​​Vanna Camp GmbH
Prantach 25
39015 St. Leonhard in Passeier/S. Leonardo i.Passiria
Südtirol Italien / Alto Adige (BZ) Italia

Florian Haller – E-Mail: florian.haller@vanna.camp 

MWSt.-Nr.  03299430219
Zertifizierte PEC-Adresse: vannacamp@pecimprese.it

​PRIVACY POLICY
Cubivan Pre-Order – Reservation and Deposit Payment

Vanna Camp GmbH · Last updated: 27 August 2026

1. Controller for Data Processing
The controller responsible for the processing of your personal data within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and the Codice in materia di protezione dei dati personali (Legislative Decree No. 196/2003, as amended, “Codice Privacy”) is: Vanna Camp GmbH
Prantach 25, 39015 St. Leonhard in Passeier (BZ), Italy
VAT No.: IT03299430219
PEC: vannacamp@pecimprese.it
represented by its managing director Florian Haller Hereinafter “we”, “us” or the “Provider”. 

2. Contact for Data Protection Enquiries
For questions regarding the processing of your personal data and to exercise your rights under Clause 3, you can reach us at florian.haller@vanna.camp. A data protection officer within the meaning of Article 37 GDPR has not been appointed, as the statutory requirements for doing so are not met. 

3. Your Rights as a Data Subject
Under the GDPR and the Codice Privacy, you have the following rights: 
•     Access to the personal data we process concerning you (Article 15 GDPR) 
•     Rectification of inaccurate data (Article 16 GDPR) 
•     Erasure of your data (Article 17 GDPR), unless statutory retention obligations preclude this 
•     Restriction of processing (Article 18 GDPR) 
•     Data portability (Article 20 GDPR) 
•     Objection to processing based on Article 6(1)(f) GDPR (Article 21 GDPR) 
•     Lodging a complaint with a data protection supervisory authority (see Clause 13) To exercise these rights, an informal notice to the contact address given in Clause 2 is sufficient. We will process your request within the statutory deadlines (as a rule, one month, Article 12(3) GDPR). 

4. Data Processing When Visiting Our Website
When you access our website, our hosting provider automatically collects technical data transmitted by your browser (server log files): IP address, date and time of access, page accessed, referrer URL, browser type and version, and operating system. This data is used for the technical provision of the website and for system security (Article 6(1)(f) GDPR, legitimate interest in stable and secure operation). [Please insert the name and registered office of the hosting provider actually used, as well as the retention period of the log files; a data processing agreement pursuant to Article 28 GDPR may need to be concluded with the provider.]

5. Cookies
Our website uses only technically necessary cookies required for the operation of the website and the reservation process (Article 6(1)(f) GDPR); no consent is required for these. 

6. Data Processing in Connection with the Cubivan Reservation and Deposit Payment
If you make a reservation for the Cubivan Pre-Order via our website and pay the deposit under the Reservation Agreement, we process the following personal data: •     Name, address and email address (provided by you in the reservation form) •     Automatically assigned reservation number •     Time and content of your consent to the Reservation Agreement, the General Terms and Conditions (GTC), and the Participation Terms, including the separate confirmation of the clauses set out in § 19 of the Reservation Agreement (see Clause 8) •     IP address and timestamp of the respective consent steps, for evidentiary purposes •     Amount and time of the deposit paid We process this data in order to conclude and perform the Reservation Agreement with you (Article 6(1)(b) GDPR), to comply with our statutory obligations to demonstrate effective consent to the aforementioned clauses (Article 6(1)(c) GDPR in conjunction with Article 1341 of the Codice Civile), and to fulfil commercial and tax-law retention obligations (Article 6(1)(c) GDPR). The following table summarises the principal purposes of processing: 
Purpose of Processing Legal Basis (GDPR) Retention Period
Conclusion and performance of the Reservation Agreement (incl. deposit payment) Article 6(1)(b) Duration of the contractual relationship plus statutory periods (Clause 11) Evidence of consent to the Reservation Agreement, GTC and Participation Terms (incl. § 19 clauses) Article 6(1)(c) in conjunction with Article 1341 of the Codice Civile Until expiry of the statutory limitation periods Processing of the deposit payment via Stripe Article 6(1)(b) Duration of payment processing plus tax-law periods Sending confirmation and transaction emails Article 6(1)(b) Until purpose is fulfilled, then deleted Fraud and abuse prevention Article 6(1)(f) Max. 12 months after the transaction* Compliance with commercial- and tax-law retention obligations Article 6(1)(c) 10 years (Article 2220 of the Codice Civile) * Indicative figure – please adapt to your actual fraud-prevention practice.

7. Payment Processing via Stripe
We process payment of the deposit through the payment service provider Stripe. Depending on the arrangement, the contracting party is Stripe Payments Europe, Limited and/or Stripe Technology Europe, Limited, both based in Ireland (please refer to your Stripe agreement or Stripe's current privacy policy for the exact contractual allocation). In connection with payment processing, we transmit to Stripe: name, email address, reservation number, and the deposit amount due. You enter your payment data (e.g., credit card number) directly on the payment page hosted by Stripe; this data is never stored or viewed by us at any time. Stripe processes the data in part as our processor (Article 28 GDPR, on the basis of the Data Processing Agreement provided by Stripe) and in part as an independent controller in its own right, for example for fraud prevention and to fulfil its own statutory obligations (including anti-money-laundering requirements). Further information on data processing by Stripe can be found in Stripe's privacy policy at stripe.com/privacy. 

8. Confirmation Email and Second Consent
After completing the first consent step on our website, we automatically send an email to the address you provided containing a personalised confirmation link. Via this link, you confirm the Reservation Agreement, the GTC, the Participation Terms, and the clauses requiring separate approval under § 19 of the Reservation Agreement a second time before being redirected to the payment page. For this purpose, we process your email address, the unique, time-limited confirmation link, and the time and IP address of your confirmation. This processing serves to demonstrate effective, separate consent within the meaning of Article 1341(2) of the Codice Civile (Article 6(1)(c) GDPR) and to perform the Reservation Agreement (Article 6(1)(b) GDPR). [insert name of email delivery service] sends the confirmation email on our behalf, acting as our processor. 

9. Disclosure to Other Processors and Service Providers
In addition to Stripe (Clause 7) and the email delivery service (Clause 8), we may engage further service providers, in particular for website hosting (Clause 4) [and, where applicable, accounting software/CRM – please complete]. We have concluded data processing agreements pursuant to Article 28 GDPR with all service providers who process personal data on our behalf. 

10. Transfer to Third Countries
To the extent that service providers – in particular Stripe – process data outside the European Union or the European Economic Area, for example in the United States, we ensure that an adequate level of data protection is guaranteed, in particular through the conclusion of EU Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR together with supplementary technical and organisational measures. A copy of the relevant safeguards may be requested via the contact address given in Clause 2. 

11. Retention Period
We store your personal data only for as long as is necessary for the respective processing purposes or as required by statutory retention obligations: •     Contractual and accounting records (including the Reservation Agreement and payment receipts): 10 years pursuant to Article 2220 of the Codice Civile •     Evidence of consent (consent log under Clauses 6 and 8): until expiry of the statutory limitation periods for claims arising from the Reservation Agreement •     Server log files under Clause 4: in accordance with the period specified there, unless security-related reasons require longer retention Upon expiry of the respective periods, the data will be deleted or anonymised, unless further statutory retention obligations preclude this. 

12. Data Security
We take appropriate technical and organisational measures to protect your personal data against accidental or intentional manipulation, loss, destruction, or access by unauthorised persons, in particular through encryption of data transmission (TLS/SSL) and access restrictions. Payment data is processed exclusively by Stripe in accordance with the PCI-DSS standard. 

13. Right to Lodge a Complaint with the Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent authority is, in particular: Garante per la protezione dei dati personali
Piazza Venezia, 11 – 00187 Rome, Italy
Email: garante@gpdp.it
PEC: protocollo@pec.gpdp.it
Web: www.garanteprivacy.it Alternatively, you may contact the supervisory authority of your habitual residence (Article 77 GDPR). 

14. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy in order to adapt it to changes in the legal situation or to changes in our services and data processing. The version published on our website at the time of your visit or your reservation shall apply.