Privacy notice on the processing of personal data under Articles 13 and 14 of Regolamento (UE) 2016/679 (GDPR).
Last updated: 6 October 2026.
1. Data controller
The controller of data relating to lesmoperformances.com is APR COMMERCE S.R.L., with registered office at Strada Pandelici 8, 42046 Reggiolo (RE), Italia, tax code and VAT number 02956850354, REA RE-328019. Email for personal data enquiries: info@lesmoperformances.com. PEC: aprcommercesrl@kelipec.it.
2. Data processed and sources
We process data supplied by users during registration, purchases and communications: first name, last name, email, telephone number if provided, billing and delivery address, tax details, products ordered, payments and the content of support requests. Compatibility requests may include vehicle characteristics and the vehicle identification number where needed for the requested check.
We receive transaction outcome information from payment providers and shipping information from those making deliveries. When the purchaser specifies a different recipient, we receive that person's data from the purchaser and use it for delivery and related communications.
Browsing may generate technical data such as IP address, online identifiers, device information, access logs and security events. Data collected through cookies and optional tools depends on consent and the service configuration described in the Cookie Policy.
Payment providers process full card details according to their own privacy notices. Do not send full card details or unnecessary information by email or WhatsApp.
3. Purposes and legal bases
Accounts, quotations, orders, payments, shipping, requested compatibility checks, returns, guarantees and assistance: performance of a contract or pre-contractual measures requested by the data subject (Article 6, paragraph 1, point b, GDPR).
Invoicing, accounting and tax compliance or requests from authorities: legal obligation (Article 6, paragraph 1, point c).
Website security, prevention of abuse and fraud, handling disputes and defending rights: the controller's legitimate interest in protecting the service, assets and its rights, while respecting the data subject's rights (Article 6, paragraph 1, point f).
Newsletters and promotional communications: the data subject's optional consent (Article 6, paragraph 1, point a). Subscription is not required to make purchases. Consent can be withdrawn using the unsubscribe link in communications or by writing to the controller.
Google Analytics for non-essential analytics, and Google Ads and Meta Pixel for advertising measurement and personalisation according to enabled functions: consent expressed through the cookie system for the relevant categories. Cookie consent is separate from newsletter consent.
WhatsApp contact: handling the user's request on the basis of the contract or requested pre-contractual measures; for general questions, a legitimate interest in responding. Use of WhatsApp also involves processing by its operator as described in its privacy notice.
4. Provision of data
Data necessary for registration, purchasing, payment, invoicing and delivery is requested to provide the chosen functions and services. Failure to supply it may prevent account management, order fulfilment or a response to the request. Newsletters, optional cookies and use of WhatsApp are optional; withholding the associated consent does not prevent purchasing.
5. Processing methods and recipients
Data is processed using electronic tools and, where necessary, paper documents, by authorised personnel and parties involved in the services, within the scope of their respective activities.
The e-commerce platform is PrestaShop; hosting is planned with OVH and company email uses Google Workspace. Data may be received by parties responsible for website maintenance and technical support, newsletter management services, enabled payment providers including PayPal, Stripe and Revolut, banks, carriers and logistics and customs operators, suppliers where needed to fulfil orders, accounting, tax and legal advisers, and competent authorities where required by law.
Google and Meta receive information relating to their analytics and advertising tools according to consent and enabled functions. WhatsApp processes data relating to use of its service. Recipients may act as processors on behalf of the controller or as independent controllers, according to their actual role. Lesmo does not publicly disclose data for order management and assistance.
6. Transfers outside the European Economic Area
Use of international services and delivery outside the European Economic Area may involve transfers of data to recipients in third countries. Transfers must comply with the conditions laid down by the GDPR, including, where applicable, European Commission adequacy decisions or standard contractual clauses with the necessary supplementary measures. For transfers strictly necessary for requested delivery to a third country, the relevant GDPR provisions apply where their requirements are met.
You can ask the controller for information on recipients, countries involved and applicable safeguards, and for a copy of the safeguards within the prescribed limits, by writing to info@lesmoperformances.com.
7. Retention
Support requests: 24 months from closure of the request, unless relevant data must be retained longer for legal obligations or dispute handling.
Order, invoice and accounting data: for the period required by applicable tax and civil law and, for data needed to defend rights, for the duration of any disputes and the related time limits.
Account data: for the lifetime of the account; after closure, only data necessary for legal obligations, orders, guarantees or disputes is retained.
Newsletter contacts: for the duration of the subscription, until consent is withdrawn or the user unsubscribes; the usefulness of retention is periodically reviewed against its purpose. After withdrawal, only information strictly necessary to document choices, respect unsubscription or meet legal obligations is retained.
Technical and security logs: for the time needed to establish and manage security events, according to their nature and severity and any applicable obligations. Cookie and tracking tool durations: stated in the Cookie Policy and the inventory for the active configuration.
When retention is no longer necessary, data is deleted or anonymised, subject to applicable obligations.
8. Data subject rights
In the cases and within the limits laid down by the GDPR, data subjects can obtain access, rectification, erasure, restriction of processing and portability. They may object to processing based on legitimate interests on grounds relating to their particular situation; they may object to direct marketing at any time. They may withdraw consent without affecting the lawfulness of processing carried out before withdrawal.
Requests may be sent to info@lesmoperformances.com. The controller responds within GDPR time limits and may request information needed to verify the requester's identity. Data subjects may lodge a complaint with the Garante per la protezione dei dati personali, www.garanteprivacy.it, or the competent supervisory authority.
Cookie preferences can be changed using the relevant control on the website.
9. Personalised advertising
Enabled advertising tools may use identifiers and online interactions to create audiences and show relevant advertisements, on the basis of consent. This processing is separate from order management and the newsletter. Consent to the relevant tools can be withdrawn in cookie preferences.
10. Updates
This notice may be updated when services, processing or applicable provisions change. The updated version is published on this page with its date.
Notes for the controller and webmaster — do not publish
The text incorporates the information supplied: PrestaShop, OVH, Google Workspace, analytics and advertising services, WhatsApp and retention of support data for 24 months. It does not name a DPO because a formal designation has not been confirmed; if one has been appointed, add their contact details before publication.
For the newsletter, retention for the duration of the subscription until withdrawal is proposed, with periodic checks of necessity: implement this criterion operationally or communicate the actual period so the text can be updated.
Check before publication: the identity of the newsletter service and its operator; providers' contracting entities and roles; processing locations and actual transfer mechanisms; Google/Meta configuration and analytics data retention; whether any solely automated decisions with legal or similarly significant effects exist. Their absence has not been stated because it is unconfirmed: if they exist, add the information required by Article 13, paragraph 2, point f, GDPR.
The current cookie table was not supplied. The notes are separate from the page texts and must not be copied to the website. The document does not certify verification of provider contracts or technical configuration.
Sources: https://eur-lex.europa.eu/eli/reg/2016/679/oj/?locale=it ; https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876 ; https://www.garanteprivacy.it/faq-sul-responsabile-della-protezione-dei-dati-rpd-in-ambito-privato .