Privacy Policy

1. Data Controller

• Controller: Astropark Trading Services
• Privacy contact: astroparktrading@gmail.com
• Data Protection Officer: not appointed — Astropark does not meet the criteria of Art. 37 GDPR (the core activities do not consist of large-scale regular monitoring nor of processing of special-category data on a large scale). The Controller acts as the privacy contact.

2. Categories of personal data collected

2.1 — Data you provide directly

• Account data: email address, username, full name, password (stored as bcrypt hash) — collected at registration.
• Optional profile data: TradingView handle, Telegram user_id — voluntary.
• Order data: what you bought, when, for how much, payment method, billing address (if provided for invoice).
• Support correspondence: content of emails, contact-form submissions, Telegram bot messages.
• Newsletter consent record: timestamp, IP, double-opt-in confirmation token.

2.2 — Data we collect automatically

• Server access logs: IP, user-agent, request paths, response codes, timestamp — for security, abuse prevention, debugging.
• Authentication tokens: JWT session cookie, CSRF token, refresh token.
• Cart state: localStorage entry with current cart.
• Cookie consent state: localStorage entry recording your choices.
• Analytics events (only if you consent): aggregated page-view counts, anonymized clickstream — Google Analytics 4.

2.3 — Data we do NOT collect or store

• Payment card data: handled entirely by Stripe and PayPal (PCI-DSS Level 1 certified). We receive only a tokenized reference and the last 4 digits.
• Sensitive data (special categories ex Art. 9 GDPR — health, political opinions, etc.): we have no use case and do not collect them.
• Children's data: the site is 18+ and we do not knowingly collect data of minors.

3. Purposes of processing and legal bases (Art. 6 GDPR)

• Account creation and authentication — Contract (Art. 6.1.b); data: email, password hash, username; retention: until account deletion + 1 month grace.
• Processing orders and delivering products — Contract (Art. 6.1.b); data: order data, TradingView handle (if provided); retention: 10 years (tax law — DPR 600/1973).
• Issuing invoices, tax/accounting record-keeping — Legal obligation (Art. 6.1.c); retention: 10 years (DPR 600/1973, art. 22).
• Sending transactional emails — Contract (Art. 6.1.b); retention: while account is active + 3 years.
• Newsletter (only if you opt in) — Consent (Art. 6.1.a); retention: until you unsubscribe.
• Site analytics (Google Analytics 4 — only if you consent) — Consent (Art. 6.1.a; Art. 122 d.lgs. 196/2003); retention: 13 months.
• Security, log retention, abuse prevention — Legitimate interest (Art. 6.1.f); retention: 90 days (logs); longer for security incidents.
• Replying to support requests — Pre-contractual measures / Contract (Art. 6.1.b) or Legitimate interest if you are not yet a customer (Art. 6.1.f); retention: 3 years from last contact.
• Defending Astropark in legal proceedings — Legitimate interest (Art. 6.1.f); retention: until limitation period expires.

We perform a legitimate-interest balancing test for each Art. 6.1.f case; the balancing record is available on request to astroparktrading@gmail.com.

We do not carry out automated decision-making or profiling with legal/significant effects on you (Art. 22 GDPR).

4. Recipients (third-party processors)

We share personal data only with the recipients listed below, each acting as a data processor under Art. 28 GDPR with a Data Processing Agreement in place.

• Stripe Inc. + Stripe Payments Europe Ltd. — payment service provider — IE (EU) + USA — EU-US Data Privacy Framework (DPF) + SCCs — stripe.com/privacy.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment service provider — LU (EU) — SCCs — paypal.com/privacy.
• Google Ireland Ltd. (Google Analytics 4) — web analytics — IE (EU) + USA — EU-US DPF.
• Telegram FZ-LLC — messaging platform (bot) — UAE — SCCs + Transfer Impact Assessment + your explicit consent (Art. 49.1.a GDPR).
• Hosting / VPS provider — infrastructure — [DE — Germany] (to be confirmed) — DPA in place.
• Email service provider — transactional + marketing email delivery (to be confirmed) — DPF / SCCs.
• Sentry.io (when active) — application error monitoring — USA — DPF.

Public authorities may receive data when we are legally compelled to disclose it (e.g. court order, tax inspection). We do not sell personal data and do not share it for third-party advertising.

5. International data transfers

Where data is transferred outside the European Economic Area, we rely on:

• Adequacy decisions of the European Commission (e.g. UK, Switzerland);
• the EU-US Data Privacy Framework (Commission Decision (EU) 2023/1795) for US providers certified under the DPF;
• Standard Contractual Clauses (Decision (EU) 2021/914) for transfers without an adequacy decision, accompanied by a Transfer Impact Assessment and supplementary measures (encryption, pseudonymization).

You may request a copy of the relevant safeguard from astroparktrading@gmail.com.

6. Retention periods

• Order data: 10 years from invoice date (Italian tax law).
• Account data: until account closure + 1 month grace period.
• Server logs: 90 days, except for security incidents.
• Newsletter data: until you unsubscribe; unsubscribe record kept indefinitely to honor your opt-out.
• Withdrawal of consent: does not affect lawfulness of prior processing.

7. Your rights (GDPR Articles 15–22)

• Access (Art. 15) — obtain confirmation and a copy of your data.
• Rectification (Art. 16) — correct inaccurate data.
• Erasure / right to be forgotten (Art. 17) — subject to legal retention obligations.
• Restriction (Art. 18) — limit how we use the data.
• Portability (Art. 20) — receive your data in a structured, machine-readable format.
• Objection (Art. 21) — object to processing based on legitimate interest, including for direct marketing.
• Withdraw consent at any time — for processing based on consent.
• Not be subject to automated decision-making (Art. 22) — we do not perform any.
• Lodge a complaint with the supervisory authority. The Italian authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.gpdp.it.

To exercise any of these rights, write to astroparktrading@gmail.com. We will respond within 30 days (extendable by 60 days for complex requests, with prior notice).

8. Security measures (Art. 32 GDPR)

• TLS 1.3 encryption for all traffic between your browser and our servers;
• bcrypt password hashing (no plaintext or reversible storage);
• access control and least-privilege principle for staff;
• audit logs for sensitive operations;
• regular dependency scanning and security patching;
• incident response plan with notification to the Garante within 72 hours where required (Art. 33 GDPR).

9. Cookies and tracking technologies

See the dedicated Cookie Policy for the complete list, purpose, and opt-out controls. The cookie banner allows granular consent and can be reopened at any time via the "Cookie preferences" link in the footer.

10. Newsletter

The newsletter is opt-in only with double opt-in. You may unsubscribe at any time using the one-click unsubscribe link in every newsletter email, or by writing to astroparktrading@gmail.com. We process newsletter data on the basis of your consent (Art. 6.1.a GDPR).

11. Telegram bot — additional information

If you connect your Astropark account to our Telegram support bot, we additionally process your Telegram user_id and any messages you send.

• Legal basis: your explicit consent (Art. 6.1.a GDPR) given via /agree at /start.
• Cross-border transfer: Telegram FZ-LLC is based in the UAE; we rely on Art. 49.1.a GDPR (your explicit consent) plus SCCs in our DPA with Telegram.
• Retention: bot conversation history kept for 90 days, then anonymized.
• Withdrawal: send /stop to the bot or write to astroparktrading@gmail.com.

12. Children

The site is intended for users 18 years and older. We do not knowingly collect data from minors. If you become aware that a minor has provided data to Astropark, please notify us at astroparktrading@gmail.com and we will delete it promptly.

13. Updates to this policy

We update the "Last updated" date at the top and notify registered users by email of material changes at least 15 days before they take effect.