Privacy & Data Handling Policy

This Policy explains how 3E S.r.l. (brand: LAPHILO Studio) collects, uses, stores, protects and deletes personal data when fulfilling orders placed on online marketplaces, including Amazon and Temu. We are a print-on-demand (DTG) manufacturer that self-fulfils customized products. We process marketplace data solely to produce and ship orders, in full compliance with the GDPR (Regulation (EU) 2016/679), the Amazon Acceptable Use Policy and Data Protection Policy, and Temu's partner requirements.

1. Data Controller & Contact

2. Personal Data We Process

We process only the minimum data necessary to fulfil an order:

Data	Purpose
Recipient name	Production and shipment addressing
Shipping address	Delivery by the courier
Phone number	Carrier delivery notifications
Email address	Order / shipping communication where required
Order & customization details	Personalized text and images needed to print the correct item

We do not collect payment card data, government IDs, or any special categories of personal data.

3. Purpose & Legal Basis

Personal data is used solely to perform order fulfilment — rendering artwork, printing, labelling and shipping — and to meet legal obligations. The legal bases are performance of a contract and compliance with legal obligations under the GDPR. We never use marketplace or buyer data for advertising, profiling, resale, or any purpose outside the agreed order fulfilment.

4. Data Storage & Encryption

• Location: data is stored and processed on private servers hosted with Amazon Web Services (AWS) within the European Union (Paris region, France).
• In transit: all connections use TLS 1.2 or higher (HTTPS).
• At rest: data is encrypted using AES-256; encryption keys are managed via AWS Key Management Service (KMS) with restricted access and periodic rotation.
• Passwords: stored only as bcrypt hashes — never in plain text.
• Backups: encrypted EBS snapshots (AES-256).

5. Access Control

Access to personal data is restricted on a strict need-to-know, least-privilege basis:

• Every user has unique individual credentials — no shared accounts.
• Role-based access control (Admin / Operator / Viewer, and production roles) limits each user to the data and functions required for their job.
• Administrative and privileged accounts are protected by a strong password policy (minimum 12 characters with complexity requirements and periodic rotation) and server-side session tokens.
• Accounts of employees who resign or change roles are promptly disabled or adjusted.
• Databases and file servers sit in a private network with no public access; access is restricted by firewall, IP allow-list and key-based authentication.

6. Logging & Monitoring

All access to and actions on personal data are recorded in audit logs — including the user identity, action, target, IP address and timestamp. Logs are retained for at least 12 months, monitored for suspicious activity, and used to investigate incidents. Buyer PII is excluded from application logs.

7. Data Retention & Deletion

Personal data is retained only as long as necessary to fulfil the order and meet legal obligations. Buyer personal data is deleted within 30 days after the order is completed / shipped. Production files and artwork are removed on a rolling basis. Data retained solely to comply with tax or accounting law is kept only for the period required by that law and then securely deleted.

8. Data Sharing & Sub-processors

We do not sell or share buyer information with any third party for their own use. Data is shared only with the sub-processors strictly needed to fulfil the order, each bound by data-protection obligations and receiving only the minimum data required:

Party	Role	Data shared
Amazon Web Services	Cloud hosting & storage (EU)	Stored data (encrypted)
Courier (e.g. BRT, DHL, UPS)	Delivery	Recipient name, address, phone

Amazon information is retrieved only directly from the Amazon Selling Partner API; Temu information is retrieved only from the Temu partner platform. We use no external or third-party sources to obtain marketplace data.

9. Your Rights

Under the GDPR, data subjects have the right to access, rectify, erase, restrict or object to processing, to data portability, and to opt out. To exercise these rights, contact vyu.3eitaly@gmail.com. We assist marketplaces and merchants in responding to such requests as required by applicable law.

10. Security Incidents & Breach Notification

We maintain an incident response plan with defined roles and periodic reviews. In the event of a suspected or confirmed breach involving personal data, we notify the affected marketplace and, where applicable, the relevant supervisory authorities without undue delay. Incidents involving Amazon Information are reported to security@amazon.com within 24 hours of detection. Temu and regulatory authorities are notified in accordance with their requirements.

11. International Transfers

Personal data is stored and processed within the European Union. We do not transfer personal data outside the EU/EEA except where adequate safeguards under the GDPR are in place.

12. Changes

We may update this Policy from time to time. The "Last updated" date above shows when the most recent changes took effect.

隐私与数据处理政策

本政策说明 3E S.r.l.（品牌：LAPHILO Studio）在履行来自各在线平台（包括 Amazon（亚马逊）与 Temu）的订单时，如何收集、使用、存储、保护和删除个人数据。 我们是自主履约的按需印刷（DTG）定制品制造商，仅为生产和发货而处理平台数据，全面遵守 《欧盟通用数据保护条例》（GDPR，Regulation (EU) 2016/679）、亚马逊《可接受使用政策》与 《数据保护政策》，以及 Temu 合作方要求。

1. 数据控制者与联系方式

2. 我们处理的个人数据

我们仅处理履行订单所必需的最少数据：

数据	用途
收件人姓名	生产与运单收件信息
收货地址	快递投递
电话号码	快递投递通知
电子邮箱	必要时的订单 / 物流沟通
订单与定制信息	打印正确商品所需的个性化文字与图片

我们不收集支付卡信息、政府证件号，或任何特殊类别的个人数据。

3. 处理目的与法律依据

个人数据仅用于履行订单——出图、打印、贴标与发货——以及履行法律义务。法律依据为 GDPR 项下的合同履行与法律义务遵从。我们绝不将平台或买家数据用于广告、画像分析、 转售，或任何超出约定订单履约范围的用途。

4. 数据存储与加密

• 存储地点：数据存储与处理于 AWS（Amazon Web Services）位于欧盟境内（法国巴黎区域）的私有服务器。
• 传输中：所有连接均使用 TLS 1.2 或更高版本（HTTPS）。
• 静态存储：采用 AES-256 加密；密钥通过 AWS 密钥管理服务（KMS）管理，访问受限并定期轮换。
• 密码：仅以 bcrypt 哈希形式存储，绝不明文保存。
• 备份：采用加密的 EBS 快照进行备份（AES-256）。

5. 访问控制

对个人数据的访问遵循严格的「按需知情、最小权限」原则：

• 每位用户拥有唯一的个人凭证，无共享账号。
• 基于角色的访问控制（管理员 / 操作员 / 只读，及各生产角色）限制每位用户仅能访问其岗位所需的数据与功能。
• 管理及特权账号采用强密码策略（≥12 位、含复杂度要求、定期轮换）与服务器端会话令牌认证。
• 员工离职或转岗时，账号及时停用或调整。
• 数据库与文件服务器位于无公网访问的私有网络，通过防火墙、IP 白名单与密钥认证限制访问。

6. 日志与监控

对个人数据的所有访问与操作均记录于审计日志，包含用户身份、操作、目标对象、IP 地址与时间戳。 日志至少保留 12 个月，持续监控可疑活动，并用于事件调查。买家个人信息不写入应用日志。

7. 数据保留与删除

个人数据仅在履行订单与履行法律义务所必需的期间内保留。买家个人数据在订单完成 / 发货后 30 天内删除， 生产文件与图稿滚动清理。仅为遵守税务或会计法律而保留的数据，仅在该法律要求的期限内保留，之后安全删除。

8. 数据共享与子处理方

我们不向任何第三方出售或共享买家信息用于其自身用途。数据仅共享给履约所必需的子处理方， 各方均受数据保护义务约束，且仅接收履约所需的最少数据：

方	角色	共享数据
Amazon Web Services	云托管与存储（欧盟）	所存数据（已加密）
快递承运商（如 BRT、DHL、UPS）	投递	收件人姓名、地址、电话

亚马逊信息仅直接通过 Amazon Selling Partner API 获取；Temu 信息仅通过 Temu 合作方平台获取。 我们不使用任何外部或第三方来源获取平台数据。

9. 您的权利

根据 GDPR，数据主体有权访问、更正、删除、限制或反对处理其个人数据，并享有数据可携权与退出权。 如需行使上述权利，请联系 vyu.3eitaly@gmail.com。 我们将依适用法律协助平台与商户响应此类请求。

10. 安全事件与泄露通知

我们制定了明确分工并定期审查的事件响应计划。一旦发生疑似或确认的个人数据泄露，我们将不无故拖延地 通知受影响平台，并在适用情况下通知相关监管机构。涉及亚马逊信息的事件，将在发现后 24 小时内报告至 security@amazon.com；并依 Temu 及监管机构要求进行通知。

11. 跨境传输

个人数据在欧盟境内存储与处理。除非已具备 GDPR 项下的充分保障措施，我们不将个人数据传输至欧盟 / 欧洲经济区之外。

12. 政策变更

我们可能不时更新本政策。上方「最后更新」日期表示最近一次变更的生效时间。