Privacy Policy

UP STREAM ITALIANA s.r.l., Via Giuseppe di Vittorio 39, 43044 Lemignano di Collecchio (PR), Italy — VAT no. 02696110341.

For any privacy request: privacy@upstreamsalmons.com.

• Browsing: IP address, date and time, requested pages and technical browser data, recorded in server logs for the security and operation of the site. Legal basis: the controller's legitimate interest.
• Account and reserved area: first and last name, e-mail, password (stored only as a secure hash, never in readable form), addresses and phone number, to manage sign-in, orders and saved details. For business accounts also the company name, VAT number, SDI code and, if you provide it, PEC. Legal basis: performance of the contract.
• Orders, payments and shipping: e-mail, delivery and billing details, phone number if provided, any notes and gift message; for private customers the tax code, required for every order; for companies and professionals the company name, VAT number and SDI recipient code. If the order goes to someone else, we also process the recipient's name and address. This data is sent to the controller's management system to fulfil the order and issue tax documents. Legal basis: performance of the contract and legal obligations.
• Loyalty programme, vouchers and gift cards: points balance and voucher use linked to your account. Legal basis: performance of the contract.
• Assistant and recipe configurator: the questions you write, the answers, and the generated recipes and images are processed by an artificial intelligence provider and stored in the backend, where administrators can review them to check the quality of the service. Generated images are stored at an unlisted web address, accessible to anyone who has it. Please do not include personal data in your requests. Legal basis: providing the service you ask for.
• Communications: the messages you send us by e-mail or phone, to reply to you. Legal basis: pre-contractual measures or legitimate interest.
• Newsletter: first and last name, city and e-mail, only if you subscribe through the external YesNology form, to send you updates on our initiatives. Details are in the Newsletter Notice. Legal basis: consent, which you can withdraw at any time.
• Optional commercial communications: if you give them in the external YesNology form, two separate consents to receive communications about Upstream products and events and about products and events of Upstream partners. They are not needed to buy. Details are in the Customer Notice. Legal basis: consent, which you can withdraw at any time.
• Analytics and marketing: when you enable the relevant categories in the banner, the Google and Meta tools configured for the site may measure visits, purchases and advertising campaigns. Legal basis: consent, which you can withdraw in cookie preferences.

Data marked as required in the registration and purchase forms is needed to complete the order: without it we cannot proceed. Subscribing to the newsletter and the commercial consents are optional. Purchases are reserved for adults.

Data is processed by the controller's authorised staff and, only for the purposes above, by providers acting, depending on the service and the related contracts, as data processors or independent controllers:

• the hosting and technical management provider, with servers in the European Union;
• the card payment provider shown at checkout: card details never pass through the controller;
• the courier DHL, for delivery;
• the provider that sends transactional e-mails (order confirmations, password recovery);
• the provider of the company management system, to fulfil orders and issue tax documents;
• BBUp S.r.l. (YesNology platform), to collect and keep subscriptions and commercial consents;
• Tuelia, to record and manage cookie consent preferences;
• OpenRouter, Inc. (United States), which forwards assistant requests to the artificial intelligence models in use;
• accounting and tax advisers;
• public authorities, where required by law: they receive data as independent controllers, not as providers.

Some providers are based in the United States: OpenRouter for the AI assistant and, if you enable Analytics or Marketing, Google and Meta. The transfer relies on the safeguard of Articles 45 and 46 GDPR that applies to each provider: the adequacy decision (EU-US Data Privacy Framework) for those that participate in it, otherwise the standard contractual clauses approved by the European Commission.

If you request delivery outside the European Economic Area, the delivery details reach the courier in that country too, because they are needed to perform the contract (Article 49(1)(b) GDPR).

• Browsing logs: only as long as needed for the security of the site, unless needed to investigate unlawful activity.
• Account: while it remains active; you can ask for its deletion at any time.
• Points balance and vouchers: while the account remains active; movements linked to an order follow the retention of that order.
• Incomplete carts, with the delivery and tax details entered: as long as needed to resume the purchase.
• Orders and tax documents: 10 years, as required by Italian civil and tax law.
• Assistant conversations: as long as needed to check the quality of the service. They are not linked to your account: to ask for earlier deletion, write to privacy@upstreamsalmons.com giving the text of the request and its approximate date.
• Newsletter: until you withdraw consent.
• Commercial consents: 10 years from collection, unless withdrawn.

Technical cookies, optional categories and preferences are described in the Cookie Policy.

You can ask at any time to access, rectify or erase your data, restrict processing and receive your data in a portable format, and object to processing based on legitimate interest. Where you gave consent, you can withdraw it without affecting processing already carried out. Write to privacy@upstreamsalmons.com: we reply within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

We may update this notice: the version in force is always published on this page, with the date of the last update.