Text updated on 20 October 2026.
This page describes the processing of personal data of people who visit this site and of people who buy on it. Purchases are reserved to people aged 18 or over. This page is not directed at children.
Controller
The controller is ECOMMERCE SPACE S.R.L., with its registered office at Via D’Ascanio Corradino 4, 20142 Milan (MI), Italy, VAT and tax number 11284250963, REA MI-2591817, Milan Companies Register. The email for customers and for the exercise of rights is info@sensoryseeds.com.
Data
To buy, the customer gives their name, delivery address, email, telephone number and the contents of the order. The telephone number is asked at checkout for delivery.
The customer can buy without an account. If the customer creates an account, the controller processes the account data.
If the person writes in the contact form, the controller processes the data they enter in order to reply. If the person writes on Facebook Messenger, Meta receives the content of the message so that a reply can be given.
If the person publishes a review, the name and the text may be shown on the site. If the person subscribes to the newsletter, the email is used for the communications they subscribed to.
If the person enters their email at checkout and does not complete the order, the site saves the email, the first and last name if entered, the cart contents with the amounts, the country, the postcode, the city, the province and the language. The same applies to an order that is created and not paid, and to the cart of a person who has an account, even if they do not reach the checkout. The site also records whether the person opens the links in the cart emails.
Some information is not given by the person. Weldpay communicates the outcome of the card payment, without the full card data. The courier instructed to deliver communicates the outcome, for example a refused parcel or absence on delivery. The provider that hosts the site processes the data needed to run the pages. Google processes the visit-statistics data described in the cookie policy. If the person plays a video embedded from Vimeo, Vimeo processes the data of that playback.
Purposes
To perform the order and deliver it, including the telephone number and the delivery data, the basis is Article 6(1)(b) of Regulation (EU) 2016/679. Without the data needed to deliver and to pay, the order is not concluded. The account is optional: if the person creates it, the basis of the account data is the same point (b).
The contact form and a Messenger message have the basis of point (b): they are steps requested by the person before a contract or for a contract already concluded.
If the person plays a video embedded from Vimeo, the data of that playback have the basis of point (b): they are needed to show the video the person asked for.
Publication of a review has the basis of point (a).
The newsletter has the basis of point (a). Consent can be withdrawn at any time by writing to info@sensoryseeds.com. Withdrawal does not affect the lawfulness of processing carried out before it.
With the data of the uncompleted cart the site sends up to three emails, over the following hours and days, as a reminder. The second and the third may contain a discount coupon. The emails are not sent if the order is completed. The basis is Article 6(1)(f). The legitimate interest is to remind the person of a purchase they started on this site.
The person can object to these emails at any time, without giving a reason, with the link in every email or by writing to info@sensoryseeds.com. After the objection, that address no longer receives these emails from this site.
For accounting and tax obligations on the order, the basis is Article 6(1)(c).
A complaint about delivery or about the order, where it is necessary to perform the contract, has the basis of point (b).
The reply to a right, even if the request arises from the contract, and every other reply that the law requires, have the basis of point (c). This basis includes the reply that the Regulation requires of the controller and the reply due for the legal guarantee or for another obligation towards the consumer. If the two processing activities coexist, each keeps its own basis.
The technical cookies needed to keep the cart and to complete payment have the basis of point (b). They do not use consent and they do not use legitimate interest. The site also uses strictly necessary technical cookies for browsing only. Those are technical and do not ask for consent. Cookies are described in the cookie policy, at /cookie-policy/.
Visit statistics use Google Analytics. They are technical cookies, as described in the cookie policy: they do not identify the user, they mask at least the fourth octet of the IP address, they produce only aggregate statistics and as a rule on a single site, and they do not combine the data with other processing or pass them on. They do not use consent.
If a dispute arises, the data are used to defend the company’s position, for the duration of the dispute. The basis is Article 6(1)(f). The legitimate interest is to defend that position.
The person may object to this processing on grounds relating to their particular situation, by writing to info@sensoryseeds.com. The company may continue only if it demonstrates compelling legitimate grounds which override, or if the processing serves to establish, exercise or defend a legal claim.
There are no decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect the person.
Recipients
The provider that hosts the site receives the data needed to run the pages.
The provider that sends the site’s emails receives the address and the content of the emails, including those about an uncompleted cart.
Google receives the visit-statistics data.
Meta receives the content of the message if the person writes on Facebook Messenger.
Vimeo receives the playback data if the person watches a video embedded from Vimeo.
The courier instructed to deliver receives the data in order to deliver the order.
Weldpay receives the data for payment by credit card. Payments made on the site are processed by Weldpay, an authorised payment service provider, in a secure environment compliant with PCI DSS and Directive (EU) 2015/2366 (PSD2). ECOMMERCE SPACE S.R.L. does not store and does not have access to the full card data. Weldpay handles them.
Transfers
Google, Meta and Vimeo may also process data in the United States, in the cases described above. Where a transfer takes place, it follows Chapter V of Regulation (EU) 2016/679. The person may write to info@sensoryseeds.com to know which safeguard applies and how to obtain a copy.
Retention
Order data are kept for the duration of the contract, for the time of a complaint or a dispute, and for the accounting records. The accounting records of the order are kept for ten years, under Article 2220 of the Italian Civil Code. They are then deleted or anonymised.
Account data are kept while the account is open. Linked orders follow the order periods. The telephone number follows the order periods.
The data of an uncompleted cart are deleted 60 days after the cart is closed. The cart is closed when the order is completed, when the person objects to the emails, or at the latest 60 days after it was abandoned. An open cart without an email is deleted after 7 days of inactivity. An unused coupon is deleted 7 days after it expires; a used coupon stays, like the order history. After deletion, only a fingerprint of the address of a person who objected is kept, from which the address cannot be derived, so that the person is not written to again. A similar fingerprint is kept for up to 187 days after a coupon, to limit the coupons given to the same person.
Contact-form and Messenger data are kept for the time needed to handle the request. They are then deleted, unless they become part of an order, a complaint or a dispute.
A published review stays until it is removed. Newsletter data stay until consent is withdrawn.
Rights
The person may request access to the data, rectification, erasure, restriction of processing, may object to the processing and may request portability. The request is sent to info@sensoryseeds.com.
The person may lodge a complaint with the Italian Data Protection Authority and with the supervisory authority of the Member State where they live.
The newsletter and the publication of a review are based on consent. Consent can be withdrawn at any time by writing to info@sensoryseeds.com, without affecting the lawfulness of processing carried out before the withdrawal. The person may also object to promotional communications: the newsletter stops. The other processing described on this page is not based on consent.
Data required for the order
The data needed to deliver and to pay, including the telephone number asked at checkout, are a requirement for concluding the contract. Without those data the order is not concluded. The account, the newsletter and a review are not required in order to buy.
Terms
Purchases are described in the terms and conditions, at /terms-and-conditions/.