Client care

PRIVACY.

Last updated: 17 August 2026. This Privacy Policy explains how Gruppo Rocket, owner of the Sofia Whitmore project, collects, uses, stores and protects personal data when you visit www.sofiawhitmore.com or otherwise interact with us.

1. Data controller

For the purposes of applicable data protection law, including the General Data Protection Regulation (GDPR), the data controller is Gruppo Rocket, owner of the Sofia Whitmore project.

If you have questions about this Privacy Policy or want to exercise your rights, you can contact us at info@grupporocket.com.

2. Your rights

Subject to applicable law, you may have the right to:

obtain confirmation as to whether we process your personal data and access that data together with supplementary information;
receive a copy of personal data you provided to us in a structured, commonly used and machine-readable format;
request correction of inaccurate or incomplete personal data under our control;
request deletion of your personal data;
object to certain processing activities;
request restriction of processing in certain circumstances;
withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal; and
lodge a complaint with the competent supervisory authority.

Please note that these rights are not absolute and may be limited where we have overriding legitimate grounds or legal obligations requiring continued processing.

3. Retention

We retain personal data for as long as reasonably necessary to provide our services, operate the website, complete transactions, maintain business records, comply with legal and tax obligations, resolve disputes and enforce our policies. Retention periods depend on the type of data collected and the purpose of processing. Where possible, we will rectify, supplement, anonymise or delete incomplete, inaccurate or no longer necessary information.

4. Legal bases for processing

We process personal data where necessary for the performance of a contract with you, to comply with legal obligations, to pursue our legitimate interests (such as securing and improving the website, preventing fraud, administering our business and communicating with users) and, where required, on the basis of your consent.

When you use the website, submit information through forms or place an order, you acknowledge the collection and use of personal data as described in this Privacy Policy.

5. What information we collect

We collect two general categories of information:

Non-personal information includes aggregated usage information and technical information transmitted by your device, such as browser type, operating system, language preference, referral source, access times, pages viewed, click behaviour and approximate technical diagnostics used to improve site functionality and performance.

Personal information means information that identifies you or could reasonably identify you, including:

Contact and registration data: name, surname, email address, postal address, phone number and similar information you provide when registering, subscribing, contacting us or creating an account.
Device and online identifiers: IP address, cookie identifiers, device identifiers and data relating to your interaction with the website.
Communications: information you include in messages sent through contact forms, customer support requests or email correspondence.
Marketing preferences: consent records, opt-in and opt-out status, and your engagement with newsletters or promotional messages.

6. E-commerce and order-related data

If you make a purchase, begin checkout or use account features connected to the store, we may process additional information necessary to manage the transaction, including:

billing and shipping address details;
order history, items purchased, order value and transaction status;
customer service records relating to orders, returns, exchanges, cancellations or complaints;
delivery and fulfilment information, including courier tracking details; and
limited payment-related information supplied by payment service providers, such as payment status, transaction identifiers or partial payment metadata.

Payments may be processed through third-party payment providers. Unless expressly stated otherwise, we do not store complete payment card details on our own systems. Payment providers process payment data under their own privacy notices and legal obligations.

We may also use order and account information to provide customer support, detect fraud, verify transactions, comply with accounting and tax obligations, process returns and send essential service communications relating to your purchase.

7. How we receive information

We receive personal data from several sources, including:

when you voluntarily provide information to register, subscribe, contact us, create an account or place an order;
when you use the website in connection with our services;
from service providers and partners such as analytics, hosting, email delivery, payment, fraud prevention or shipping providers; and
where relevant, from public sources or social platforms, subject to applicable law.

8. How we use personal data

We may use personal data for the following purposes:

to provide, operate and maintain the website and our services;
to process and fulfil orders, payments, shipping, returns and refunds;
to communicate with you about your account, purchases, customer support requests, technical notices and service updates;
to send newsletters, promotional materials and marketing communications, where permitted by law or based on your consent;
to personalise your experience and show relevant content or offers;
to analyse website traffic, customer behaviour and performance metrics;
to detect, prevent and investigate fraud, abuse, security incidents or unlawful activity; and
to comply with legal, accounting, tax and regulatory obligations.

9. Sharing information with third parties

We do not sell your personal data. We may share personal data with trusted third-party service providers and collaborators where reasonably necessary for the purposes described in this policy, including for:

website hosting and technical infrastructure;
analytics, diagnostics and website performance monitoring;
email delivery, marketing and customer relationship management;
payment processing and fraud prevention;
order fulfilment, warehousing, shipping and delivery services; and
professional advisers, auditors or authorities where disclosure is required or permitted by law.

We may also disclose information in good faith where we believe this is necessary to comply with legal obligations, enforce our policies, investigate suspected fraud or illegal activity, protect our rights, property or safety, or cooperate with law enforcement or regulators.

10. Cookies and similar technologies

We and our trusted partners may use cookies and similar technologies when you visit the website. A cookie is a small text file stored on your device that helps websites function, remember preferences, improve navigation, understand user behaviour and support analytics or marketing activities.

The website may use:

session cookies, which are temporary and are removed when you close your browser;
persistent cookies, which remain on your device for a defined period to remember preferences or recognise returning visits; and
third-party cookies, which may be set by analytics, advertising or embedded service providers.

You can manage or delete cookies through your browser settings. Disabling cookies may affect the functionality of certain areas of the website.

11. Third-party sites and services

This Privacy Policy applies only to our own practices. If you disclose information to third parties, including websites, social platforms, payment providers or other services linked from our website, different rules may apply. We encourage you to read the terms and privacy policies of each third party you use.

12. Security

We implement and maintain industry-standard technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. However, no system can be guaranteed to be completely secure, and we cannot warrant that unauthorised access or misuse will never occur.

13. International transfers

Some recipients of personal data may be located outside the European Economic Area or the United Kingdom. Where that is the case, we will transfer data only where an adequate level of protection is ensured under applicable law, including through adequacy decisions or appropriate contractual safeguards.

14. Advertising and marketing

We may use personal data, such as your name, email address or engagement data, to send marketing communications about our products, projects and services, directly or through trusted service providers, where permitted by law. Every marketing email should include a way to unsubscribe or update your preferences. Even if you opt out of marketing, we may still send essential transactional or administrative messages relating to your orders, account or our services.

15. Corporate transactions

If we are involved in a merger, acquisition, business reorganisation, financing due diligence or sale of assets, personal data may be disclosed or transferred as part of that transaction, subject to appropriate confidentiality and legal protections.

16. Children

We do not knowingly collect personal data from children without appropriate consent from a parent or legal guardian where such consent is required. If you believe that a child has provided us with personal data without appropriate authorisation, please contact us at info@grupporocket.com.

17. Changes to this policy

We may revise this Privacy Policy from time to time. Material changes become effective when the updated version is published on the website. The “Last updated” date at the top of this page indicates the most recent revision.

18. Contact

For general questions about this website, this Privacy Policy or the way we collect and use information, please contact info@grupporocket.com.