Privacy Policy - wambooka.com

Information notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 as amended. Last updated: 18 October 2026.

1. Data controller

The data controller is Fabulous Instruments S.r.l., with registered office in Via Mannino Cefaly 8, 95126 Catania (CT), Italy, VAT and tax code IT05179660872, owner of the Wambooka brand and of the website wambooka.com (the Site). You can contact us at [email protected]. A Data Protection Officer has not been appointed because the conditions of Article 37 GDPR do not apply.

2. What data we process

Identification and contact data you provide: first and last name, shipping and billing address, email address, telephone number, company name and tax identifiers (VAT number, tax code, SDI recipient code or certified email) when you ask for an invoice to a business.
Account data: login credentials (the password is stored in encrypted form), order history, wish list, saved addresses.
Purchase data: products ordered, amounts, payment method chosen, shipping and tracking information. Card and PayPal details are entered directly on the secure pages of Stripe and PayPal: we never see or store card numbers and we only receive the outcome of the payment and a transaction identifier.
Communications: the content of messages you send us through the contact forms, by email or via the WhatsApp button, and product reviews you choose to publish.
Browsing data: IP address, browser and device type, pages visited, date and time of access, security logs. Cookies and similar technologies are described in our Cookie Policy, which you can open from the footer of every page.

3. Why we process your data and on what legal basis

To process and deliver your orders, issue invoices, manage returns, warranty and customer service. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (Art. 6(1)(c)).
To create and manage your customer account. Legal basis: performance of the contract.
To answer requests you send through the contact forms, by email or WhatsApp. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b)).
To send you our newsletter with news and offers, only if you subscribe. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time using the link at the bottom of every email. Subscription is confirmed with a double opt-in email.
To invite you by email to review the products you bought from us. Legal basis: our legitimate interest in collecting feedback on our products (Art. 6(1)(f)) and Article 130(4) of the Italian Privacy Code, which allows this kind of message to existing customers for similar products; you can object at any time with the link in the email or by writing to us.
To protect the Site against fraud, spam, abuse and attacks, and to keep security logs: we use a firewall, an anti-bot check on forms (Cloudflare Turnstile) and spam filtering of form submissions (Akismet). Legal basis: our legitimate interest in the security of the service (Art. 6(1)(f)).
To measure the audience of the Site with Google Analytics 4 (anonymised IP addresses, no advertising features) and, in the future, to show you our advertising, only if you accept the related cookie categories in the banner. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). The Google Analytics script is not loaded at all until you give consent.
To comply with legal obligations and to establish, exercise or defend legal claims. Legal basis: legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)).
To understand which channel brought you to the Site when you place an order (for example a search engine, a newsletter or a social network): WooCommerce Order Attribution stores this information, without personal profiling, in first-party cookies and in the order. Legal basis: our legitimate interest in measuring the effectiveness of our communication channels (Art. 6(1)(f)); the related cookies are technical and do not leave our server.

4. Is providing your data mandatory?

The data marked as required at checkout and in the forms are necessary to complete the purchase or to answer you: without them we cannot process the order or reply. Data for the newsletter and consent to statistical and marketing cookies are optional and refusing them has no effect on your purchase.

5. Who receives your data

Your data are processed by our staff and by the following categories of recipients, appointed as data processors under Article 28 GDPR or acting as independent controllers for their own services. We do not sell personal data to anyone.

Hosting and infrastructure: Hostinger International Ltd (servers located in the European Union) and Cloudflare, Inc. (content delivery network, security, anti-bot verification Turnstile on forms and cookieless Web Analytics that measures page performance).
Payments: Stripe Payments Europe Ltd (Ireland), also for Klarna and Link payments, and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). They process your payment data as independent controllers according to their own privacy policies.
Shipping: postal services and couriers in charge of delivering your parcel, which receive name, address, telephone number and email for delivery notifications.
Invoicing and accounting: Sibill S.r.l. (electronic invoicing software), the Italian Revenue Agency's Sistema di Interscambio for electronic invoices, our accountant and advisers.
Email and office tools: Google Workspace (Google Ireland Ltd) for our mailboxes.
Newsletter: Intuit Mailchimp (The Rocket Science Group LLC), only for subscribers.
Security: Defiant, Inc. (Wordfence) for firewall and intrusion detection, which processes IP addresses and request logs; Automattic, Inc. (Akismet), which checks form submissions for spam and receives the content of the message, the IP address and the email address entered.
Statistics, social networks and advertising, only after your consent in the cookie banner: Google Ireland Ltd (Google Analytics 4, YouTube videos), Meta Platforms Ireland Ltd (Instagram feed). The WhatsApp button opens a conversation on your own WhatsApp app: nothing is sent until you write to us. Fonts are served from our own server and do not involve third parties.
Public authorities, courts and law enforcement when required by law.

6. Transfers outside the European Economic Area

Some of the providers listed above (Cloudflare, Mailchimp, Defiant, Automattic, Meta, Google) are based in the United States or may process data there. Transfers take place on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework, for providers certified under it, or of the Standard Contractual Clauses approved by the Commission, together with additional safeguards where necessary. You can ask us for a copy of the safeguards in place.

7. How long we keep your data

Order, invoice and accounting data: 10 years from the end of the financial year, as required by Article 2220 of the Italian Civil Code and tax law.
Customer account: until you ask us to delete it.
Messages sent through the forms, by email or WhatsApp: up to 24 months after the request is closed, unless a dispute requires a longer period.
Newsletter data: until you unsubscribe or withdraw your consent.
Security logs and IP addresses: up to 30 days, unless they are needed to investigate an attack.
Google Analytics data: 14 months, after which Google deletes the user-level data automatically.
Cookies: for the periods indicated in the Cookie Policy.

8. Your rights

Under Articles 15 to 22 GDPR you have the right to obtain access to your data, to have them rectified or erased, to restrict or object to their processing, to receive them in a portable format and to withdraw any consent you have given, without affecting the lawfulness of processing carried out before the withdrawal. To exercise your rights write to [email protected] or to the postal address above; we will reply within one month. You can also manage your addresses and download your data from the My Account area.

If you believe that the processing of your data infringes the law, you have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.

9. Minors

The Site is not intended for children under 14 years of age and purchases can only be made by adults. If we learn that we have collected data from a child without the required parental consent we will delete them.

10. Automated decisions and security

We do not take decisions based solely on automated processing that produce legal effects on you. Payment providers may run automated anti-fraud checks on transactions under their own responsibility. Data are protected with technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), restricted access, firewall, two-factor authentication for administrators and regular backups.

11. Changes to this notice

We may update this notice to reflect changes in the law or in our services. The current version, with its date, is always published on this page; substantial changes will be announced on the Site or by email to registered customers.