Privacy Policy

This Privacy Policy explains how Petra Srl (“we”, “us”, “our”), trading as ComfyCat, collects and processes your personal data when you visit comfycat.com, create an account, or place an order. We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and applicable Italian data-protection law.

This document is provided as a draft and should be reviewed by qualified legal counsel before go-live.

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

Petra Srl (trading as ComfyCat)
Registered office: Monte Napoleone 20, Milan (MI), Italy
VAT no.: IT12386900968
Contact: help@comfycat.com

2. What Data We Collect

Depending on how you use our Site, we may collect:

Account data — name, email address and password.
Order & billing data — billing and delivery address, telephone number, order history.
Payment data — payments are processed securely by our payment provider (Stripe). We do not store your full card number; we receive only a token and limited transaction details.
Subscription data — plan, billing frequency and renewal details for litter subscriptions.
Communications — messages you send us (e.g. support requests).
Technical data — IP address, browser and device type, and cookie identifiers (see Section 4).

3. How & Why We Use Your Data (Legal Bases)

To perform our contract with you — process and deliver orders, manage subscriptions, provide customer support (Art. 6(1)(b) GDPR).
To comply with legal obligations — tax, accounting and invoicing requirements (Art. 6(1)(c) GDPR).
For our legitimate interests — fraud prevention, network and site security, and improving our products and service, balanced against your rights (Art. 6(1)(f) GDPR).
With your consent — optional marketing communications and non-essential cookies, which you may withdraw at any time (Art. 6(1)(a) GDPR).

4. Cookies & Tracking

We use strictly necessary cookies to run the shop (cart, checkout and session). These are always active because the Site cannot function without them.

Any non-essential cookies (for analytics or marketing) are loaded only after you give consent through our cookie banner. You can review and change your choices at any time via the cookie settings, and no non-essential tracker is set before you accept.

5. Who We Share Your Data With

We share personal data only with trusted service providers (“processors”) who act on our instructions under a data-processing agreement, including:

Payment processing — Stripe.
Shipping & delivery — our courier and fulfilment partners.
Email delivery — our transactional email/SMTP provider.
Hosting & platform — our website hosting provider and WooCommerce.

We do not sell your personal data. We may disclose data where required by law or to protect our legal rights.

6. International Transfers

Your data is primarily processed within the EU/EEA. Where a provider processes data outside the EU/EEA, we rely on appropriate safeguards such as an EU adequacy decision or the European Commission’s Standard Contractual Clauses.

7. How Long We Keep Your Data

Order and invoice records — retained for the period required by Italian tax and accounting law (generally up to 10 years).
Account data — kept while your account is active; deleted or anonymised on request, subject to legal retention.
Marketing preferences — kept until you withdraw consent.

8. Your Rights

Under the GDPR you have the right to:

access the personal data we hold about you;
request correction of inaccurate data;
request erasure (“right to be forgotten”);
restrict or object to certain processing;
request portability of your data;
withdraw consent at any time (without affecting prior processing).

To exercise any of these rights, email us at help@comfycat.com. You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

9. Data Security

We use technical and organisational measures to protect your data, including encrypted (HTTPS) connections, access controls, and PCI-DSS-compliant payment handling through Stripe. No method of transmission over the internet is 100% secure, but we work to protect your data using industry-standard measures.

10. Children

Our Site and products are intended for adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, please contact us so we can remove it.