Privacy Policy

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA
(pursuant to Art. 13 of EU Regulation 2016/679)

1. Data Controller and Contact

The Data Controller of personal data is Somnia Technologies S.r.l. (hereinafter “Somnia” or the “Controller”), VAT number IT14406600966, with its registered office in Via Vincenzo Foppa 7, 20144 Milan, Italy. The Data Controller is the entity that determines the purposes and means of the processing of personal data.

For any matter concerning the processing of your personal data, including the exercise of your rights, you can contact the Controller at support@qimora.com.

2. Types of Personal Data Processed

Somnia collects and processes the following categories of personal data:

• Data voluntarily provided by the user: Data communicated by the user when placing an order, subscribing to our newsletter, filling out the contact form or the business enquiry form, or through communications via email, social media, or telephone. This data may include, by way of example, name, surname, email address, telephone number, billing and shipping address, company name, VAT number or tax code (where an invoice is requested), and the content of your messages. Payment card details are entered directly with our payment service providers and are never stored by Somnia.
• Navigation data: Data collected automatically during navigation on Somnia’s website. This data, although not collected to be associated with identified data subjects, could, through processing and association with data held by third parties, allow users to be identified. This category includes IP addresses, domain names of the computers used by users, URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), and other parameters relating to the user’s operating system and IT environment. The image or handwritten signature of a natural person also falls within the definition of “personal data”.
• Cookies and similar technologies: see Section 9.

Providing the data marked as required at checkout is necessary to conclude and perform the sales contract: without it, we cannot process your order. Providing data for marketing purposes is optional.

3. Purposes and Legal Basis for Processing

Personal data is processed for the following purposes and on the basis of the following conditions of lawfulness (Art. 6 GDPR):

• a) Provision of requested services: To process purchase orders, deliver the products, issue invoices, manage returns, warranty requests and customer support requests, and generally to perform a contract to which the data subject is a party or to take pre-contractual measures at the data subject’s request.
  • Legal basis: Performance of a contract (Art. 6, para. 1, lett. b) GDPR).
• b) Compliance with legal obligations: To comply with obligations provided for by law, a regulation, or EU legislation, such as accounting and tax obligations.
  • Legal basis: Compliance with a legal obligation (Art. 6, para. 1, lett. c) GDPR).
• c) Exercise of rights in legal proceedings: To ascertain, exercise, or defend a right of the Controller in legal proceedings .
  • Legal basis: Legitimate interest of the Controller (Art. 6, para. 1, lett. f) GDPR), provided that the interests or fundamental rights and freedoms of the data subject do not override it.
• d) Direct marketing: Subject to your explicit consent, to send commercial and promotional communications, newsletters, advertising material relating to products and services of Somnia and/or third-party commercial partners, via email, SMS, telephone, paper mail, and social media. Consent for this purpose is optional and can be revoked at any time. Pursuant to Art. 130, paragraph 4, of Legislative Decree 196/2003 (Privacy Code), the email coordinates provided in the context of the sale of a product or service may be used for sending commercial communications relating to similar products or services (so-called “soft spam”), provided that the data subject, being adequately informed, does not object to such use.
  • Legal basis: Consent of the data subject (Art. 6, para. 1, lett. a) GDPR) or legitimate interest for “soft spam”.
• e) Profiling: Subject to your explicit consent, to analyze your preferences, consumption habits, and purchasing choices, in order to create user profiles and offer personalised services, content, and commercial communications. Consent for this purpose is optional and can be revoked at any time.
  • Legal basis: Consent of the data subject (Art. 6, para. 1, lett. a) GDPR).
• f) Fraud prevention and payment security: To prevent fraud and the misuse of payment methods, also through the fraud analysis tools of our e-commerce platform and payment service providers.
  • Legal basis: Legitimate interest of the Controller (Art. 6, para. 1, lett. f) GDPR).
• g) Website analytics and advertising measurement: Subject to your consent given through the cookie banner, to measure how the website is used and how effective our advertising is (see Section 9). Consent for this purpose is optional and can be revoked at any time.
  • Legal basis: Consent of the data subject (Art. 6, para. 1, lett. a) GDPR).

4. Processing Methods and Security Measures

The processing of personal data is carried out by means of the operations indicated in Art. 4, no. 2) GDPR. The processing is based on the principles of lawfulness, fairness, and transparency. The data is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. Somnia adopts appropriate technical and organizational security measures to prevent data loss, illicit or incorrect use, and unauthorized access.

5. Communication and Recipients of Data

Your personal data may be communicated to:

• Employees and collaborators of the Controller, duly authorized and instructed.
• Third-party companies or other entities that carry out activities on behalf of the Controller, appointed, if necessary, as Data Processors pursuant to Art. 28 GDPR. In particular: Shopify, which provides our e-commerce platform and checkout; our logistics provider (Medrop), our shipment tracking platform (Qapla) and couriers (e.g. UPS); our electronic invoicing provider (Fattura24); our email marketing provider (Klaviyo); our email and office services provider (Google Workspace); and, where we invite you to review your purchase, our review platform (Trustpilot).
• Payment service providers (Shopify Payments, PayPal, Klarna), which process payment data to execute your payment, as independent controllers or as processors depending on the service.
• Only with your consent given through the cookie banner, analytics and advertising providers (Google, Meta), as described in Section 9.
• Professional advisers (e.g. accountants and lawyers), bound by confidentiality, where necessary for the purposes in Section 3.
• Judicial or administrative authorities, for the fulfillment of legal obligations.
• The data subject has the right to obtain the specific identity of the recipients to whom their data has been disclosed. The Controller may limit itself to indicating only the categories of recipients if it is impossible to identify the specific recipients or if the data subject’s request is manifestly unfounded or excessive.

6. Transfers outside the European Economic Area

Some of the providers listed in Section 5 (for example Shopify, Google, Meta and Klaviyo) may process personal data outside the European Economic Area, including in Canada and the United States. Such transfers take place only on the basis of an adequacy decision of the European Commission (for example for Canada, or the EU-U.S. Data Privacy Framework for certified companies) or of the Standard Contractual Clauses approved by the European Commission, with additional safeguards where required. You can request information on these safeguards by writing to support@qimora.com.

7. Data Retention Period

Personal data is kept for the time strictly necessary to achieve the purposes for which it was collected. Specifically:

• For contractual and legal obligation purposes, the data will be kept for the entire duration of the contractual relationship and, after its termination, for the period provided for by law (usually 10 years for accounting records).
• For marketing and profiling purposes, the data will be kept until the data subject withdraws consent or for the maximum period permitted by the regulations and by the provisions of the Data Protection Authority.
• For cookies and similar technologies, see Section 9.

8. Rights of the Data Subject

As a data subject, you may at any time exercise the rights provided for in Articles 15 to 22 of the GDPR:

• Right of access (Art. 15 GDPR): Obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and information regarding the processing.
• Right to rectification (Art. 16 GDPR): Obtain the rectification of inaccurate personal data.
• Right to erasure (‘right to be forgotten’, Art. 17 GDPR): Obtain the erasure of personal data in the cases provided for by law.
• Right to restriction of processing (Art. 18 GDPR): Obtain the restriction of processing where one of the provided hypotheses applies.
• Right to data portability (Art. 20 GDPR): Receive the personal data concerning you in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller.
• Right to object (Art. 21 GDPR): Object at any time to the processing of personal data based on legitimate interest or carried out for direct marketing purposes.
• Right not to be subject to automated decision-making (Art. 22 GDPR): The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you.

Requests to exercise your rights can be sent to the Data Controller at support@qimora.com. Where processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal. The Controller will provide a response without undue delay and, in any event, at the latest within one month of receipt of the request.

• Right to lodge a complaint: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live or work, if you believe that the processing concerning you violates the GDPR.

9. Cookies

The Qimora website uses:

• Technical cookies, necessary for the website, the cart and the checkout to work and to remember your cookie choices. They do not require consent.
• Analytics and marketing cookies and similar technologies (for example Google Analytics, Google Ads, Meta Pixel and Klaviyo), used to measure how the website is used, to measure the effectiveness of our advertising and to show you relevant advertising. Where required by law, they are used only if you give your consent through the cookie banner.

You can change your choices at any time through the “Cookie preferences” link at the bottom of every page (shown where your consent is required), or by deleting cookies in your browser settings.

10. Changes to this Notice

This notice may be subject to changes and updates. Any changes will be made known to users through publication on Somnia’s website.

Last updated: 5 October 2026.