1. Data Controller

We explain that “A Cosplay’s Place” is the data controller of the personal data collected through the website www.acosplaysplace.com (hereinafter, the “Site”). Where sellers process personal data (e.g., to ship orders), they act as independent data controllers under the GDPR; the platform may act as a data processor for payment services or for processing carried out on behalf of sellers.

2. Categories of personal data processed

We indicate the categories: identification and contact data (first name, last name, email address, shipping address), account and payment-related data, browsing data (IP address, cookies, logs).

3. Purposes and legal bases for processing

– Management of the user account and registration on the platform; performance of the contract between the user and the platform. (Legal basis: Art. 6(1)(b) GDPR).

– Order management, intermediation between sellers and buyers, payment processing, calculation of our 10% service fee; transfer of data to sellers to enable the conclusion of the sales contract. (Legal basis: performance of the contract).

– Compliance with legal and tax obligations (Legal basis: Art. 6(1)(c) GDPR).

– Statistical analysis and service improvement (legitimate interest – Art. 6(1)(f) GDPR).

– Sending promotional communications only with the data subject’s prior consent (Art. 6(1)(a) GDPR).

4. Data sharing and recipients

Data may be shared with:

– Sellers on the platform, who will process the data as independent data controllers for shipping and order management;

– Technical service providers (hosting, payment management) acting as data processors;

– Competent authorities and entities to whom disclosure is required by law (e.g., the Agenzia delle Entrate (Italy)).

Where necessary, data may be transferred to non-EU countries; in such cases, appropriate safeguards will be adopted, such as EU Standard Contractual Clauses.

5. Data retention

We retain data for as long as necessary to pursue the purposes indicated and to comply with legal obligations (e.g., retention of accounting records). Data used for marketing purposes will be retained until consent is withdrawn.

6. Users’ rights

Data subjects may exercise the rights set out in Articles 15–22 of the GDPR, including the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing on legitimate grounds. To exercise these rights or submit complaints, data subjects may send a request to the email address indicated above or contact the Data Protection Officer (DPO), if appointed. In addition, data subjects may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).