• Collection of Personal Data: We collect personal data necessary for processing orders, managing user accounts, sending marketing communications (only with the user's explicit consent), and fulfilling legal obligations. Data processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).

​

• Use of Personal Data: * Personal data is used for the purposes indicated above and will not be disclosed to third parties without the user's explicit consent, except as required by law. * In particular, data may be disclosed to Printful for the management of order production and shipping. Printful acts as data processor on behalf of TOSHI LUKE and guarantees compliance with privacy regulations. * Data collected through the Wix site is also subject to Wix's Privacy Policy. Users are invited to consult Wix's Privacy Policy for further information on data processing by Wix.

​

• User Rights: The user has the right to: * Access their personal data and obtain information about its processing. * Request its rectification or integration. * Request its deletion ("right to be forgotten"). * Request the limitation of processing. * Object to its use for marketing purposes or other legitimate reasons. * Receive their data in a structured, commonly used, and machine-readable format ("right to data portability"). * Lodge a complaint with the Data Protection Authority.

​

• Cookies: The website uses cookies to improve the user experience. The user can manage their cookie preferences through their browser settings and through the appropriate banner on the site. Cookie management is carried out in accordance with Directive 2002/58/EC (ePrivacy Directive) and the provision of the Italian Data Protection Authority of May 8, 2014.

​

• Data Controller: The data controller is TOSHI LUKE, with registered office in 61010 - Tavullia (PU), Italy.

​

• Data Protection Officer (DPO): The Controller has not appointed a Data Protection Officer (DPO) as the characteristics of the processing do not fall within the cases that make such designation mandatory pursuant to Article 37 of Regulation (EU) 2016/679. Specifically, the processing is not carried out by a public authority or public body; the Controller's core activities do not consist of processing operations which, by their nature, scope and/or purposes, require regular and systematic monitoring of data subjects on a large scale; nor do they consist of the large-scale processing of special categories of data pursuant to Article 9 of the GDPR or data relating to criminal convictions and offences pursuant to Article 10 of the GDPR.