Privacy & cookie policy

Last updated: 20 October 2026

This notice explains how we process your personal data when you visit www.staging.sgswork.it (the “Site”) and buy our products, under Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003.

Data controller
What data we process
Purposes, legal bases and retention
Providing your data
Who we share data with
Transfers outside the European Union
Your rights
Cookies and similar technologies
Changes

1. Data controller

The data controller is B-Lab di Pietro Bulgarelli, registered office Via Davide Franceschetti 21, 35043 Monselice (PD), VAT number 05803210284. For any privacy request write to kavaia.2026@gmail.com or to our certified email (PEC) b_lab@pec.it.

2. What data we process

Purchase data: first and last name, shipping and billing addresses, email, phone, products bought, amounts, any tax details needed for the invoice.
Account data, if you choose to create one: email, password (stored encrypted), order history.
Payment data: handled directly by payment service providers. We only receive the outcome of the transaction and partial information (such as the card network), never your full card number.
Contact requests: the data you enter in the form for gyms and professionals or send us by email (name, company, email, phone, message).
Browsing data: technical data logged by the server (IP address, browser type, requested pages, date and time) and aggregate statistics on how the Site is used.

We do not process health data: we don’t ask about your health and kindly ask you not to include it in your messages.

3. Purposes, legal bases and retention

Purpose	Legal basis	Retention
Handling orders, payments, shipping, returns, guarantee and support	Performance of the contract (Art. 6(1)(b) GDPR)	For the duration of the relationship; then 10 years for legal obligations
Tax and accounting obligations	Legal obligation (Art. 6(1)(c))	10 years (Art. 2220 Italian Civil Code)
Managing your customer account	Performance of the contract (Art. 6(1)(b))	Until the account is deleted
Replying to requests sent through forms or email	Pre-contractual steps or legitimate interest in replying (Art. 6(1)(b) and (f))	24 months from the last contact
Site security and fraud prevention	Legitimate interest (Art. 6(1)(f))	Technical logs up to 12 months, unless needed for investigations
Aggregate statistics on Site usage and order sources	Consent, given through the cookie banner (Art. 6(1)(a))	Aggregate data, up to 26 months
Defending our rights in case of disputes	Legitimate interest (Art. 6(1)(f))	For the duration of any dispute

We currently send no newsletters or promotional messages. If we do in the future, it will only be with your consent, which you can withdraw at any time.

4. Providing your data

The data requested at checkout is needed to conclude and perform the contract: without it we cannot process your order. Other data is optional.

5. Who we share data with

We only share data with parties needed to provide our service, appointed as data processors where required (Art. 28 GDPR):

the Site’s hosting provider ([fornitore hosting]);
couriers and carriers, for deliveries and returns;
payment service providers;
tax and accounting advisers;
IT and email service providers;
public authorities, where required by law.

Your data is never sold or published. The up-to-date list of processors is available on request.

6. Transfers outside the European Union

If you order delivery to a non-EU country, the delivery data is shared with the courier and the customs authorities of the destination country: this transfer is necessary to perform the contract (Art. 49(1)(b) GDPR). Where we use providers based outside the EU, transfers rely on a European Commission adequacy decision (for example the EU-U.S. Data Privacy Framework) or standard contractual clauses.

7. Your rights

At any time you can request access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest (Articles 15–22 GDPR). Where processing is based on consent, you can withdraw it at any time. Write to kavaia.2026@gmail.com: we reply within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the supervisory authority of your country.

The Site only uses first-party cookies and tools. Technical cookies are always on because the shop needs them. Statistics cookies are only activated if you accept them in the banner shown on your first visit. We do not use profiling cookies or third-party advertising cookies.

You can change your mind at any time from the Cookie preferences link, also found at the bottom of every page. Your choice is remembered for 6 months.

Name	Type	Purpose	Duration
wp_woocommerce_session_*	Technical	Keeps your cart and shopping session	Up to 2 days
woocommerce_cart_hash, woocommerce_items_in_cart	Technical	Keep the cart status up to date	Session
kv_lang	Technical	Remembers your language (Italian or English) for cart and checkout	12 months
wordpress_logged_in_, wordpress_sec_	Technical	Keep you signed in to your customer account	Session, or 14 days with “Remember me”
kv_consent	Technical	Remembers your cookie choices	6 months
sbjs_* (sourcebuster)	First-party statistics, consent only	Record where a visit came from (e.g. a search engine) to link it to the order; the data stays on our Site	Session (30 minutes)
unique_session_id (cookie and localStorage)	First-party statistics, consent only	Random identifier for aggregate visit statistics, processed on our server	12 months
kv_intro (sessionStorage)	Technical	Avoids replaying the intro animation	Session

You can block or delete cookies in your browser settings; if you block technical cookies, the cart and checkout may not work.

9. Changes

We may update this notice; the current version is always published on this page with the date of the last update.