Effective date: October 9, 2026
This Privacy Policy explains how personal data is processed when people visit or use https://www.vroomkart.pt, create an account, subscribe to communications, submit forms, interact with content or use services made available through the website.
1. Controller and contact details
The data controller is OKKART srl, Via Pergolesi 48, 04011 Aprilia (LT), Italy — VAT IT02629390598, REA LT-186893. Privacy requests can be sent to info@vroom.it.
2. Data we process
- Technical and usage data: IP address, request time, requested resource, device, browser, operating system, referral information, security logs and interactions with pages or media.
- Account and profile data: identifiers, contact details, credentials and information supplied when an account or subscription is created.
- Contact and editorial data: information included in contact forms, messages, comments, submissions or material sent to the editorial team.
- Newsletter data: email address, subscription preferences and delivery or interaction events where newsletter features are used.
- Transaction data: order, billing and payment-related information where paid services or products are offered. Payment providers process card or account details under their own terms; the website does not need to retain complete card credentials.
- Consent data: CookieYes consent choices, timestamp, consent identifier and a masked IP address used to document the choice.
3. Purposes and legal bases
- Providing the website, accounts, requested content and services: performance of a contract or steps requested before entering a contract.
- Replying to enquiries and managing editorial or commercial relationships: pre-contractual measures and the controller's legitimate interest in handling communications.
- Sending newsletters or promotional communications: consent, where required. Consent can be withdrawn using the unsubscribe link or by contacting us.
- Security, fraud prevention, troubleshooting and service protection: the controller's legitimate interest in maintaining a secure and reliable service.
- Accounting, tax, legal claims and regulatory compliance: compliance with legal obligations and establishment, exercise or defence of legal claims.
- Audience measurement, embedded third-party content and personalised advertising: consent where required by data-protection or electronic-communications law.
4. Cookies, analytics, advertising and embedded content
The website uses CookieYes to collect and record consent choices. Depending on the visitor's choices, services such as Google Analytics, Google advertising products, YouTube and other embedded or social services may process device and usage data. Details of the currently detected cookies, their purposes and durations are provided in the Cookie Policy.
5. Recipients
Personal data may be accessed by authorised staff and by providers supporting hosting, security, maintenance, email delivery, CRM, newsletters, analytics, advertising, embedded media and payment processing. Providers act as processors or independent controllers according to the service and applicable law. Data may also be disclosed when required by law or to protect legal rights.
6. International transfers
Some providers may process data outside the European Economic Area. Where required, transfers are based on an adequacy decision, approved contractual safeguards such as the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism. Information about the safeguards relevant to a particular provider can be requested from the controller.
7. Retention
Data is kept only for as long as necessary for the purpose for which it was collected and for any applicable legal, accounting, security or dispute-resolution period. Account data is normally kept while the account is active; enquiries for the time needed to answer and manage follow-up; newsletter data until withdrawal or confirmed inactivity; transaction records for statutory accounting periods; and consent evidence for the period necessary to demonstrate compliance. Backup copies are deleted or overwritten according to the applicable backup cycle.
8. Rights
Subject to the conditions in the GDPR, data subjects may request access, rectification, erasure, restriction, portability or object to processing, and may withdraw consent at any time without affecting earlier lawful processing. Requests can be sent to info@vroom.it. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali, or with another competent supervisory authority.
9. Mandatory information and automated decisions
Fields marked as required are necessary to provide the requested function or service. If they are not supplied, the request may not be completed. Unless expressly stated for a specific service, the controller does not make decisions producing legal or similarly significant effects based solely on automated processing.
10. Security and changes
Reasonable technical and organisational measures are used to protect personal data. No internet service can guarantee absolute security. This policy may be updated when processing activities, providers or applicable law change; the effective date above identifies the current version.