Privacy policy

Privacy Policy

Last Updated: November 6, 2025

1. Introduction and Identity of the Data Controller

We consider the protection of personal data and the privacy of our Clients and Users to be a fundamental commitment. This Privacy Policy details how Global Distribution S.A.S. di Fabio Niccolai & C. collects, utilizes, discloses, and processes the personal data that we acquire through the operation of our e-commerce Website, www.fightclubstore.com. We saw that transparent data practices build necessary trust.

The entity responsible for the processing of your personal data (the Data Controller) is:

• Global Distribution S.A.S. di Fabio Niccolai & C.: Located at Via Lorenzo il Magnifico 10, 50129, Firenze (FI), Italy. Our Tax Code and VAT number are 02342200488.

• Contact Email: The primary contact point for data protection matters is fightclub@fightclubstore.com.

The legal framework governing our data processing operations is primarily the General Data Protection Regulation (GDPR), which is supplemented by the relevant national legislation, specifically the Italian Personal Data Protection Code. We acknowledge the importance of rigorous adherence to these regulations across all our B2C and B2B activities.

2. Categories of Personal Data We Collect

We collect various categories of personal data, depending on your interaction with our Website. We will not collect any data that is not strictly necessary for the purposes outlined in this Policy.

2.1. Data Provided Directly by the User

This data is provided by you when creating an account, placing an order, filling out forms (like the return form), or subscribing to the loyalty program.

• Identification Data: Name, Surname, email address, physical shipping and billing addresses, and telephone number. This data is essential for contract execution and communication.

• Account Data: Login credentials, unique client ID, and preferences established within the account. Clients can register using a standard email or an existing shop account.

• Transaction Data: Details concerning the products purchased, payment amounts, order history, and payment method used (e.g., American Express, PayPal, Visa). We do not store full payment card details; these are handled exclusively by certified third-party payment processors.

• Return/Request Data: Information submitted via the return form on https://www.fightclubstore.com/pages/resi, including the Order Number and details of products to be returned.

• Marketing Preferences: Opt-in/opt-out status for marketing communications.

2.2. Data Collected Automatically (Technical and Usage Data)

When you access and use the Website, certain technical data is collected automatically through server logs, cookies, and other tracking technologies.

• Browsing and Usage Data: Information concerning how you interact with the Website, including the pages viewed, time spent on the Website, product interest, internal search queries, and referring website addresses.

• Device Information: IP address, browser type and version, time zone setting, operating system, and platform. This helps us ensure the Website functions correctly across different environments.

• Location Data: General location derived from your IP address.

2.3. Data from Third-Party Sources

We integrate services from third parties, which may involve data sharing.

• Analytics Providers (e.g., Google Analytics): Information regarding your browsing patterns and activity on the Website.

• Advertising Platforms (e.g., Meta, Google Ads): Data related to the effectiveness of advertising campaigns and your interaction with those ads.

• Payment Processors (e.g., PayPal, Shopify Payments): Confirmation of payment success and certain masked payment identifiers.

• Loyalty Program Providers (e.g., Smile): Data related to your participation in the 'Fight Club' program, including accrued Fighter Credits and coupon redemption history.

3. Purposes and Legal Basis for Processing

We process personal data only when we have a valid legal basis to do so, as defined by Article 6 of the GDPR. We noticed that clear articulation of the legal basis is crucial for compliance.

Purpose of Processing	Categories of Data Used	Legal Basis (GDPR Art. 6)	Retention Period
A. Execution of the Contract and Pre-Contractual Measures	Identification Data, Account Data, Transaction Data, Return/Request Data	Contractual Necessity (Art. 6(1)(b)): Necessary to fulfill the sales contract (placing orders, processing payments, shipping goods, managing B2B and B2C returns, and handling the Legal Guarantee of Conformity).	Ten years from the termination of the contract or last order, for civil law obligations (Italian Civil Code Art. 2946).
B. Compliance with Legal Obligations	Identification Data, Transaction Data	Legal Obligation (Art. 6(1)(c)): Necessary to comply with tax, accounting, and anti-money laundering laws specific to Italian jurisdiction (e.g., VAT and fiscal records).	Ten years as required by Italian fiscal legislation (DPR 600/1973).
C. Operation of the Loyalty Program	Account Data, Identification Data, Program Activity Data (Fighter Credits, Referrals)	Contractual Necessity (Art. 6(1)(b)): Necessary to manage and administer the 'Fight Club' membership and benefits.	While the Client remains a member of the program; up to 10 years after membership cessation for legal record keeping.
D. Direct Marketing Communications	Identification Data, Marketing Preferences	Consent (Art. 6(1)(a)): When you have freely and explicitly consented to receive promotional and commercial communications (e.g., newsletter subscriptions).	Until withdrawal of consent (opt-out), or as required by specific marketing regulations.
E. Website Analytics and Optimization	Browsing/Usage Data, Device Information, Data from Third-Party Sources (Google Analytics)	Legitimate Interest (Art. 6(1)(f)): To monitor and analyze Website usage, identify technical errors, improve performance, and optimize the user experience.	As per specific Cookie Policy (typically 13-26 months for analytics data).
F. Behavioral Advertising and Retargeting	Browsing/Usage Data, Data from Third-Party Sources (Meta, Google Ads)	Consent (Art. 6(1)(a)) or Legitimate Interest (Art. 6(1)(f)) (where permitted by law and minimized through pseudonymization). Used to present relevant advertisements based on your interests.	As per specific Cookie Policy (up to 12 months, subject to specific platform settings).
G. Prevention of Fraud and Security	Identification Data, Device Information	Legitimate Interest (Art. 6(1)(f)): To protect the rights and assets of Global Distribution S.A.S. and to ensure the security of transactions and the Website infrastructure.	Up to 12 months after the incident is resolved.

4. Methods of Processing and Data Security

We execute data processing using both manual (paper) and automated (electronic) tools, adhering strictly to the security measures required by the GDPR.

• Security Measures: We implement physical, technical, and administrative security measures to protect data from unauthorized access, disclosure, alteration, and destruction. These measures include encryption protocols (SSL/TLS) for data transmission, firewalls, and access controls for internal personnel. We noticed that continuous security monitoring is critical.

• Data Minimization: We only process data that is relevant, limited to what is necessary, and accurate. We regularly review our data retention schedules to ensure compliance with minimization principles.

5. Data Disclosure and Recipients

We may need to disclose your personal data to specific categories of recipients, acting either as separate Data Controllers or as Data Processors acting on our behalf. We only share data necessary for the stated purposes.

5.1. Data Processors (Operating on Our Behalf)

These third parties are engaged under formal agreements (Article 28 GDPR) to provide specific services.

• Shipping and Logistics Companies: To deliver the ordered products to your specified address.

• IT Service Providers: For Website hosting, maintenance, development, and data storage (e.g., Shopify platform services).

• Payment Gateways and Banks: To process transactions (e.g., PayPal, Shopify Payments).

• Loyalty Platform: The third-party provider Smile is used to administer the 'Fight Club' program and track Fighter Credits and referral rewards.

• Marketing and Analytics Providers (e.g., Google Analytics, Meta): To analyze Website performance and deliver advertisements.

5.2. Independent Data Controllers

These entities process data for their own purposes.

• Public Authorities and Law Enforcement: When required by law or a legitimate request from a competent authority (e.g., the Italian Revenue Agency).

• Professional Advisors: Such as accountants, auditors, and legal consultants, who require access to data to provide professional services and ensure our legal compliance.

6. Transfers of Personal Data Outside the EU/EEA

Given our reliance on global service providers, particularly for e-commerce hosting (Shopify) and analytics/advertising (Google, Meta), personal data may be transferred outside the European Union (EU) or the European Economic Area (EEA).

• Legal Basis for Transfer: We ensure that all such transfers comply with Chapter V of the GDPR by implementing one of the following safeguards:

  • Adequacy Decision: Transfer to countries recognized by the European Commission as providing an adequate level of protection.

  • Standard Contractual Clauses (SCCs): Implementation of the standard data protection clauses adopted by the European Commission, combined with appropriate supplementary measures where necessary.

  • Binding Corporate Rules (BCRs): If the recipient group has adopted approved BCRs.

We only work with service providers that commit to maintaining GDPR-compliant data protection standards.

7. Your Data Protection Rights (Articles 15-22 GDPR)

As a Data Subject, you are granted several fundamental rights concerning your personal data. We are obligated to facilitate the exercise of these rights.

• Right of Access (Art. 15): You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and specific information regarding the processing.

• Right to Rectification (Art. 16): You have the right to obtain the rectification of inaccurate personal data concerning you and to have incomplete personal data completed.

• Right to Erasure ('Right to be Forgotten') (Art. 17): You have the right to request the deletion of your personal data when, for instance, the data is no longer necessary for the purposes for which it was collected, or if you withdraw your consent and there is no other legal ground for processing.

• Right to Restriction of Processing (Art. 18): You have the right to restrict the processing of your personal data under specific circumstances, for example, if you contest the accuracy of the data.

• Right to Data Portability (Art. 20): You have the right to receive the personal data concerning you, which you provided to us, in a structured, commonly used, and machine-readable format and have the right to transmit that data to another controller without hindrance.

• Right to Object (Art. 21): You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on our legitimate interest (Art. 6(1)(f)). We will cease the processing unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms. This right is absolute regarding processing for direct marketing purposes.

• Right to Withdraw Consent (Art. 7): Where processing is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

• Right to Lodge a Complaint (Art. 77): You have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement. The competent Italian Supervisory Authority is the Garante per la protezione dei dati personali.

8. Exercising Your Rights

You may exercise any of the rights listed in Section 7 by submitting a written request to us at the following addresses:

• Email: fightclub@fightclubstore.com

• Postal Address: Global Distribution S.A.S., Via Lorenzo il Magnifico 10, 50129, Firenze (FI), Italy.

We will respond to your request without undue delay and, in any event, within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of the requests. We will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.

9. Data Processing Specific to Children

Our Website and the products we sell are not intended for children under the age of 16. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have collected personal data from a child under 16 without parental consent, we will take immediate steps to delete that information.

10. Third-Party Links and Services

The Website may contain links to third-party websites, applications, and services, including those integrated for payment processing (e.g., PayPal) or social media connections (Meta).

• External Sites: We are not responsible for the content or privacy practices employed by external websites or services linked from our Website. The data collected by these third parties is subject to their own separate privacy policies. We strongly recommend that you review the privacy policies of any third-party websites you visit.

11. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our data processing practices or legal requirements. We will notify you of any material changes by posting the new Policy on the Website and updating the "Last Updated" date at the beginning of the Policy. Continued use of the Website after the effective date of the revised Policy indicates your understanding of the revised terms.