Privacy Policy

1. Who We Are

Genusto is a trading name of Claudio Romanazzi OÜ, a company registered in Estonia, with its registered office at Nõmme tee 64-3, Kristiine, 11311 Tallinn, Estonia.

For the purposes of the UK GDPR and the Data Protection Act 2018, Claudio Romanazzi OÜ is the data controller for the personal data collected through this website.

Questions about this policy or about your data? Write to us at support@genusto.com. We reply to every message.

This policy explains what we collect, why we collect it, how long we keep it, and what you can ask us to do with it. Plain language. No small print games.

2. What Data We Collect

Order data: first and last name, delivery address, billing address, email address, phone number, order contents, order value and order history.

Payment data: we receive only the payment status, the payment method type and the last four digits of the card. Full card numbers never reach our servers — see section 4.

Support data: the content of emails or messages you send us, including photos or documents you attach to a return or guarantee request.

Technical data: IP address, browser type and version, device type, operating system, referring page, pages viewed and time on page.

Marketing data: your email address if you subscribe to our newsletter or accept marketing at checkout, plus whether you open our emails and click our links.

We do not knowingly collect data from anyone under 16. We do not collect special category data (health, biometric, political or religious data) and we ask you not to send it to us.

3. Why We Use Your Data and Our Legal Basis

To process and deliver your order, handle returns and provide customer support — legal basis: performance of a contract with you.

To take payment and prevent fraud and chargebacks — legal basis: performance of a contract and our legitimate interest in protecting the business against fraud.

To meet accounting, tax and consumer law obligations — legal basis: compliance with a legal obligation.

To send marketing emails about our products — legal basis: your consent, or our legitimate interest where you are an existing customer buying a similar product. You can unsubscribe from any email in one click, at any time.

To measure how the site performs, improve our pages and our advertising — legal basis: your consent for non-essential cookies and analytics, our legitimate interest for basic security and load statistics.

We do not sell your personal data. Not to advertisers, not to data brokers, not to anyone.

4. Payments and Card Security

All payments on this website are processed by Stripe Payments Europe, Ltd. and its affiliated entities.

Your card details are entered inside Stripe's own secure payment fields and are transmitted directly to Stripe. They do not pass through, and are not stored on, our website or our servers.

Stripe is certified to PCI DSS Level 1, the highest level of certification in the payments industry, and acts as an independent data controller for the payment data it processes. Stripe's own privacy policy applies to that processing and is available on the Stripe website.

We keep only what we need to identify your payment and handle refunds, disputes and accounting: transaction reference, amount, currency, date, payment status and card type.

5. Who We Share Your Data With

Payment provider: Stripe, to authorise and settle your payment and to process refunds.

Suppliers and fulfilment partners: our overseas manufacturing and fulfilment partner receives your name, delivery address, phone number and order contents solely to pack and dispatch your parcel.

Carriers: the postal operators and couriers handling your parcel, including the final-mile carrier in the United Kingdom, receive the delivery details needed to complete delivery and to send you tracking updates.

Technology providers: our website host, order management platform, email and helpdesk providers, all bound by written data processing agreements.

Advertising and analytics platforms: where you have consented to non-essential cookies, limited event data may be shared with platforms such as Meta, TikTok and Google to measure and improve campaigns.

Authorities and advisers: where we are legally required to disclose data, or where necessary to establish, exercise or defend legal claims.

Every processor is contractually required to use your data only on our instructions, keep it secure, and delete or return it when the service ends.

6. International Transfers

Because our fulfilment partner is located outside the United Kingdom and the European Economic Area, your delivery details are transferred internationally in order to dispatch your order. Without this transfer we cannot fulfil your purchase.

Where we transfer personal data outside the UK or EEA, we rely on the UK International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, or an applicable adequacy decision.

We transfer the minimum data needed for delivery — no payment data, no browsing history, no marketing profiles.

You can request a copy of the safeguards we have in place by emailing support@genusto.com.

7. How Long We Keep Your Data

Order, invoice and payment records: 7 years from the end of the relevant financial year, to meet tax and accounting obligations.

Customer support correspondence: 24 months from the last message, so we can handle repeat issues and guarantee claims.

Marketing contact data: until you unsubscribe or withdraw consent, and then a minimal suppression record so we do not contact you again by mistake.

Analytics and advertising data: normally up to 14 months, depending on the platform and your cookie choices.

When a retention period ends, we delete the data or anonymise it so it can no longer be linked to you.

8. Your Rights

Under the UK GDPR you have the right to: access your data; have inaccurate data corrected; have your data erased; restrict or object to processing; receive your data in a portable format; and withdraw consent at any time.

You also have the right to object at any time to processing for direct marketing purposes. If you object, we will stop immediately.

To exercise any right, email support@genusto.com. We respond within one month. If your request is complex we may extend this by a further two months and will tell you why.

We may ask for information to confirm your identity before acting on a request. This protects your data from being disclosed to someone else.

Exercising your rights is free. We only charge a fee, or refuse, if a request is manifestly unfounded or excessive — and we will explain our reasoning.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the Estonian Data Protection Inspectorate (aki.ee). We would rather you told us first so we can fix it.

9. Cookies and Tracking

Essential cookies keep your basket, your session and your security settings working. The site cannot function without them, so they are always active.

Analytics and advertising cookies help us understand which pages and adverts work. These are only set after you accept them in our cookie banner.

You can change or withdraw your cookie choices at any time through the cookie settings link on the site, or by clearing cookies in your browser.

Blocking non-essential cookies does not affect your ability to order, pay, or receive support.

10. Security and Changes to This Policy

The whole site runs over encrypted HTTPS. Access to order data is restricted to the people who need it to do their job, and is protected by strong authentication.

No system is perfect. If a breach ever occurs that is likely to result in a high risk to your rights, we will notify you and the relevant supervisory authority without undue delay.

We may update this policy when our services, providers or legal obligations change. The current version is always published on this page with its effective date.

If a change materially affects how we use your data, we will tell you by email before it takes effect.