Privacy Policy
Last updated: 3 September 2026
This policy explains how Save Your iPod processes the personal data of users who visit saveyouripod.com, request a repair quote, use the «build your own iPod» configurator or contact us. Processing is carried out in accordance with Regulation (EU) 2016/679 («GDPR») and applicable national law, including the Dutch GDPR Implementation Act (Uitvoeringswet AVG) for users resident in the Netherlands and Italian Legislative Decree 196/2003 as amended.
1. Data controller
The data controller is Save Your iPod – [registered name / name of the controller], [full registered address], [VAT number and/or company register / KvK number].
For any request concerning the processing of personal data you can write to: info@saveyouripod.com.
The controller has not appointed a Data Protection Officer (DPO), as it is not required to do so.
2. Categories of personal data processed
Depending on how you interact with the site, we may process the following categories of data:
- Contact and identification data: first and last name, e-mail address, telephone number, country and any further information you provide voluntarily in a notes field or by e-mail.
- Device and request data: iPod model and generation, capacity, described symptoms and faults, type of service requested (repair, upgrade, diagnosis only), cosmetic condition, components selected in the configurator, the generated price estimate and additional notes.
- Images: any photographs of the device you upload to support your request.
- Shipping data: pick-up/delivery address and information needed to arrange the courier, where the device is sent to us or returned.
- Navigation and technical data: IP address, browser and device type, date and time of the request, pages viewed and server logs, collected automatically for the operation and security of the site.
- Data contained in cookies: see section 12.
The site is not intended to collect special categories of data (Art. 9 GDPR). Please do not enter such information in free-text fields.
3. Purposes of processing and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to quote, information and contact requests, and carrying out the pre-contractual steps you request | Pre-contractual measures and, subsequently, performance of the contract – Art. 6(1)(b) GDPR |
| Providing the repair, upgrade, diagnosis or assembly service, handling the device received, communicating timing, cost and status of the work, arranging pick-up and return | Performance of the contract – Art. 6(1)(b) GDPR |
| Complying with legal obligations regarding accounting, tax and civil-law record keeping (invoicing, retention of documents) | Legal obligation – Art. 6(1)(c) GDPR |
| Ensuring the security of the site and preventing abuse, fraud and automated submissions (request rate limiting, technical logs) | Legitimate interest of the controller in protecting its systems and services – Art. 6(1)(f) GDPR |
| Establishing, exercising or defending legal claims | Legitimate interest of the controller – Art. 6(1)(f) GDPR |
| Sending promotional communications or a newsletter (only if activated in the future) | Consent of the data subject – Art. 6(1)(a) GDPR, withdrawable at any time |
As at the last update, the site operates on an information and quote-request basis only: there is no direct online sale and no marketing activity.
4. How data is processed
Data is processed using electronic tools and, solely for the physical handling of devices, paper records, applying technical and organisational measures appropriate to ensure the security, confidentiality and integrity of the information (including encrypted HTTPS connection, access controls, system updates and data minimisation). Processing is carried out by the controller and by persons authorised under its responsibility.
5. Recipients and processors
For the purposes described above, personal data may be disclosed to the following categories of parties, acting as processors under Art. 28 GDPR or as independent controllers:
- Hosting and e-mail provider: Hostinger International Ltd, which hosts the website and the info@saveyouripod.com mailbox on servers located in the European Union;
- E-mail delivery providers used to send confirmations and service communications;
- Couriers and logistics operators, for the pick-up and return of devices;
- Advisers and professionals (e.g. accountant) and technical maintenance providers for the site, to the extent necessary;
- Payment service providers, should direct sales be activated in the future;
- Public authorities, where required by law or by an order of the authorities.
Data is not disseminated and is not transferred to third parties for marketing purposes.
6. Transfers to third countries
Data is processed within the European Economic Area. Where a provider entails a transfer to third countries, the controller ensures that such transfer takes place on the basis of an adequacy decision of the European Commission or of appropriate safeguards under Art. 44 et seq. GDPR (in particular the Standard Contractual Clauses adopted by the Commission), a copy of which may be requested from the controller.
7. Retention period
- Quote or contact requests with no contractual follow-up: up to 24 months from the last contact, in order to handle possible subsequent requests, unless deleted earlier at the data subject’s request;
- Data relating to contracts and work carried out: for the duration of the relationship and thereafter for the period provided by law to exercise and defend rights (generally 10 years);
- Accounting and tax documentation: 10 years under Italian law and tax rules; for operations attributable to an establishment in the Netherlands, the 7-year fiscal retention period under Dutch law also applies;
- Technical logs and security data: normally no longer than 12 months, save for longer retention in the event of security incidents or disputes;
- Data processed on the basis of consent (e.g. newsletter): until consent is withdrawn.
At the end of the periods indicated, data is deleted or irreversibly anonymised.
8. Nature of the provision of data
Providing the data marked as mandatory in the forms (in particular name and e-mail address) is necessary to act on your request: failure to provide it makes it impossible to reply or to provide the service. Providing the other data is optional and only serves to make the assessment more accurate.
9. Your rights
Within the limits and under the conditions set out in Arts. 15–22 GDPR, you have the right to:
- obtain access to your personal data and a copy of it;
- obtain the rectification of inaccurate data and the completion of incomplete data;
- obtain the erasure of data («right to be forgotten») in the cases provided for;
- obtain the restriction of processing;
- receive your data in a structured, commonly used, machine-readable format and obtain its portability to another controller;
- object at any time, on grounds relating to your particular situation, to processing based on legitimate interest;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Rights may be exercised by writing to info@saveyouripod.com. The controller responds within one month, extendable by two months in particularly complex cases.
10. Complaint to a supervisory authority
If you consider that the processing of your data infringes the GDPR, you may lodge a complaint with the competent supervisory authority. In the Netherlands: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). In Italy: Garante per la protezione dei dati personali (www.garanteprivacy.it). This is without prejudice to your right to a judicial remedy.
11. Data relating to minors
The services are not directed at children under 16. The controller does not knowingly collect data of minors without the consent of the holder of parental responsibility. If it becomes aware of processing carried out in such circumstances, the data will be deleted.
12. Automated decision-making
The price estimate shown by the configurator is a simple indicative calculation based on the options chosen and does not produce legal effects or similarly significantly affect the data subject within the meaning of Art. 22 GDPR. The final quote is always prepared and confirmed by a person.
13. Cookies and similar technologies
The site uses only technical cookies and tools necessary for its operation, for which prior consent is not required:
- session and security cookies generated by the platform;
- cookies storing the selected language (multilingual site);
- caching cookies and mechanisms to improve page performance.
No profiling or marketing cookies are used, nor any third-party statistical analytics. Should any be introduced in the future, this policy will be updated and consent will be requested, where necessary, via a dedicated banner. You can in any case manage or delete cookies from your browser settings.
14. Changes to this policy
The controller may amend or update this policy, including as a result of changes in law or in the services offered. The updated version is published on this page with the date of last update; in the event of material changes, data subjects will be informed where appropriate.