Privacy policy
Data Controller: Kevin Braga
Website: www.kevinbraga.com
Last updated: 31 August 2026
BRAGA | rive del garda (www.kevinbraga.com) operates this website and all related content, features, tools, products and services, with the aim of providing a curated shopping experience (the "Services"). The website is built on the Shopify platform, which enables us to deliver the Services to you.
This Privacy Policy sets out how Kevin Braga, acting as the data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 ("GDPR"), collects, uses and discloses the personal data of users who visit www.kevinbraga.com, make a purchase, download free products, or otherwise interact with the Services.
This Privacy Policy is provided in accordance with Article 13 GDPR, Legislative Decree No. 196/2003 (as amended by Legislative Decree No. 101/2018), Directive 2002/58/EC, and Article 122 of the Italian Personal Data Protection Code in relation to cookies and tracking technologies.
In the event of any conflict between our Terms of Service and this Privacy Policy, this Privacy Policy prevails with respect to the collection, use and disclosure of your personal data.
Please read this Privacy Policy carefully. By accessing or using the Services, you acknowledge that you have read and understood how we collect, use and disclose your information as described below.
1. Data Controller
Kevin Braga, Via Mancino 26, 25017 Lonato del Garda (BS), Italy. Tax identification number: BRGKVN97C17F463N
To exercise your rights under Articles 15–22 GDPR, or for any query about how your personal data are handled, please contact: customerservice@kevinbraga.com
Response times are set out in Section 14.
2. Personal Data We Collect
Depending on how you use the website, we may process the following categories of personal data:
2.1 Identity and contact details
Your name, email address, shipping and billing address, and phone number, provided through forms on the website — including order forms, download requests and pre-sale registrations. Where relevant, we may also process size and height data that you choose to provide.
2.2 Technical and browsing data
Data collected automatically when you visit the website, including your IP address, device type and browser type, pages viewed, session length and other technical usage information. These data are collected through the platform's infrastructure and the tools used on the website. For details of the tracking technologies used, see our Cookie Policy.
2.3 Purchase and payment data
If you make a purchase, we process the personal data required to fulfil your order, arrange delivery and meet our legal obligations, including tax and accounting obligations. Payment details are processed by Shopify Payments and the relevant payment service providers directly. We do not retain your payment card details.
2.4 Communications with us
If you contact us — for example, to submit a support request or enquiry — we process the information you include in that communication, including your name, email address and the content of your message.
2.5 Preference data
Where you choose to provide this information, we may process data about your preferences relating to your experience or purchasing habits. These data are not special category data within the meaning of Article 9 GDPR.
3. How We Collect Personal Data
We collect personal data from the following sources:
-
directly from you, when you visit the website, complete a form, make a purchase, register for a pre-sale, or contact us;
-
automatically, through the website's technical infrastructure, when you interact with the Services — including through cookies and similar tracking technologies (see our Cookie Policy);
-
from our service providers, including Shopify and the payment service providers we use to process your orders, where they collect or process personal data on our behalf.
4. Purposes and Legal Bases of Processing
We process your personal data only where we have a valid legal basis to do so (for specific, explicit and legitimate purposes) under applicable data protection law. For each processing activity, we identify the relevant legal basis under Article 6 of the GDPR and, where applicable, under Italian Legislative Decree No. 196/2003.
We may use your personal data to: deliver orders, content and pre-sale access; operate and secure the website; conduct analytics (subject to your consent); send marketing communications (subject to your consent); provide customer support; and comply with our legal obligations.
The purposes for which we process your personal data, together with the applicable legal basis, are set out in the sections below. Where we rely on our legitimate interests as a legal basis, we have carried out a balancing assessment and are satisfied that our interests do not outweigh your rights and freedoms. You may object to any processing based on legitimate interests by contacting us at customerservice@kevinbraga.com.
Where processing is based on your consent, you may withdraw it at any time, with effect for future processing. Withdrawal does not affect the lawfulness of any processing carried out before the withdrawal.
4.1 Delivering content and downloads
When you submit a form to access digital content, we use the data you provide to fulfil your request. Our legal basis is Article 6(1)(b) of the GDPR, where processing is necessary in order to take steps at your request prior to entering into a contract. We use your data only to the extent necessary to deliver the content requested. Any use of your data for marketing is based on a separate legal basis and, where required, on your specific consent in accordance with Article 7 of the GDPR.
4.2 Running and securing the website
We use technical data to operate the website, maintain security, prevent misuse and monitor errors. Our legal basis is Article 6(1)(f) of the GDPR, relating to our legitimate interests. Our legitimate interest is to maintain a secure and reliable website and service. We have carried out a balancing test and are satisfied that this interest does not outweigh your rights and freedoms. You may object to this processing at any time by contacting us at customerservice@kevinbraga.com.
4.3 Analytics
We only activate analytical cookies and tracking tools after obtaining your consent. Our legal basis is Article 6(1)(a) of the GDPR, read together with Article 5(3) of Directive 2002/58/EC and Article 122 of Legislative Decree No. 196/2003. Full details, including providers, purposes and retention periods, are set out in our Cookie Policy.
4.4 Pre-sale access
If you request access to an ongoing pre-sale, we process your data under Article 6(1)(b) of the GDPR. If you provide your email address only to be notified when a future pre-sale opens, this constitutes a marketing communication and we rely on your consent under Article 6(1)(a) of the GDPR. Section 4.5 applies in that case.
4.5 Marketing
We only send newsletters, product updates, collection announcements, promotions and other marketing emails if you have given your consent. Our legal basis is Article 6(1)(a) of the GDPR. Consent is obtained and managed in accordance with Article 7 of the GDPR and Article 130 of Legislative Decree No. 196/2003. You may withdraw your consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal.
4.6 “BRAGA VIP Lounge” Access Programme
If we launch an exclusive access programme, we will provide a separate privacy notice when you sign up, setting out the purposes, legal bases, recipients and retention periods that apply. Any profiling or automated processing will be subject to the safeguards required by law, including Article 22 of the GDPR, where applicable.
5. Disclosure of Personal Data
We do not sell your personal data. We may share your personal data with third parties only in the circumstances described below.
5.1 Service providers
We share personal data with third-party service providers who process data on our behalf, including Shopify (platform infrastructure and payment processing), delivery and fulfilment partners, and cloud storage providers. These providers act as data processors under Article 28 GDPR and are bound by contractual obligations to process your data only on our instructions and in accordance with applicable law.
5.2 At your direction
We may disclose your personal data to third parties where you have directed or consented to that disclosure — for example, to arrange delivery of your order to a specified address or carrier.
5.3 Legal obligations and protection of rights
We may disclose your personal data where required to comply with applicable law, respond to lawful requests from public authorities (including law enforcement), enforce our terms and policies, or protect the rights, safety or property of our users or third parties.
5.4 Business transfers
In the event of a merger, acquisition, restructuring or sale of assets, your personal data may be transferred to the relevant third party as part of that transaction, subject to applicable data protection law.
6. Minimum Age
Our website and its forms are intended for users aged 14 and over, in accordance with Article 8 of the GDPR and Article 2-quinquies of Legislative Decree No. 196/2003 (as amended by Legislative Decree No. 101/2018). We do not knowingly collect or process personal data from anyone under the age of 14.
By completing a form on the website, you confirm that you are at least 14 years old, or that you have obtained the prior consent of a parent or legal guardian. We have no technical means of verifying users' ages and accept no liability for false statements made in this regard. If you are the parent or guardian of a child who has provided us with their personal data without the required consent, or if we become aware that we have collected personal data from a child under 14 without such consent, we will take prompt steps to erase the relevant data. You may notify us at customerservice@kevinbraga.com.
7. Email Communications
We distinguish between emails sent to deliver a service you have requested and marketing emails, which rely on different legal bases.
7.1 Service emails
Emails strictly necessary to deliver a service you have requested are sent under Article 6(1)(b) of the GDPR and do not require your consent to receive marketing communications. Depending on how you use the website, these may include: request confirmations; download confirmations and access links; pre-sale access communications; and order updates.
Service emails do not contain promotional content. If a service email includes promotional content, Section 7.2 applies to that content.
7.2 Marketing emails
We only send marketing emails, including newsletters, new collection announcements, product launches, promotions and subscriber-only events, if you have given your consent. Our legal basis is Article 6(1)(a) of the GDPR. Consent is obtained and managed in accordance with Article 7 of the GDPR and Article 130 of Legislative Decree No. 196/2003.
You may withdraw your consent at any time, using the same means by which you gave it:
-
clicking the unsubscribe link in any marketing email; or
-
emailing customerservice@kevinbraga.com with the subject line: UNSUBSCRIBE — [FIRST NAME LAST NAME]
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
8. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purpose for which they were collected. Retention periods vary by purpose:
-
Download data: for as long as necessary to fulfil your request and, thereafter, for up to 12 months to demonstrate that the service was properly provided.
-
Marketing data: until you withdraw your consent and, in any event, no longer than 24 months from your last active interaction or valid re-confirmation of consent. Data are erased at the end of this period unless consent is renewed.
-
Rights requests: for 12 months after the request has been closed, so that we can demonstrate compliance if required.
-
Technical and browsing data: in accordance with the retention periods of the specific tools used on the website, as set out in our Cookie Policy.
-
Purchase data: for as long as necessary to perform the contract and, thereafter, for as long as required by law, including tax and accounting obligations arising under Article 2220 of the Italian Civil Code and Presidential Decree No. 633/1972.
When the relevant period ends, we erase or anonymise your data, unless we are required to retain them to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
9. Cookies and Tracking Technologies
We use cookies and other technologies that are strictly necessary to operate the website. These do not require your consent under Article 5(3) of Directive 2002/58/EC and Article 122 of Legislative Decree No. 196/2003.
Any non-essential technologies, including analytical cookies, marketing cookies and equivalent technologies, are only activated after you have given your consent through our cookie banner.
If you consent, we activate the following non-essential cookies set by Shopify International Limited as part of the platform infrastructure:
|
Cookie |
Purpose |
|
shopify_analytics |
Statistical analysis of browsing behaviour and website performance |
|
shopify_marketing |
Optimisation of marketing activities |
|
shopify_s |
Shopify analytics session and anonymous browsing data |
|
shopify_y |
Unique visitor identification for Shopify analytics |
All four cookies are covered by Shopify's Consumer Privacy Policy. No third-party cookies are currently active on this website.
Full details, including retention periods and provider information, are set out in our Cookie Policy, which forms part of this Privacy Policy.
You may update or withdraw your cookie consent at any time using the cookie preference panel on the website or through your browser settings, as described in the Cookie Policy.
10. Profiling and Automated Decision-Making
We do not currently carry out profiling or make decisions concerning you based solely on automated processing within the meaning of Article 22 of the GDPR.
If we introduce segmentation or personalisation tools in the future, we will distinguish between the following:
-
segmentation and analysis that do not produce legal effects or similarly significantly affect you, which will be carried out on a lawful basis under Article 6 of the GDPR and, where based on consent, subject to your specific consent; and
-
decisions made solely by automated means that produce legal effects concerning you or similarly significantly affect you, which will be subject to the safeguards required by Article 22 of the GDPR, including your right to obtain human intervention, express your views and challenge the decision.
Before introducing any profiling or automated decision-making tool, we will update this Privacy Policy to set out the legal basis, the logic involved, the likely impact on you and your rights in relation to such processing.
11. Service Providers
We work with technology providers to operate the website and provide its features. Where these providers process personal data on our behalf, they act as data processors in accordance with Article 28 of the GDPR, on the basis of written agreements.
Our main providers are:
Shopify International Limited
Our core platform provider, used to operate the website and provide checkout, payment and analytics functionality. Shopify International Limited acts as a data processor on our behalf in accordance with its Data Processing Addendum (last updated 7 July 2026), and is bound by contractual obligations to process your data only on our instructions and in accordance with applicable law.
Documentation: shopify.com/legal/dpa
Please note that Shopify also processes certain personal data as an independent data controller for its own purposes — including operating, securing and improving the Shopify platform. In these circumstances, Shopify is solely responsible for that processing. For further information on how Shopify uses your personal data and how to exercise your rights in that context, see the
Shopify Consumer Privacy Policy
and the
.
We also share personal data with delivery and fulfilment partners and cloud storage providers, where they process data on our behalf under Article 28 GDPR.
Shopify Messaging
Used to manage transactional and marketing email communications, where enabled. Covered by Shopify International Limited.
Translate & Adapt
Used to manage the website's language features. Covered by Shopify International Limited.
Sono Music Player
Used for audio playback on the website. This tool does not set cookies or collect personal data during normal operation.
Google LLC — Google Workspace
Used to manage and store our internal data and documents. Your personal data are not stored in Google Workspace. Documentation: Google DPA
The role of each provider depends on the services provided, the service configuration and the relevant contractual documentation. This list will be updated if our technology stack changes.
12. International Data Transfers
Certain technology providers we work with process personal data outside the European Economic Area (EEA). All such transfers are carried out in compliance with Articles 44 et seq. GDPR, on the basis of the applicable safeguard mechanisms.
Shopify International Limited — Ireland and transfers outside the EEA For processing subject to European data protection law, our contractual counterpart is Shopify International Limited, headquartered in Dublin, Ireland. Transfers to other Shopify group entities or sub-processors located outside the EEA are made on the basis of the mechanisms set out in the Shopify DPA (last updated 7 July 2026):
-
primarily, Binding Corporate Rules (BCR) under Article 46(2)(b) GDPR;
-
where applicable, Standard Contractual Clauses under Article 46(2)(c) GDPR;
-
for transfers to countries recognised as adequate by the European Commission, the relevant adequacy decision under Article 45 GDPR.
Documentation: shopify.com/legal/dpa
Google LLC — United States Data processed via Google Workspace are managed with the data region set to the EU. Any residual transfers to the United States are made on the basis of Standard Contractual Clauses under Article 46(2)(c) GDPR and, where applicable, the EU–US Data Privacy Framework.
Documentation: Google DPA
For all other providers involving transfers outside the EEA, we will apply the safeguards required by applicable law. This list will be updated if our technology stack changes.
13. Your rights
Under Articles 15–22 of the GDPR, you have the following rights:
Access (Art. 15) — to know whether we hold personal data concerning you and, if so, to receive a copy, together with information about how we use your data.
Rectification (Art. 16) — to have inaccurate data corrected and incomplete data completed.
Erasure (Art. 17) — to have your data erased where permitted by law.
Restriction (Art. 18) — to have the processing of your data restricted where permitted by law.
Portability (Art. 20) — to receive the data you have provided to us in a structured, commonly used and machine-readable format, where technically possible.
Objection (Art. 21) — to object to processing based on our legitimate interests.
Withdrawal of consent (Art. 7(3)) — to withdraw any consent you have given at any time. This does not affect the lawfulness of processing carried out before the withdrawal.
You also have the right to lodge a complaint with the supervisory authority — see Section 14.
To exercise any of these rights, contact us at customerservice@kevinbraga.com.
We may ask you to confirm your identity before acting on a request if we have reasonable doubts about your identity, as permitted by Article 12(6) of the GDPR. If we do so, we will let you know promptly.
14. How Long We Take To Response
We will respond to requests to exercise your rights without undue delay and in any event within one month of receiving them, in accordance with Article 12(3) of the GDPR.
If you contact us electronically, we will respond electronically where possible, unless you ask us to do otherwise.
If your request is particularly complex or we receive a large number of requests simultaneously, we may extend this period by a further two months. If we do so, we will let you know within the first month, together with the reasons for the extension.
15. Offline and In-Person Data Collection
At events, trade fairs, pop-ups, concerts or other brand activities, we may collect personal data in paper or digital form.
In accordance with Article 13 of the GDPR, we will provide you with a privacy notice at the point of collection, in writing or in another documented form. The notice will set out the purposes, legal bases, recipients, retention periods and our contact details for exercising your rights.
For paper forms, the notice will be attached to the form or displayed on-site in a legible format. For digital forms, the notice will be accessible before you complete the form.
Data collected at in-person activities are processed in the same way and for the same purposes described in this Privacy Policy, unless we tell you otherwise at the time of collection.
16. Complaints
You have the right to lodge a complaint with a supervisory authority under Article 77 of the GDPR. This does not affect any other administrative or judicial remedy you may have.
The supervisory authority responsible for our processing activities is:
Garante per la Protezione dei Dati Personali
Piazza Venezia 11
00187 Rome — Italy
Website: www.garanteprivacy.it
Certified electronic mail (PEC): garante@pec.gpdp.it
Telephone: +39 06 69677 1
17. Updates to This Privacy Policy
We may update this Privacy Policy if the law changes or if we change how we operate, update our technology or engage new service providers. When we do, we will publish the updated version on the website and update the “Last updated” date accordingly.
For minor changes, publication of the updated version on the website will be sufficient.
For material changes that affect how we process your data, we will give registered users reasonable notice by email before the changes take effect.
If the changes affect the purposes or legal basis for processing carried out on the basis of your consent, we will obtain your consent again before carrying out the new processing. If you do not consent, we will not process your data for the new purposes.
Last updated: 31 August 2026