Effective from March 31, 2026
Last updated: September 14, 2026

This Privacy Policy explains how Super Archive SRL collects and processes the personal data of users who visit superarchive.com, create an account, complete the onboarding process, purchase products, book events or contact customer support.

1. Data Controller

The Data Controller is:

Super Archive SRL
Corso Concordia 11
20129 Milan (MI), Italy
VAT number: IT14457900968
Privacy contact email: privacy@superarchive.com

2. Scope and minimum age

The website, registration, purchases and Super Archive events are intended exclusively for persons aged 18 or over. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that a minor has registered, we will take the necessary steps to deactivate the account and delete any data that we are not required to retain by law.

3. Personal data we process

Depending on how a user interacts with the website, we may process the following categories of personal data.

Identification and contact data

• first and last name;
• email address;
• telephone number;
• date of birth;
• gender;
• residential, billing or shipping address.

Account and onboarding data

• customer identifier and account status;
• information required to complete the user profile;
• date and status of onboarding completion;
• information relating to access to restricted services and events;
• technical data relating to authentication through a code sent by email. We do not retain the access code for longer than is necessary to complete the authentication process.

Profile data is stored on the Shopify platform and replicated on Super Archive’s proprietary systems hosted on Microsoft Azure.

Purchase and payment data

• products viewed, added to the cart or purchased;
• order, return and refund history;
• transaction amounts, currency and status;
• billing, shipping and delivery information;
• information required for fraud prevention and dispute management.

Payments are processed through Shopify Payments and PayPal. Super Archive does not normally receive the full payment card number, security code or PayPal account credentials, which are processed directly by the respective payment providers. We may receive the payment outcome, a transaction identifier and the information required to manage the order, refunds or disputes.

Event data

• event booked;
• booking date and status;
• information required to verify eligibility and grant access to the event;
• organisational communications relating to the event.

Events are free of charge unless otherwise stated before booking.

Communications and customer support data

• the content of requests submitted through the website, email or other contact channels;
• information contained in support tickets and communications managed through Zoho Desk;
• preferences and consent relating to marketing communications;
• technical information required to deliver and manage emails sent through our proprietary system hosted on Microsoft Azure.

Technical and usage data

• IP address;
• browser type and version;
• device type, operating system and technical settings;
• date and time of access;
• pages visited, actions performed and time spent on the website;
• source of the visit and online identifiers;
• information relating to errors, security, performance and login attempts;
• approximate geographical location derived from the IP address. We do not collect the device’s precise GPS location.

Cookies, pixels and similar technologies

Subject to the user’s consent, we may collect information about interactions with the website through Google Analytics 4, Google Ads, Meta Pixel and Meta Ads. Please refer to our Cookie Policy for further information.

4. How we collect personal data

We collect personal data:

• directly from the user during registration, onboarding, purchases, event bookings, subscription to marketing communications or contact with customer support;
• automatically while the website is being used, through logs, cookies, pixels and similar technologies;
• from Shopify and providers supporting authentication, payments, deliveries, security, analytics and advertising campaigns;
• from advertising channels when a user interacts with one of our advertisements, subject to the applicable settings and consent choices.

5. Purposes and legal bases

We process personal data for the following purposes and on the following legal bases.

Where processing is based on consent, the user may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the user. Advertising platforms may perform personalisation and measurement according to the user’s consent choices and settings.

6. Mandatory and optional information

The fields marked as mandatory during onboarding — first name, last name, date of birth, address, telephone number and gender — are required to create and complete the profile, verify that the user is over 18, manage access to events and, where applicable, arrange deliveries and operational communications. Failure to provide this information prevents completion of onboarding and access to restricted features.

Consent to marketing communications and non-essential cookies is optional. Refusal does not prevent registration, purchases or event bookings, except for features that technically depend on cookies that have been declined.

7. Recipients and service providers

Personal data may be disclosed, to the extent necessary, to the following categories of recipients:

• Shopify, for the ecommerce platform, customer accounts, orders, checkout, payments, security and related features. Information about Shopify’s processing is available in the Shopify Consumer Privacy Policy;
• Shopify Payments and PayPal, for payment processing, fraud prevention, refunds and disputes;
• Microsoft Azure, for hosting the servers and proprietary systems on which account, profile, order, booking and communication data is replicated;
• Microsoft 365, for email and business tools;
• Zoho Desk, for managing customer support and tickets;
• Google Analytics 4 and Google Ads, for analytics, conversion measurement and advertising, subject to consent;
• Meta Pixel and Meta Ads, for measurement, attribution and advertising on Meta platforms, subject to consent;
• hCaptcha and Shopify security services, for preventing automated access, abuse and fraud;
• couriers, logistics operators and providers responsible for delivering orders;
• technical service providers, content delivery networks, providers of installed Shopify applications and professional advisers that require data to provide their services;
• accountants, legal advisers, insurers, public authorities and courts where necessary or required by law;
• parties involved in extraordinary corporate transactions, subject to the applicable safeguards.

Service providers process personal data according to their respective privacy roles and, when they act on behalf of Super Archive, are bound by appropriate agreements and instructions.

8. International data transfers

Super Archive’s proprietary systems are hosted on Microsoft Azure in Italy. However, some providers, including Shopify, Microsoft, Google, Meta, PayPal and Zoho, may also process personal data in other countries within or outside the European Economic Area.

Where personal data is transferred to a country outside the European Economic Area, we rely on safeguards provided by applicable law, such as an adequacy decision of the European Commission, Standard Contractual Clauses or other legally recognised mechanisms. Users may request further information about the applicable safeguards by emailing privacy@superarchive.com.

9. Data retention

• Account, profile and onboarding: for the duration of the account. Following a valid deletion request, data that is not required to be retained by law will be deleted or anonymised from Shopify and Super Archive’s Azure systems within 90 days.
• Orders, payments and accounting records: for ten years or for any different period required by applicable law. The period may be extended where necessary in connection with tax assessments, disputes or requests from public authorities.
• Event bookings: for the time required to organise the event and, afterwards, for the period necessary to respond to requests or protect our rights.
• Customer support: for the time required to manage the ticket and for any additional period necessary to protect contractual or legal rights.
• Marketing: until consent is withdrawn. We may retain evidence of consent and the minimum information required to respect the user’s objection to further communications.
• Cookies and online identifiers: for the periods stated in the Cookie Policy or until consent is withdrawn, if earlier.
• Technical and security logs: for a period proportionate to the purposes of security, fraud prevention, technical diagnostics and protection of our rights.

At the end of the applicable period, we delete or anonymise personal data unless further retention is required by law or is necessary to establish, exercise or defend a legal claim.

10. Security

We implement technical and organisational measures appropriate to the level of risk to protect personal data against loss, destruction, alteration, disclosure or unauthorised access. However, no electronic transmission or storage system can guarantee absolute security.

Access to the account is provided through a code sent to the user’s email address. Users must protect access to their email account and inform us promptly of any unauthorised use of their Super Archive account.

11. Data subject rights

Where provided by applicable law, users may:

• obtain confirmation as to whether their personal data is being processed and access that data;
• request the correction or updating of inaccurate personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests and, at any time, to direct marketing;
• receive the personal data they have provided in a structured, commonly used and machine-readable format and request its transmission to another controller, where the right to data portability applies;
• withdraw consent at any time;
• lodge a complaint with the competent supervisory authority.

Requests may be submitted to privacy@superarchive.com. We may request information strictly necessary to verify the identity of the requester. We will respond within the time limits established by applicable law.

Deletion of an account may also be requested through customer support. Granting a deletion request does not require us to delete information that we must retain for legal, tax or accounting obligations or to protect our rights.

12. Marketing communications

Marketing communications are sent through a proprietary system hosted on Microsoft Azure only to users who have provided separate consent.

Consent may be withdrawn at any time through the unsubscribe link included in emails or by writing to privacy@superarchive.com. Withdrawal does not prevent us from sending service communications concerning the account, orders, booked events, security or customer support requests.

Super Archive does not send marketing communications by SMS.

13. Cookies and advertising

The website uses cookies that are strictly necessary for its operation. Subject to the user’s consent, it also uses cookies and similar technologies from Shopify Analytics, Google Analytics 4, Google Ads, Meta Pixel and Meta Ads.

Users can accept, reject or select individual categories through Shopify’s cookie banner and may subsequently change their choices through the Cookie Preferences link available on the website. Refusal or withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Please refer to the Cookie Policy for further details.

14. Third-party websites and services

The website may contain links to websites or services operated by third parties. Processing carried out after accessing those services is governed by the privacy notices of the respective providers. Users should review those notices before providing personal data.

15. Changes to this Privacy Policy

We may update this Privacy Policy to reflect regulatory, technical or organisational changes. The updated version will be published on the website and will indicate the date of the latest update. Where required by law or where changes significantly affect processing activities, we will inform users by appropriate means and, where necessary, obtain new consent.

16. Contact details and complaints

For privacy-related requests or questions:

Super Archive SRL – Privacy Contact
Corso Concordia 11, 20129 Milan (MI), Italy
Email: privacy@superarchive.com

Users may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it, or with the competent supervisory authority in the European country where they live or work or where they believe an infringement has occurred.

If the store accepts orders from residents of the United Kingdom, those users may also contact the Information Commissioner’s Office (ICO) at ico.org.uk.