Privacy and cookies

UP STREAM ITALIANA s.r.l., Via Giuseppe di Vittorio 39, 43044 Lemignano di Collecchio (PR), Italy — VAT no. 02696110341.

For any privacy request: privacy@upstreamsalmons.com.

• Browsing: IP address, date and time, requested pages and technical browser data, recorded in server logs for the security and operation of the site. Legal basis: the controller's legitimate interest.
• Account and reserved area: first and last name, e-mail, password (stored only as a secure hash, never in readable form), addresses and phone number, to manage sign-in, orders and saved details. Legal basis: performance of the contract.
• Orders, payments and shipping: delivery and billing details and, if you need an invoice, tax code, VAT number, SDI code or PEC. They are sent to the controller's management system to fulfil the order and issue tax documents. Legal basis: performance of the contract and legal obligations.
• Loyalty programme, vouchers and gift cards: points balance and voucher use linked to your account. Legal basis: performance of the contract.
• Assistant and recipe configurator: the questions you write, the answers, and the generated recipes and images are processed by an artificial intelligence provider and stored in the backend, where administrators can review them to check the quality of the service. Please do not include personal data in your requests. Legal basis: providing the service you ask for.
• Communications: the messages you send us by e-mail or phone, to reply to you. Legal basis: pre-contractual measures or legitimate interest.
• Newsletter: your e-mail address, only if you subscribe and give consent, to send you news and offers. You can unsubscribe at any time. Legal basis: consent.
• Analytics and marketing: when you enable the relevant categories in the banner, the Google and Meta tools configured for the site may measure visits, purchases and advertising campaigns. Legal basis: consent, which you can withdraw in cookie preferences.

Data marked as required in the registration and purchase forms is needed to complete the order: without it we cannot proceed. Subscribing to the newsletter is optional. Purchases are reserved for adults.

Data is processed by the controller's authorised staff and, only for the purposes above, by providers acting as data processors:

• the hosting and technical management provider, with servers in the European Union;
• the card payment provider shown at checkout: card details never pass through the controller;
• the courier DHL, for delivery;
• the provider that sends transactional e-mails (order confirmations, password recovery);
• Tuelia, to record and manage cookie consent preferences;
• OpenRouter, Inc. (United States), which forwards assistant requests to the artificial intelligence models in use;
• accounting and tax advisers and public authorities, where required by law.

Some providers, such as the AI assistant provider, are based in the United States. In these cases the transfer relies on the safeguards of Articles 45 and 46 GDPR: an adequacy decision (EU-US Data Privacy Framework) or the standard contractual clauses approved by the European Commission.

• Browsing logs: only as long as needed for the security of the site, unless needed to investigate unlawful activity.
• Account: while it remains active; you can ask for its deletion at any time.
• Orders and tax documents: 10 years, as required by Italian civil and tax law.
• Assistant conversations: as long as needed to check and improve the service; you can ask for their deletion at any time.
• Newsletter: until you withdraw consent.

Technical cookies are needed for the shop to work and do not require consent. Analytics and Marketing are optional categories and remain disabled until you accept them in the Tuelia banner. You can reject both categories, select them separately, and change or withdraw your choice using the cookie icon or the Cookie preferences button in the footer.

Google and Meta receive data only when the corresponding tools are enabled and you have given the relevant consent. You can consult detected providers and cookie lifetimes in the banner's cookie declaration.

• Language preference (lang): remembers Italian or English, about 1 year.
• Account session (upstream_medusa_session): httpOnly cookie after signing in to the reserved area, about 7 days.
• Cart (upstream_medusa_cart): httpOnly cookie that keeps your cart between visits, about 30 days.
• Order confirmation (upstream_order_success): httpOnly cookie used to show the checkout result, 30 minutes.
• Pending Nexi payment (upstream_nexi_pending): httpOnly cookie used to resume checkout after returning from payment, 60 minutes.
• Local cart (localStorage upstream-cart): used only when the online shop is not active.
• Cookie preferences (TueliaConsent): keeps your choice in the banner for 180 days.
• Purchases already measured (sessionStorage upstream:purchase-transactions): after consent, stores only order IDs to prevent duplicates. It is removed when you close the tab or withdraw consent to both Analytics and Marketing.

You can ask at any time to access, rectify or erase your data, restrict processing and receive your data in a portable format, and object to processing based on legitimate interest. Where you gave consent, you can withdraw it without affecting processing already carried out. Write to privacy@upstreamsalmons.com: we reply within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

We may update this notice: the version in force is always published on this page, with the date of the last update.