - Purposes and Legal Basis of the Processing

32.1 The processing of personal data collected for the reasons referred to in Art. 31 above is aimed at enabling Xplored to periodically send a newsletter, that is, an update for informational, promotional and educational purposes, to Users who have requested it, or in any case to send similar updates by means other than the newsletter, whether individualised or general; in this case, the legal basis for the processing is the User's express, freely given and informed consent; such consent may be withdrawn at any time, by following the instructions at the bottom of the relevant email message and/or by sending an email to: [email protected].

Art. 33 - Nature of the Personal Data and Provision Thereof

33.1 The following are processed: Users' first name and surname, their contact details and any other information requested and/or provided in the Website form dedicated to subscription to the newsletter service.

33.2 With reference to the purposes referred to in Art. 32 above, the provision of the data is optional and any refusal will not allow the periodic newsletter – paper and/or electronic – to be sent, nor the sending of communications relating to updates, events and initiatives.

Art. 34 - Retention Period of Personal Data

34.1 Solely with regard to the provisions of this Title VI), Xplored retains Users' personal data for 24 (twenty-four) months from the date of registration.

34.2 If, however, the User withdraws consent before the expiry of the period referred to in paragraph 34.1 above, the data shall be promptly destroyed.

34.3 In the event of a dispute with the User, Xplored retains the User's personal data until any settlement of the dispute or until the judgment becomes final.

34.4 Any processing carried out after the end of the retention periods referred to in the preceding paragraphs shall be preceded by a new notice in accordance with the provisions of the Regulation.

VII) PROCESSING OF DATA COLLECTED BY THE WEBSITE DURING BROWSING

Art. 35 - Scope of Application

35.1 This Title VII) governs the use of cookies, with detailed rules set out in the dedicated Cookie Policy, to which reference is made.

35.2 In this document, the term 'cookies' means both cookies in the strict sense and similar technologies.

Art. 36 - Purposes and Legal Basis of the Processing

36.1 The Website uses first-party and third-party cookies, as well as similar local storage technologies (such as local storage and session storage), classified as follows:

  • a) technical cookies and strictly necessary technologies, used to ensure the proper functioning of the Website and to enable the User to use the services and features requested, including management of authentication and session, management of the cart and the purchase process, and storage of the preferences necessary for use of the Website. This category also includes the access cookies referred to in Art. 38 below;
  • b) analytics cookies and technologies, used to collect information on the browsing and use of the Website, including for the purpose of carrying out statistical analysis and improving the functioning of the Website and the browsing experience. To the extent that such technologies involve the processing of information that is not adequately aggregated or anonymised, their use is subject to the User's consent.

36.2 As of the date of update of this Privacy Policy, the Website does not use profiling or marketing cookies or technologies.

36.3 The detailed inventory of the cookies, local storage and session storage currently used by the Website, indicating provider, purpose, duration and legal basis, is set out in the Cookie Policy published at teburu.com, to which reference is made for the detailed rules.

36.4 The legal basis for the processing varies according to the category of cookie:

  • a) the technical cookies and strictly necessary technologies referred to in paragraph 36.1, letter a) do not require the User's consent, in the cases and under the conditions provided for by applicable law; the legal bases are, as the case may be, the performance of the Contract, compliance with a legal obligation or Xplored's legitimate interest, as indicated in the Cookie Policy;
  • b) the analytics cookies referred to in paragraph 36.1, letter b) are processed on the basis of the User's express, freely given and informed consent, given after reviewing the Cookie Policy and by making a selection on the relevant cookie banner displayed on first access to the Website. Consent so given may be withdrawn at any time by changing one's preference options in the dedicated settings area of the Website or through the browser functionalities.

Art. 37 - Nature of the Personal Data and Provision Thereof

37.1 The following are processed:

  • a) browsing data: the information and data relating to the User that is collected by Xplored through the Website, such as, by way of example and without limitation: date and time, IP addresses, browser and operating system, language, country, time of request, etc.
  • b) cookies: small text files sent by the Website to the device used by the User to access and browse it, where they are stored to be retransmitted to the Website on the same User's next visit. Some of the functions of cookies may be delegated to other technologies.

37.2 With regard to the purposes referred to in Art. 36.1, point a), the provision of personal data – and therefore the acceptance of cookies – is optional and any refusal and/or disabling could compromise the use of the Website's features.

37.3 As regards the purpose referred to in Art. 36.2, point b), the provision of data is optional and any refusal and/or disabling would not allow the activities described above to be carried out and, among these, in particular, the possibility of storing one's login credentials for the Website and, therefore, of remaining logged in for future sessions.

Art. 38 - "Access" Cookies

38.1 Cookies within the meaning of paragraph 36.1 above include, among others, any login credentials that the User decides to use in order to use the features of the Website and/or to register on it.

38.2 Such cookies, where authorised, enable the User to store their credentials on the Website in order to access their restricted area in the future.

38.3 The User may record their preferences both on first access to the Website, using the so-called cookie banner, and subsequently, by modifying the preference choices already made in the dedicated settings area of the Website.

38.4 Any deactivation of "access" cookies does not prevent the proper functioning of the Website, since the User is allowed both to enter their credentials at each access and not to register on the Website at all, even to submit an Order.

Art. 39 - Retention Period of Personal Data

39.1 Solely with regard to the provisions of this Title VII), Xplored retains the User's data for as long as necessary to provide the service requested and, therefore, to pursue the purposes referred to in the preceding articles.

39.2 More specifically, with regard to the "access" cookies referred to in Art. 38, Xplored retains the User's data for as long as necessary to provide the service requested or until any change by the User of their preference options pursuant to paragraph 39.3 below.

39.3 The User may withdraw previously given consent at any time and, therefore, also before the expiry of the retention periods referred to in the preceding paragraphs, by modifying their preference options. In such case, the data stored and retained up to that moment shall be promptly destroyed.

39.4 In the event of a dispute with the User, Xplored retains the User's personal data until any settlement of the dispute or until the judgment becomes final.

39.5 Any processing carried out after the end of the retention periods referred to in the preceding paragraphs shall be preceded by a new notice in accordance with the provisions of the Regulation.

This notice is current as of 12 October 2026.