Annapurna Publishing · Annapurna S.r.l.s.
Privacy Policy
Last updated: September 1, 2026. This notice is provided under Regulation (EU) 2016/679 (GDPR) and explains the processing of personal data through the Joy Bondielli website and store.
Data controller
The controller is Annapurna S.r.l.s., Via Lago Maggiore 6, 36077 Altavilla Vicentina (VI), Italy, tax code and VAT number 04366730242. Privacy requests may be sent to info@annapurnapublishing.site or by post to the registered office.
Data and sources
We receive data directly from the adult purchaser and, where needed to complete an order, from Stripe, Amazon Multi-Channel Fulfillment and delivery carriers. Data may include name, email, telephone number, billing and delivery address, tax identification details, selected products, price, order status, shipment and tracking data, communications and refund history. We also process language, basket and privacy preferences stored on the device, limited request, device, IP and security logs, and—only after analytics consent—pseudonymous usage information such as pages viewed, session events, approximate location, browser and device category.
Payments
Stripe processes payment credentials and fraud-prevention information through its secure checkout. Full payment-card details are not stored by this website. Stripe may act as our processor and, for some regulated payment activities, as an independent controller under its own privacy notice.
Purposes and legal bases
We process data to answer requests and take pre-contract steps; form, perform and manage the sales contract; calculate VAT, issue invoices and meet legal, tax and accounting duties; arrange fulfillment, delivery, returns and refunds; prevent fraud and protect the service; and establish or defend legal claims. The legal bases are contract and pre-contract steps, legal obligation and legitimate interests in security, service management and legal protection. Google Analytics and Meta Pixel/Conversions API are used only after the visitor’s consent to measure audiences, traffic sources, product interactions and purchases and to support advertising measurement. Consent may be refused or withdrawn without affecting the purchase journey.
Required information
Contact, billing, delivery and payment information requested at checkout is necessary to complete the purchase. If it is not provided, the order cannot be accepted or fulfilled. Optional marketing choices are never required to buy a book.
Recipients
Data is shared only as necessary with providers supporting hosting and security (including Vercel), payments and invoicing (Stripe), fulfillment and delivery (Amazon Multi-Channel Fulfillment and its carriers), optional audience and advertising measurement (Google Analytics and Meta Pixel/Conversions API, operated by Google and Meta), customer support, professional advisers, tax or accounting services and public authorities where legally required. Providers receive only the information needed for their role.
International transfers
Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, the EU–US Data Privacy Framework for participating organizations, Standard Contractual Clauses or another safeguard recognized by EU law.
Retention
Order, invoice and accounting records are generally retained for ten years or the longer period required for a dispute or legal obligation. Delivery and customer-service records are retained for the time needed to complete the service and handle claims, normally no longer than 24 months after closure unless linked to an accounting record or dispute. Security logs are retained for a proportionate short period. Google Analytics user- and event-level retention is configured to the shortest available period of 2 months; standard aggregated reports may remain available longer. Meta event data and identifiers follow the retention controls and contractual terms configured for the connected business tools. Consent evidence is retained for as long as necessary to demonstrate the choice. Data is then deleted or anonymized where feasible.
Rights
Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction, portability or objection, and may withdraw consent at any time without affecting earlier lawful processing. No purchase decision is based solely on automated processing that produces legal or similarly significant effects. Send requests to info@annapurnapublishing.site; reasonable identity verification may be required.
Complaints
You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority in the EU/EEA country where you live or work or where the alleged infringement occurred.
Children
The books are for children, but the store, checkout and customer-service channels are intended for adults. We do not offer child accounts or knowingly request personal data directly from children. A parent or guardian may contact us to request deletion of information a child may have submitted.
Updates
We may update this notice when providers, features or legal requirements change. The current version and effective date are always published on this page.