Privacy Policy
Last updated: 30 October 2026
This policy is issued pursuant to Article 13 of EU Regulation 2016/679 ("GDPR") and describes how personal data of users interacting with myorganics.com is processed.
1. Data Controller
The Data Controller is SMÀ Srl, VAT no. 03547050249, with registered office at Via Bianche 3, 36010 Carrè (VI), Italy, reachable at support@myorganics.com.
2. Categories of data collected
- Registration data: first name, last name, email, password (encrypted), date of birth.
- Contact data: address, phone number.
- Order data: items purchased, amounts, date, shipping and billing address.
- Payment data: handled directly by PCI-DSS certified payment gateways; the Controller does not store card numbers.
- Browsing data: IP address, browser, OS, pages visited, timestamps.
- Marketing data: newsletter subscription preferences, email open/click logs.
3. Purposes of processing and legal basis
| Purpose | Legal basis |
|---|---|
| Account registration and user management | Art. 6(1)(b) GDPR (contract performance) |
| Order processing, invoicing, shipping | Art. 6(1)(b) + 6(1)(c) (tax obligations) |
| Customer support | Art. 6(1)(b) GDPR |
| Newsletter and promotional communications | Art. 6(1)(a) GDPR (consent, revocable at any time) |
| Purchase behaviour profiling | Art. 6(1)(a) GDPR (consent) |
| Legal defence, fraud prevention | Art. 6(1)(f) GDPR (legitimate interest) |
| Regulatory compliance | Art. 6(1)(c) GDPR (legal obligation) |
| Suggesting the official store for the country you are browsing from (IP address geolocation) | Art. 6(1)(f) GDPR (legitimate interest) |
4. Processing methods
Data is processed using automated and paper-based tools, with appropriate technical and organisational measures (TLS encryption in transit, password hashing, access controls, backups).
IP address geolocation. To suggest the official store for the country you are browsing from (for example myorganicsofficial.es for Spain), we derive your country from your IP address. The country is determined on our servers using a locally installed database: your IP address is not sent to third parties and is not stored by this feature. There is no automatic redirection: the choice is yours and is remembered for 30 days with the technical cookie sma_geoshop (see the Cookie Policy). IP Geolocation by DB-IP (CC BY 4.0).
5. Data retention
- Account data: for the duration of the contractual relationship and for an additional 10 years after closure for tax obligations.
- Marketing data: until consent is withdrawn and in any case no longer than 24 months from the last active interaction.
- Browsing data: for the technical time needed, in any case no longer than 12 months.
6. Disclosure and recipient categories
Data may be disclosed to the following categories of recipients, appointed as Data Processors under Art. 28 GDPR:
- Cloud, hosting and backup service providers (EU data centers).
- Payment gateways (Stripe, PayPal or equivalent).
- Shipping carriers (GLS, FedEx, DHL and similar).
- Transactional and marketing email providers.
- Analytics and advertising providers: Google (Google Analytics 4 ID
G-EFRWBJ3YFH, Google AdsAW-18196943800with Merchant Center5811811698) and Meta Platforms (Meta Pixel ID1769735723759274). - Professional advisors (accountants, lawyers) and competent authorities upon request.
7. International data transfers
Some third-party services (Google, Meta) process data in the United States. Transfers comply with Articles 44-49 GDPR, based on the EU-US Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission.
8. User rights
You have the right, at any time, to:
- access your data (Art. 15);
- request rectification (Art. 16) or erasure (Art. 17);
- request restriction of processing (Art. 18);
- object to processing (Art. 21);
- receive your data in a portable format (Art. 20);
- withdraw consent at any time;
- lodge a complaint with the competent supervisory authority.
To exercise these rights, write to support@myorganics.com.
9. Cookies
The use of cookies and similar technologies is described in our dedicated cookie policy.
10. Changes
The Controller reserves the right to update this policy to reflect regulatory or service changes. The latest update date is shown at the top.
11. Reports and complaints (B Corp)
As part of its commitment as a B Corp, SMÀ S.r.l. provides a form for submitting reports, observations and complaints concerning social, environmental or commercial matters, diversity, equity and inclusion, or relations with the company. The form can be reached from the “Reports and complaints” link in the website footer and is hosted at segnalazioni.smagroup.it.
- Data controller: SMÀ S.r.l., Via Bianche 3, 36010 Carrè (VI), Italy, VAT no. IT03547050249, email segnalazioni@smagroup.it.
- Data processed: the reason for and description of the report and, if you provide them, your full name, email address and phone number; in addition, the date and time of sending, the website you came from, the browser type and a code derived irreversibly from your IP address, used only to limit repeated submissions. Your name is optional: you can submit a report without identifying yourself, but without at least one contact detail we will not be able to reply. Please do not include unnecessary data in the description, in particular health data or other special categories of data.
- Purpose: to receive and review reports, reply to them and keep a record of them as required by the B Corp certification.
- Legal basis: the controller’s legitimate interest in handling reports and documenting its social and environmental commitment (Art. 6(1)(f) GDPR); for complaints relating to a purchase, also the performance of the contract (Art. 6(1)(b) GDPR).
- Recipients: SMÀ staff in charge of handling reports; GCP Corporate, which receives reports in copy and supports SMÀ in handling them; the providers hosting the form and the email service; Google Ireland Limited, which provides Google Sheets, where the register of reports is kept (any transfer of data to the United States takes place under the EU-US Data Privacy Framework). The data is not disclosed to the public.
- Retention: 5 years from the date of submission; after this period reports are deleted automatically.
- Cookies: the form does not use cookies.
- Your rights: you can request access to, rectification or erasure of your data, restriction of processing, or object to processing (Arts. 15-21 GDPR) by writing to segnalazioni@smagroup.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of your country.