Strictly No Small Talk.
Expect zero noise, just quality updates.
We email once a month. Maybe twice.
Never miss a drop and get 10% OFF your first order.
Privacy policy
PRIVACY AND COOKIE POLICY
Last updated: 13 October 2026
We collect only the data we need, use it only for the purposes described here and never sell it. This notice is provided under arts. 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 ("Italian Privacy Code").
1. DATA CONTROLLER
Scalioti Giuseppe Alessandro, owner of the sole proprietorship PepperCap di Scalioti Giuseppe Alessandro
Via Michele de Napoli 21, 70126 Bari (BA), Italy
VAT no. 09142410720 · REA BA-674835
Email for privacy requests: gius3009@gmail.com (or support@peppercap.it)
Certified email (PEC): giuseppe.scalioti@pec.it
Phone: +39 342 842 4472
No Data Protection Officer (DPO) has been appointed, as it is not required for our business.
2. WHAT DATA WE PROCESS
- a) Contact and identification data: first name, last name, email, phone number (if you provide it), shipping and billing address.
- b) Order data: products bought, amounts, date, shipping method, returns and refunds.
- c) Payment data: the method used and the outcome of the transaction. Full card details are handled only by payment providers (Shopify Payments, PayPal): we do not see or store them.
- d) Account data, if you create one: login details, order history, saved addresses.
- e) Communications: messages you send us by email, contact form or social media.
- f) Reviews: text, rating, date, any photos and the name you choose to display. For reviews you left us on one of our other online sales channels, your first name and last initial as shown on that channel (section 3.6).
- g) Browsing data: IP address, device and browser type, pages visited, products viewed and added to the cart, where your visit came from and, if you accept statistics cookies, how you move around the pages (clicks, taps, scrolling and mouse movements, see section 3.7-bis). Some of this is collected through cookies and similar tools (section 9).
We do not process special categories of data (for example health data). The website is not aimed at children under 14 and we do not knowingly collect their data.
3. WHY WE PROCESS IT, ON WHAT LEGAL BASIS AND FOR HOW LONG
3.1 Managing orders, payments, shipping, returns, refunds and guarantee claims; managing your account.
Legal basis: performance of the contract and pre-contractual steps (art. 6(1)(b) GDPR).
Retention: for the duration of the relationship and then 10 years for order documents (art. 2220 of the Italian Civil Code). Account data is kept until you delete your account.
3.2 Complying with legal obligations (tax, accounting, consumer protection).
Legal basis: legal obligation (art. 6(1)(c) GDPR).
Retention: 10 years.
3.3 Answering your support requests.
Legal basis: performance of the contract or pre-contractual steps (art. 6(1)(b) GDPR).
Retention: up to 24 months from the last communication, unless needed for an order (see 3.1).
3.4 Sending you our newsletter and promotional emails, including abandoned-cart reminders.
Legal basis: your consent (art. 6(1)(a) GDPR), which you give by entering your email in the newsletter sign-up form on the website (next to which you'll find a link to this policy). The welcome discount is a perk for subscribers: if you don't sign up, you can still buy on the same terms. You can withdraw it at any time via the "unsubscribe" link in every email or by writing to us. Withdrawal does not affect processing already carried out.
Retention: until you withdraw your consent.
3.4-bis Measuring our emails and tailoring them to how you interact with us (profiling).
What we do: emails sent through Klaviyo contain measurement tools: an invisible image (pixel) that records whether and when you open the email, and tracked links that record what you click. If you are subscribed and have accepted marketing cookies on the banner, Klaviyo also links your activity on the website to your profile: products viewed, products added to the cart and checkouts started. Completed orders are linked to your profile in any case, so we don't send you reminders about things you've already bought.
Why: to decide which emails to send you and when (for example a cart reminder, products you looked at, or a discount code if you seem interested), to email you less or stop altogether if you haven't opened our emails in a long time, and to measure how our campaigns perform. For this, your profile is placed in automatic groups (segments) based on your behaviour. We make no decisions that produce legal effects on you or similarly significantly affect you (art. 22 GDPR): at most you get a different email or a different code.
Legal basis: for measuring opens and clicks and choosing which emails to send, the consent you give when you subscribe to the newsletter (art. 6(1)(a) GDPR; art. 130 of the Italian Privacy Code), which covers this tailoring; for linking your browsing on the website to your profile, the consent to marketing cookies you give on the banner (art. 122 of the Italian Privacy Code). For the emails described in 3.5, legitimate interest (art. 6(1)(f) GDPR), which you can object to at any time. The two consents are separate: you can get the newsletter without accepting marketing cookies.
How to stop it: use the "unsubscribe" link in any email, write to us (section 7), withdraw your marketing-cookie consent from the "Cookie preferences" link in the footer or, for opens only, turn off image loading in your email app.
Retention: until you withdraw your consent or object. Profiles that haven't opened or clicked any of our emails for 24 months are deleted.
3.5 Sending customers who have already bought from us emails about products similar to those they purchased.
Legal basis: legitimate interest, within the limits of art. 130(4) of the Italian Privacy Code ("soft opt-in"). You can object at any time, including at the time of purchase, via the link in every email.
Retention: until you object, and in any case no longer than 24 months after your last purchase.
3.6 Asking you for a review after your purchase and publishing reviews.
What we do: after an order on the website, we email you through Judge.me a link to leave a review. We also publish on the website reviews that customers left us after buying on our other online sales channels: in that case we receive the data (text, rating, date, first name and last initial) from that channel, where it is already publicly visible, and this section serves as the notice required by art. 14 GDPR.
Legal basis: legitimate interest in collecting and showing verified opinions on our products (art. 6(1)(f) GDPR). You can object at any time: if you don't want your review to appear on the website, write to us (section 7) and we will take it down.
Retention: reviews stay published until you ask us to remove them.
3.7 Website usage statistics (Google Analytics 4).
Legal basis: your consent via the cookie banner (art. 6(1)(a) GDPR and art. 122 of the Italian Privacy Code).
Retention: up to 14 months.
3.7-bis Session recordings and heatmaps (Microsoft Clarity).
What we do: with your consent, Microsoft Clarity records how you use the website's pages: clicks, taps, scrolling, mouse movements and the pages you open, along with device, browser, approximate country and where your visit came from. This gives us replays of single visits and heatmaps showing where people click and how far they scroll. We use them only to spot what doesn't work and make the site easier to use, never to work out who you are. What you type into forms (name, email, address, payment details) is masked and never reaches Clarity, and the checkout is not recorded.
Legal basis: your consent to statistics cookies via the cookie banner (art. 6(1)(a) GDPR and art. 122 of the Italian Privacy Code). Without it, Clarity doesn't load at all. You can withdraw it at any time from the "Cookie preferences" link in the footer; Clarity then deletes its cookies.
Microsoft's own use: Microsoft may also use this data, as an independent controller under its own privacy statement, to run, improve and secure its services. It can use it for Microsoft Advertising only if you have also accepted marketing cookies.
Retention: recordings are deleted after 30 days, apart from the few we save as useful and a random sample Microsoft keeps, which last up to 9 months; heatmaps and aggregate statistics last up to 9 months.
3.8 Advertising, remarketing and campaign measurement on Google (Google Ads) and Meta (Facebook, Instagram).
- With your consent we use cookies and similar tools to: know whether a visit or a purchase came from one of our ads; show our ads, on Google and on sites that carry Google advertising, to people who have already visited the store (remarketing); build groups of visitors based on the pages they viewed, without identifying you by name.
Legal basis: your consent via the cookie banner (art. 6(1)(a) GDPR and art. 122 of the Italian Privacy Code). You can withdraw it at any time from the "Cookie preferences" link in the footer.
Retention: as set out in section 9; remarketing visitor groups last 540 days at most.
3.8-bis Google enhanced conversions.
- When you complete an order after consenting to marketing cookies, the store sends Google the email, phone number and address you entered, turned into an encrypted code (SHA-256 hash) before they leave the site. Google matches them against its own accounts to attribute the purchase to the ad that led to it. We receive no information about you from Google.
Legal basis: your consent via the cookie banner (art. 6(1)(a) GDPR).
Retention: Google deletes the hashed data once matching is complete, under its own data processing terms.
3.9 Website security and payment fraud prevention.
Legal basis: legitimate interest (art. 6(1)(f) GDPR).
Retention: for as long as strictly necessary and no longer than 12 months, unless there is a dispute.
3.10 Protecting our rights in case of disputes.
Legal basis: legitimate interest (art. 6(1)(f) GDPR).
Retention: until the relevant limitation period expires (usually 10 years).
4. DO YOU HAVE TO PROVIDE YOUR DATA?
The data marked as required at checkout is needed to conclude and carry out your purchase: without it we cannot fulfil your order. Consent to the newsletter and to non-essential cookies is optional: if you don't give it, you can still shop and browse normally.
5. WHO WE SHARE DATA WITH
Data is processed by the controller and by providers that help us run the shop. They act as data processors (art. 28 GDPR) or, where stated, as independent controllers. We do not sell your data.
- Shopify (Shopify International Limited, Ireland): website platform, checkout, Shopify Payments, transactional emails. Processor. We've also switched on Shopify Network Intelligence: Shopify uses our store's customer data, together with other data it holds, to improve its services, personalise your shopping experience and make ads and marketing more relevant, including on our behalf. For these uses Shopify acts as an independent controller under its own privacy policy (https://www.shopify.com/legal/privacy/customers), and other merchants can't see your data. Personalised ads are based on your consent. Our legal basis for this sharing is our legitimate interest in improving the store and our campaigns (art. 6(1)(f) GDPR): you can object by writing to us (section 7) or through Shopify's privacy portal (https://privacy.shopify.com).
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg): PayPal payments. Independent controller.
- Klaviyo (Klaviyo, Inc., USA): newsletter and automated emails; sign-up forms on the store; email measurement and profile segmentation (sections 3.4-bis and 9.3). Processor.
- Judge.me (Judge.me Reviews Inc., Canada): collecting and publishing reviews. Processor.
- Google (Google Ireland Limited, Ireland): statistics (Google Analytics 4), product listings on Google (Merchant Center), advertising and remarketing (Google Ads), enhanced conversions. Processor for Analytics and enhanced conversions; independent controller for the other advertising services.
- Meta (Meta Platforms Ireland Limited, Ireland): Meta Pixel for measurement and advertising on Facebook and Instagram. Joint controller for data collection through the pixel, independent controller for subsequent processing.
- Microsoft (Microsoft Ireland Operations Limited, Ireland): session recordings and heatmaps (Microsoft Clarity, section 3.7-bis). Processor for the service it provides to us; independent controller for its own uses described in 3.7-bis.
- one.com: registration of the peppercap.it domain and email service. Processor.
- Sendcloud (Sendcloud B.V., Netherlands): shipping and return labels, parcel tracking and shipping status emails. Processor.
- Revoq (BuschBytes, Germany, data hosted in the EU): the online withdrawal form and the email confirming we've received your withdrawal. Processor.
- BRT S.p.A. and Poste Italiane S.p.A.: delivery of parcels and returns. Independent controllers for transport activities.
- Accountant and advisers: tax and legal compliance. Bound by professional secrecy.
- Public authorities: only where required by law.
An up-to-date list of processors is available on request.
6. TRANSFERS OUTSIDE THE EUROPEAN UNION
Some providers (in particular Shopify, Klaviyo, Google, Meta and Microsoft) may process data in the United States, Canada or other countries outside the EU. In these cases the transfer is based on an adequacy decision of the European Commission (for example the EU-U.S. Data Privacy Framework for certified US companies and the adequacy decision for Canada) or on the Standard Contractual Clauses approved by the Commission (art. 46 GDPR). You can ask us for a copy of the safeguards in place.
7. YOUR RIGHTS
At any time you can ask for:
- access to your data and a copy of it (art. 15 GDPR);
- correction of inaccurate data (art. 16);
- erasure (art. 17);
- restriction of processing (art. 18);
- portability of the data you provided to us (art. 20);
- to object to processing based on legitimate interest and, always, to marketing (art. 21);
- to withdraw any consent given, without affecting earlier processing (art. 7(3)).
To exercise them, write to gius3009@gmail.com or support@peppercap.it. We reply within 1 month. We may ask you to verify your identity.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live.
8. AUTOMATED DECISIONS
We do not make decisions based solely on automated processing that produce legal effects concerning you. Payment providers' anti-fraud systems may flag suspicious transactions; in that case the final decision on the order is made by a person.
9. COOKIES
9.1 Cookies are small files the website stores on your device. We use:
- technical cookies, needed for the website to work (cart, checkout, language, security, remembering your cookie choices). They do not require consent (art. 122 of the Italian Privacy Code);
- third-party statistics cookies (Google Analytics 4 and Microsoft Clarity), to understand how the website is used. Only with your consent;
- third-party marketing cookies (Google Ads, Meta Pixel, Klaviyo), used to measure campaigns, recognise returning visitors, link browsing to the profile of newsletter subscribers and show relevant ads or content. Only with your consent;
- technical tools for the sign-up forms (Klaviyo): the script that shows the newsletter sign-up forms stores in your browser (local storage) only which forms you've already seen or closed, so they don't keep popping up. It holds no identifier and doesn't track your browsing. No consent required (art. 122 of the Italian Privacy Code).
9.2 On your first visit, if you are in the European Union, the United Kingdom or Switzerland, the banner lets you accept, reject or choose by category. Closing the banner without choosing means rejecting non-essential cookies. You can change your mind at any time via the "Cookie preferences" link in the website footer.
9.3 Before you choose on the banner we don't switch on any statistics or marketing cookies (Google, Meta, Klaviyo, Microsoft Clarity): the Klaviyo script doesn't load at all, and Microsoft Clarity loads only if you accept statistics cookies. Google only receives the anonymous signals provided for by "Consent Mode". Once you've chosen, the Klaviyo script loads to show the newsletter sign-up forms. If you've rejected marketing cookies, it doesn't set the "__kla_id" tracking cookie and doesn't record the pages or products you look at. To pick the right form (for example by language or country), Klaviyo receives your device's IP address, as any site serving content does, and uses it only to work out your country; legal basis: legitimate interest in showing the right form (art. 6(1)(f) GDPR). If you accept marketing cookies, Klaviyo sets the "__kla_id" cookie (lasting up to 2 years) and, if you're subscribed, links your browsing to your profile as described in 3.4-bis.
9.4 Indicative duration: technical cookies from end of session to 1 year; Google Analytics up to 13 months; Google Ads up to 90 days for ad-click measurement and up to 13 months for ad personalisation; Meta Pixel up to 90 days; Klaviyo up to 2 years; Microsoft Clarity up to 13 months. Third-party providers also process data under their own policies:
- Google: https://policies.google.com/privacy
- How Google uses data from sites and apps that use its services: https://policies.google.com/technologies/partner-sites
- Google ad settings: https://myadcenter.google.com
- Meta: https://www.facebook.com/privacy/policy
- Klaviyo: https://www.klaviyo.com/legal/privacy
- Shopify: https://www.shopify.com/legal/privacy
- Microsoft: https://privacy.microsoft.com/privacystatement
9.5 You can also block or delete cookies in your browser settings. Blocking technical cookies may stop the cart from working.
10. SECURITY
We take appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), payments handled by PCI-DSS certified providers, protected access to management systems. No system is 100% secure: if a data breach affects you, we will inform you where required by law.
11. CHANGES
We may update this notice. The current version is always published on this page with the date of the last update. In case of significant changes we will also let you know by email, if we have your address.