Effective date -------------- 25 July 2026 About this policy ----------------- This Privacy and Cookie Policy explains how KalaRara Roma collects, uses, stores and protects personal data when you visit kalarararoma.com, contact the atelier, or use the website’s request for shipping, payment and acquisition information. It also explains the use of cookies and similar technologies. This policy applies to the English and Italian versions of the website. KalaRara Roma does not sell personal data. 1. Data controller ------------------ The data controller is: KalaRara di 5 Rooms Srl Piazza della Rovere 115, int. 9 00165 Roma, Italy VAT / P. IVA: 14455331000 Email: info@kalarararoma.com 2. Personal data we collect --------------------------- Depending on how you use the website, we may collect: • identity and contact data, including first and last name, email address, telephone number and postal address; • enquiry and acquisition data, including the works selected, quantity, product link or reference, price displayed, shipping destination, questions, messages and correspondence; • transaction and administrative data where an acquisition proceeds, including quotations, invoices, payment status, shipping details and records required for accounting or legal purposes; • marketing preference data, including whether you have chosen to receive news and updates; • technical and usage data, including IP address, browser and device information, pages viewed, referral information, approximate location, cookie identifiers and information used to maintain security and prevent abuse. Please do not include sensitive personal data in free-text fields unless it is strictly necessary for your request. 3. How we collect data ---------------------- We collect data directly from you when you complete a form, submit an acquisition request, email or telephone us, or correspond with us. We also collect limited technical and usage data automatically through Squarespace, cookies, Google Analytics (where you consent), and security tools such as Google reCAPTCHA. 4. Purposes and legal bases --------------------------- We process personal data for the following purposes and legal bases: • Website operation and security: to deliver the website, remember privacy choices, maintain the request list, prevent spam and abuse, diagnose faults and protect the website. The legal basis is our legitimate interest in operating a secure and functional website and, where applicable, compliance with legal obligations. • Enquiries and acquisition requests: to identify the requested works, respond to questions, calculate shipping, discuss payment options, prepare quotations and take steps toward a possible acquisition. The legal basis is taking steps at your request before entering into a contract. General correspondence may also be processed on the basis of our legitimate interest in responding to communications concerning the atelier. • Acquisitions, delivery and administration: to fulfil an agreement, arrange payment and shipping, issue invoices, keep accounting records, address claims and comply with tax, customs and other legal obligations. The legal bases are performance of a contract and compliance with legal obligations. • Analytics and improvement: to understand how the website is used and improve its content and performance. Non-essential analytics technologies, including Google Analytics, are used only where you have given consent. • News and updates: to send marketing communications only where you have actively opted in. The legal basis is consent, which may be withdrawn at any time. KalaRara Roma does not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects. 5. Request list and acquisition workflow ---------------------------------------- The website’s “Request Shipping and Payment Information” function is an enquiry and acquisition-request tool, not an immediate online checkout. It allows you to select one or more works and send their details with your contact and delivery information to KalaRara Roma. No payment-card data is collected through this form and no payment is completed on the website. Shipping and payment arrangements are discussed personally after the request is received. The request function is supported by Squarespace and a technical Wishlist extension supplied by S.F. Digital. Technical providers may access information only where necessary to provide, secure or maintain their services and are not permitted to use it for their own independent marketing. 6. Cookies and similar technologies ----------------------------------- The website uses cookies and similar technologies in the following categories: • Necessary technologies: required for core website functions, security, forms, privacy preferences and the request list. These cannot be disabled through the website’s consent banner because the site may not function correctly without them. • Analytics technologies: used to understand visits and website performance, including Google Analytics. These are activated only with your consent where required. • Marketing technologies: KalaRara Roma does not currently use the website to run behavioural advertising. If marketing technologies are introduced in the future, they will be used only with any consent required by law. When you first visit the website, the cookie banner allows you to accept or decline non-essential cookies. You may change your selection at any time through “Cookie Preferences” in the website footer. You can also delete or block cookies through your browser, although this may affect website functions. The precise cookies, providers and durations may change when Squarespace or connected services are updated. Current choices and available categories are shown through Cookie Preferences. 7. Service providers and recipients ----------------------------------- Personal data may be processed by: • Squarespace, which hosts and operates the website, forms and related commerce functions; • Google services, including Gmail/Google Workspace for email, Google Analytics for consented website analytics, and Google reCAPTCHA for spam and abuse prevention; • S.F. Digital and other technical providers where access is necessary to support or maintain the Wishlist extension or website; • Mailchimp only if KalaRara Roma resumes newsletters or marketing campaigns and you have opted in; • payment, banking, insurance, logistics, packing, shipping, customs, accounting, legal and professional service providers where necessary for an enquiry, acquisition, delivery or legal requirement; • public authorities where disclosure is required by law. We require service providers to process personal data only for the relevant services and with appropriate safeguards. We do not sell personal data or provide it to third parties for their independent direct marketing. 8. International transfers -------------------------- Some service providers may process personal data outside the European Economic Area, including in the United States. Where this occurs, transfers are made using a valid legal mechanism, such as an adequacy decision, the EU–US Data Privacy Framework where applicable, Standard Contractual Clauses, or another safeguard permitted by data-protection law. Information about a provider’s applicable safeguards is available from that provider or from KalaRara Roma on request. 9. Retention ------------ We retain personal data only for as long as necessary for the purposes described above: • enquiries that do not result in an acquisition: normally up to 24 months after the last meaningful contact; • acquisition, contract, invoice, accounting, tax, customs and related records: for the period required by applicable law, generally up to 10 years, and longer only where necessary for a dispute or legal claim; • marketing data: until consent is withdrawn or, where appropriate, after 24 months of inactivity; • cookie and analytics data: according to the duration stated in Cookie Preferences and the settings of the relevant service. Data may be retained for a longer period where required by law, necessary to establish, exercise or defend legal claims, or needed to resolve an active matter. 10. Required and optional information ------------------------------------- Fields marked as required are needed to identify you, understand the request, calculate delivery or respond effectively. If required information is not provided, we may be unable to process the request. Telephone, address and other fields that are not marked as required are voluntary, although delivery information will be needed if the request progresses. Marketing consent is always optional and has no effect on the handling of an enquiry or acquisition. 11. Your rights --------------- Subject to the conditions and limits of applicable law, you may request: • access to your personal data and information about its processing; • correction of inaccurate or incomplete data; • erasure of data; • restriction of processing; • receipt or transfer of data in a portable format where applicable; • objection to processing based on legitimate interests; • withdrawal of consent at any time, without affecting processing carried out before withdrawal. To exercise a right, email info@kalarararoma.com. We may ask for information reasonably necessary to verify your identity and request. 12. Complaints -------------- You have the right to lodge a complaint with the Italian data-protection authority: Garante per la protezione dei dati personali Piazza Venezia 11, 00187 Roma, Italy www.garanteprivacy.it You may also contact the supervisory authority in the EU or EEA country where you live, work, or believe an infringement occurred. We encourage you to contact KalaRara Roma first so that we can try to resolve the matter. 13. Security ------------ We use reasonable organisational and technical measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure. No internet transmission or storage system is completely secure, and absolute security cannot be guaranteed. 14. Third-party links --------------------- The website may link to third-party services, including Instagram and 1stDibs. Those services operate under their own privacy and cookie policies. KalaRara Roma is not responsible for the privacy practices of third-party websites. 15. Children ------------ The website and its acquisition services are not directed to children. We do not knowingly collect personal data from children through the website. If you believe a child has supplied personal data, please contact us so that we can review and, where appropriate, delete it. 16. Changes to this policy -------------------------- We may update this policy to reflect changes to the website, services or legal requirements. The current version will be published on the website with its effective date. 17. Contact ----------- For privacy questions or requests: KalaRara di 5 Rooms Srl Email: info@kalarararoma.com Address: Piazza della Rovere 115, int. 9, 00165 Roma, Italy