Privacy Policy

Last updated: June 2026

Your privacy is important to us. This Privacy Policy explains how Pappa Fresh OÜ collects, uses and protects your personal data when you visit the pappafresh.it website, place an order or subscribe to our newsletter, in accordance with Regulation (EU) 2016/679 ("GDPR") and applicable law.

This document is a template provided for informational purposes and should be reviewed and adapted by a legal advisor before final publication.

1. Data controller

The data controller of the personal data is:

Pappa Fresh OÜ
Registration number: 16157146
Registered office: Saani tn 2/2-26, Põhja-Tallinna, Tallinn, Harju maakond, 10149, Estonia
Contact email: info@pappafresh.it

For any request regarding the processing of your data, you can write to us at the email address indicated above.

2. Data we collect

Depending on how you interact with us, we may process the following categories of data:

Order and account data: first name, last name, email address, phone number and the details relating to your dog (e.g. weight, age, any food sensitivities) that you provide to us in order to personalise the feeding plan.
Shipping data: delivery and billing address necessary to deliver your orders.
Payment data: payments are handled by our provider Stripe. Full card details are processed directly by Stripe and are not stored on our servers; we only receive confirmation of the transaction outcome and partial identifying data (e.g. the last four digits, card type).
Email and newsletter: email address and subscription preferences, if you choose to receive our communications.
Browsing data: information collected automatically through cookies and similar technologies, such as IP address, browser and device type, pages visited and interactions with the site (see the Cookie Policy).
Communications: the content of the requests you send us via email or contact forms.

3. Purposes and legal bases

Purpose	Legal basis
Manage orders, subscriptions, payments and shipments	Performance of the contract (Art. 6.1.b GDPR)
Provide customer support and respond to requests	Performance of the contract and legitimate interest (Art. 6.1.b and 6.1.f)
Comply with tax, accounting and legal obligations	Legal obligation (Art. 6.1.c GDPR)
Send newsletters and promotional communications	Consent (Art. 6.1.a GDPR), revocable at any time
Statistical analysis and improvement of the site	Consent for non-essential cookies / legitimate interest (Art. 6.1.a and 6.1.f)
Prevent fraud and ensure the security of the service	Legitimate interest (Art. 6.1.f GDPR)

4. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

Order and billing data: for the period required by tax and accounting obligations (generally up to 10 years).
Account and subscription data: for the entire duration of the relationship and subsequently for the time necessary to handle any disputes.
Newsletter data: until consent is withdrawn or you unsubscribe from the list.
Browsing data: according to the durations indicated in the Cookie Policy.

At the end of the retention periods, the data is irreversibly deleted or anonymised.

5. Data subject rights

As a data subject, under Articles 15-22 of the GDPR you have the right to:

Access: obtain confirmation of the processing and a copy of your data;
Rectification: correct inaccurate or incomplete data;
Erasure: request the deletion of your data (the "right to be forgotten") in the cases provided for;
Restriction: request the restriction of processing in certain circumstances;
Portability: receive your data in a structured, commonly used format and transmit it to another controller;
Objection: object to processing based on legitimate interest and to direct marketing;
Withdrawal of consent: withdraw at any time the consent you have given, without affecting the lawfulness of the prior processing.

To exercise these rights, write to info@pappafresh.it. You also have the right to lodge a complaint with a supervisory authority, for example the Italian Data Protection Authority (Garante per la protezione dei dati personali) in Italy (garanteprivacy.it) or the Estonian data protection authority (Andmekaitse Inspektsioon).

6. Transfers and data processors

To provide the service we rely on selected providers who process data on our behalf as data processors, on the basis of dedicated agreements:

Stripe – secure payment processing and subscription management;
Couriers and logistics operators – delivery of orders to the indicated address;
Email and marketing service providers – sending transactional communications and the newsletter;
Hosting providers and analytics tools – operation of the site and aggregate statistics.

Some of these providers may process data outside the European Economic Area. In such cases, the transfer takes place in compliance with the GDPR, for example through adequacy decisions or Standard Contractual Clauses approved by the European Commission. We do not sell your personal data to third parties.

7. Security

We adopt appropriate technical and organisational measures to protect personal data from unauthorised access, loss or disclosure, including encrypted connections (HTTPS) and entrusting payments to a PCI-DSS certified provider such as Stripe.

The pappafresh.it website uses cookies and similar technologies to function correctly and to improve your experience. Cookies are small text files stored on your device.

Technical cookies (necessary)

Essential to the functioning of the site: they manage, for example, the cart, the session and basic preferences. No consent is required for these cookies and they cannot be disabled without compromising the use of the site.

Third-party cookies

Stripe: used during payment to ensure the security of transactions and prevent fraud.
Analytics (if applicable): if enabled with your consent, they help us understand in aggregate form how the site is used in order to improve it.

How to manage cookies

You can manage or disable cookies through any consent banner present on the site and through your browser settings, where you can block or delete cookies that are already installed. Disabling technical cookies may limit some functionalities of the site.

9. Contact

For any questions regarding this Privacy Policy or the processing of your personal data, you can contact Pappa Fresh OÜ at info@pappafresh.it.

Last updated: June 2026 — template document to be reviewed by a lawyer before publication.