★★★★★
“I’ve been buying Caramì for years, for both myself and my partner, and the quality has always been impeccable — it has actually improved. Well done!”
Verified customer · IT · 16/02/2026Privacy policy
Privacy and cookie notice
Last updated: 26 October 2026
1. Who manages your data
The controller is Carami S.r.l., Via di Bellosguardo 2/R, 50124 Florence (FI), Italy, VAT no. 06684020487. For privacy information and requests: info@carami.it; certified email (PEC): carami@pec.it.
2. Data, sources and purposes
We receive information you provide through purchases, subscriptions, contacts and support requests: your name, contact details, addresses, account information, orders, returns, messages and preferences. Site services may also process IP addresses, device and browser information, online identifiers, pages and interactions. Payment providers process the information needed for your selected payment method.
- Purchases, delivery, returns and support: performance of a contract or steps you request before entering a contract, GDPR Article 6(1)(b). Information necessary for a service must be provided for us to perform it.
- Accounting and obligations to public authorities: compliance with legal obligations, Article 6(1)(c).
- Security, fraud prevention and protection of rights: legitimate interests in protecting the store and handling disputes, Article 6(1)(f), subject to individuals’ rights.
- Newsletters: consent, Article 6(1)(a). We use Mailchimp and Shopify’s email service. Subscription is optional; you may withdraw using the link in messages or by contacting us. Unsubscribing does not prevent necessary order or support messages.
- Optional analytics and personalised advertising: consent for non-essential tracking, according to your choices in the preferences centre. Advertising integrations may group visits, interests and conversions to measure campaigns and create audiences; this is not a condition of purchase.
- Privacy requests: compliance with GDPR obligations and documentation of the response, Article 6(1)(c); protection of rights where necessary, Article 6(1)(f).
3. Records and recipients
The store uses Shopify for its platform, accounts, orders and related services. Newsletters use Shopify and Mailchimp. We also keep contacts in spreadsheets on Google Drive, with access restricted to the authorised people managing them. An address appearing in an order or a record does not amount to consent to newsletters.
To the extent relevant to the service, data may be processed by authorised people, platform and storage providers, payment providers selected at checkout, carriers and shipping services, email providers, accounting and technical advisers, and authorities where required by law.
Store integrations include Google Analytics, Ads, YouTube and Tag Manager, Meta/Facebook and Instagram, Pinterest, Microsoft Clarity, Trustpilot, Globo/PreOrder and Webgains. Their functions concern analytics and measurement, advertising, reviews, pre-orders or affiliation, depending on the active service and applicable choices. Microsoft Clarity analyses interactions with pages; loading it directly from the theme requires Analytics permission. The Tag Manager container loaded directly from the theme requires Analytics and Marketing.
Shopify Network Intelligence is enabled: Shopify may use data about interactions with the store together with data from other Shopify services to improve products, personalisation and advertising, under its Consumer Privacy Policy. For processing independently managed by Shopify, options are also available through the Shopify privacy portal. Providers’ roles depend on their activities: they may act on the controller’s behalf or for their own purposes described in their policies.
4. Retention
Retention criteria depend on the purpose: operational data is needed to perform and complete orders, returns and support; accounting and tax documents follow applicable mandatory retention periods; information relevant to disputes is retained to handle and protect the rights involved. Account and contact data is assessed in relation to the ongoing relationship and the need for the service. Withdrawing or unsubscribing from newsletters stops promotional sends; information strictly necessary to respect that choice, document consent or meet other obligations may remain. Security data is assessed in relation to preventing or handling incidents and disputes. Evidence of privacy requests is limited to what is necessary to handle them and demonstrate the response. These criteria also apply to working records: storage in a spreadsheet does not justify further use.
Cookies and identifiers follow the lifetime of the individual tool and service settings; provider details appear in the next section. Contact the controller for information about retention of your data.
5. Cookies, pixels and choices
We use cookies and similar technologies for store functions, analytics and marketing. Necessary tools enable, for example, security, the cart, checkout and saving privacy choices. Optional categories are Analytics, Marketing and non-essential Preferences.
You can accept, reject or select categories and change your choice at any time using “Cookie preferences” in the footer. Rejecting optional categories does not prevent purchases. We save your choice through Shopify’s Customer Privacy API. Refusal or withdrawal concerns future processing; existing cookies can be managed separately in your browser.
Provider information about cookies, purposes and declared lifetimes: Shopify, Google, Microsoft Clarity, Mailchimp, Meta, Pinterest and Trustpilot. For Google Analytics, Ads and Customer Match, choices concerning analytics, advertising data and personalisation are distinct. Loading a technical component alone does not describe which data it collects.
6. Processing outside the EEA
International providers may process data outside the European Economic Area. Shopify describes applicable mechanisms in its Data Processing Addendum; Mailchimp in its Data Processing Addendum; Google in its data transfer information. Provider documentation describes, depending on the service and destination, adequacy decisions and/or contractual safeguards, including standard contractual clauses. Contact the controller for information about processing of your data and relevant safeguards. The store’s stated EU data hosting location does not mean that all providers process data exclusively in the EEA.
7. Rights and requests
Where provided by the GDPR, you may request access, rectification, erasure, restriction and portability, and object to processing; you may withdraw consent without affecting the lawfulness of earlier processing. Write to info@carami.it or carami@pec.it. Where necessary, we will request only proportionate information to verify identity. The ordinary response period is one month; any justified extension is communicated within the statutory time limits.
An erasure request is assessed across relevant records, including Shopify, Mailchimp and spreadsheets. Unsubscribing from newsletters differs from erasure of all data; some data may need to be retained for legal obligations or protection of rights. You may complain to the Italian data protection authority, Garante per la protezione dei dati personali, or contact the competent supervisory authority and courts.
8. Updates and other privacy choices
This page may be updated following changes to services or legislation. For users with additional rights to opt out of sharing or targeted advertising, the store’s privacy tools and the controller’s contact details are also available.