Personal Data Processing Notice

English version - v1.0 | Updated 24 August 2026

This Policy explains how Illustar processes the personal data of website visitors, customers, registered users and people who contact customer support.

1. Data controller

Mirko Grisendi, sole trader trading under the name Illustar, with business address at Via Don Pasquino Borghi 18, 42021 Bibbiano (Reggio Emilia), Italy, VAT no. IT02836770350, Tax Code GRSMRK72R02H223H and REA no. RE - 317851, is the data controller. Website: https://www.illustar.art. Email: support@illustar.art.

No data protection officer has been appointed. If this changes, the relevant contact details will be published in this Policy.

2. Personal data we process

Identification and contact data: first name, last name, email address, billing address and, where provided, company name and telephone number.
Order and licence data: purchased products, selected licence type, amounts, coupons, credits, downloads and order history.
Payment data: payment method, transaction status and payment identifiers. Full payment instrument details are generally processed directly by the selected payment provider and are not made available to Illustar.
Tax and billing data: Tax Code, VAT/VAT identification number, SDI recipient code or certified email address (PEC), and any other information required to issue an invoice.
Technical and usage data: IP address, browser, operating system, device identifiers, access logs, security events, cookies and similar technologies, subject to the choices available through the consent tool.
Download data: purchased file, delivery status and information necessary to provide and support the download through Shopify Digital Downloads.
Communications and support data: the content of requests, replies, attachments voluntarily sent by the user and information needed to resolve the request.
Preferences: language, country, marketing choices, cookie choices and other privacy preferences.

3. Purposes and lawful bases

Process orders, provide digital files, manage licences and credits, and maintain the customer account where created: performance of a contract or steps taken at the data subject's request before entering into a contract.
Process payments, prevent fraud and protect transactions: performance of a contract, compliance with legal obligations and Illustar's legitimate interest in protecting its business and customers.
Issue invoices and maintain tax and accounting records: compliance with legal obligations.
Respond to enquiries and provide technical or contractual support: performance of a contract or Illustar's legitimate interest in managing requests and providing assistance.
Send newsletters and promotional communications, where the service is used: consent, which may be withdrawn at any time.
Use non-essential analytics tools, where enabled: consent expressed through the available privacy and cookie controls.
Comply with legal obligations, exercise or defend legal claims, prevent abuse and protect the service: legal obligation or legitimate interest, as applicable.

4. Providing personal data

Data marked as required are necessary to complete a purchase, deliver the file, manage the licence, create an account or respond to a request. If these data are not provided, the relevant service may not be available. Consent to newsletters and non-essential cookies is optional and may be refused or withdrawn without affecting purchases.

5. Sources of personal data

Personal data are collected directly from the data subject, generated through use of the website and the customer account, or received from Shopify, PayPal, the selected payment provider and the services connected to the store, insofar as necessary to complete the transaction or provide the requested service.

6. Platform and recipients

The store is hosted on Shopify. Personal data may be disclosed, only where necessary, to providers supporting hosting, ecommerce operations, payments, email delivery where used, security, accounting, customer support, digital delivery and professional advice. Depending on the circumstances, these recipients act as processors, sub-processors or independent controllers under their own privacy notices.

Shopify, including Shopify Payments, Shop Pay and related technical services where active.
PayPal and the payment networks or providers selected by the customer.
Shopify Digital Downloads, used to deliver purchased files and manage the related download service.
Shopify Customer Privacy, used to manage cookie and privacy choices and, where enabled, record consent preferences.
Public authorities, accountants, legal advisers and other professionals where disclosure is required by law or necessary to establish, exercise or defend legal claims.

7. International transfers

Some service providers, including Shopify and payment providers, may process personal data outside the European Economic Area. Where required, transfers are based on an adequacy decision, standard contractual clauses or another safeguard recognised by applicable data protection law. Information on the safeguards relevant to a specific transfer may be requested from the data controller.

8. Retention

Personal data are retained only for as long as necessary for the purposes for which they were collected and, where applicable, for the longer periods required by tax, accounting or other legal obligations, or needed to establish, exercise or defend legal claims. Account data are retained while the account is active and thereafter as required for orders and legal obligations. Support communications are retained for the time needed to handle the request and any related claims. Marketing data are retained until consent is withdrawn, the user unsubscribes or the service ends, subject to any limited retention needed to document the opt-out.

9. Data subject rights

Subject to the conditions laid down by applicable law, data subjects may request access to, rectification or erasure of their personal data, restriction of processing, data portability, and may object to processing based on legitimate interests. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Data subjects may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the competent supervisory authority in their country.

Requests may be sent to support@illustar.art. Illustar may request information reasonably necessary to verify the applicant's identity and protect personal data from unauthorised access.

10. Automated decision-making

Illustar does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject. Payment and fraud-prevention providers may apply automated controls under their own privacy notices.

11. Minors

Purchases and customer accounts are intended for people aged 18 or over. If Illustar becomes aware that personal data have been submitted by a minor in breach of this requirement, it will take reasonable steps to delete them, subject to applicable legal obligations.

12. Security

Illustar adopts technical and organisational measures appropriate to the nature of the data and the risks of processing. No online system can be guaranteed to be completely secure. Users must keep their account credentials and download links confidential and should report suspected unauthorised use to support@illustar.art.

13. Changes to this Policy

This Policy may be updated to reflect legal, technical or organisational changes. The date of the latest update is shown at the beginning of the document. Where appropriate, material changes will also be communicated through the website or another suitable channel.