Privacy Policy

Last updated: October 9, 2026

This Privacy Policy describes how Exellious (the "Site") collects, uses, stores, and discloses personal data when you visit https://exellious.com, create an account, use our Virtual Try-On features, contact us, subscribe to our newsletter, or purchase products through the Site.

Exellious is operated by Volturia S.r.l. This Policy explains our data-processing practices in accordance with the General Data Protection Regulation (GDPR), applicable Italian data-protection legislation, and other applicable privacy laws.

1. Data Controller and Business Structure

The data controller responsible for the processing described in this Policy is:

Volturia S.r.l.
Registered office: Via Enrico Toti 112, 00030 San Cesareo (RM), Italy
VAT number: 18252951001
Email: support@exellious.com

Exellious is the name of the ecommerce website operated by Volturia S.r.l. and is not a separate legal entity.

Volturia provides and operates the technology infrastructure supporting Exellious, including the ecommerce website, customer accounts, brand dashboard, and Virtual Try-On functionality.

For purchases in which Volturia S.r.l., trading through Exellious, is identified as the seller in the applicable order confirmation and invoice, Volturia S.r.l. is responsible for administering the sale and the associated customer relationship, subject to the applicable Terms of Service.

Redi S.r.l. is Volturia's commercial partner and participates in the commercial management of the Exellious project. Redi may receive relevant personal data for commercial coordination, order management, and other activities associated with its role.

Independent fashion brands participate in the marketplace as brand partners and product suppliers. They may receive the customer and order information necessary to prepare, dispatch, or otherwise fulfil orders. Where a brand independently determines the purposes and means of particular processing activities, it is responsible for those activities in accordance with applicable law.

The precise data-protection roles of Volturia, Redi, and individual brand partners depend on the processing activity concerned. Where applicable, the parties will put in place appropriate data-processing or joint-controller arrangements.

2. Personal Data We Collect

2.1 Account and Identity Information

When you register for an account or use account-based services, we may collect:

• Name and surname.
• Email address and telephone number, where provided.
• Account identifiers and authentication information.
• Login credentials, stored using appropriate security measures.
• Account preferences, settings, and information you choose to provide.

This information is used to create and maintain your account, provide account-related services, communicate with you, and protect the security of the Site.

You may also place orders without creating an account.

2.2 Order and Transaction Information

When you purchase products through Exellious, we may collect:

• Customer name and contact information.
• Billing and shipping addresses.
• Products purchased, sizes, quantities, prices, and order references.
• Order, delivery, return, and refund status.
• Transaction identifiers and payment confirmation information.
• Information necessary to manage customer service requests, disputes, and legal obligations.

Payment methods available at checkout may include Stripe, PayPal, Google Pay, and other payment options enabled on the Site.

Payment credentials are processed through the relevant payment provider or payment integration. Depending on the method used, Volturia may receive payment tokens, transaction references, payment status, and other information necessary to administer the transaction. The exact information processed depends on the payment method and its integration.

2.3 Virtual Try-On and Body Measurement Information

When you use the Virtual Try-On ("VTO") functionality, we may collect and retain clothing-size preferences and body measurements that you provide, save, or generate through the available fitting features.

Where these measurements are saved to your customer account, they are associated with that account.

We use this information to provide virtual fitting functionality, support garment-size selection, personalise fitting features, and improve the usability of the service.

Our current VTO functionality does not require users to upload photographs. We do not currently collect user-uploaded photographs for the purposes of the VTO service described in this Policy.

Saved body measurements are not routinely shared with Redi or brand partners. They may be disclosed only where necessary for a specific feature you request or where another lawful basis applies, with appropriate information provided to you.

You may request deletion of your saved VTO measurements through your account, where that functionality is available, or by contacting support@exellious.com. Deletion may be subject to applicable legal obligations and limited technical backup-retention periods.

2.4 Device and Technical Information

When you visit the Site, we and our technical service providers may automatically collect certain technical information, including:

• IP address.
• Browser type and version.
• Operating system and device information.
• Access dates and timestamps.
• Session identifiers and technical logs.
• Pages and products viewed, searches performed, and interactions with Site features.
• Information generated by cookies and similar technologies, where enabled.

We use this information to deliver the Site, maintain security, diagnose technical problems, prevent abuse, and understand how the service is used, subject to applicable consent requirements.

2.5 Customer Support Information

When you contact us through email, contact forms, or customer support channels, we may collect your name, email address, telephone number, order reference, and the contents of your communication.

If live chat is implemented, the information processed through that service will also be covered by this Policy and any applicable supplementary notices.

2.6 Newsletter and Marketing Information

If you subscribe to our newsletter or consent to receive promotional communications, we may collect your email address, subscription status, marketing preferences, and records necessary to document and manage your consent.

We may also retain limited information necessary to respect an unsubscribe request and prevent further unwanted marketing communications.

2.7 Information Received from Third Parties

We may receive relevant transaction or delivery information from payment providers, Redi, brand partners, and shipping providers, including payment status, order updates, shipment tracking, and return information.

We use such information only for the relevant operational, contractual, security, or legal purposes described in this Policy.

3. Purposes and Legal Bases for Processing

We process personal data only where an applicable legal basis permits us to do so.

Depending on the circumstances, we may process personal data for the following purposes:

Providing the Site and customer accounts. We process account and authentication information to register users, maintain accounts, provide requested features, and protect account security. The legal basis is the performance of a contract or taking steps requested before entering into a contract, where applicable.

Providing Virtual Try-On functionality. We process saved size preferences and body measurements to provide the fitting features requested by users. The legal basis is the performance of the relevant service contract and, where applicable, consent for optional processing.

Processing orders and payments. We process order details, contact information, addresses, and transaction information to administer purchases, coordinate product fulfilment, arrange shipping, handle returns and refunds, and provide customer support. The legal basis is the performance of a contract and compliance with applicable legal obligations.

Commercial and operational coordination. We may process relevant order information with Redi and the appropriate brand or fulfilment partners to coordinate commercial operations and order delivery. The legal basis depends on the specific activity and may include contract performance, legal obligations, or legitimate interests.

Customer support. We use contact and order information to answer enquiries, resolve complaints, and manage requests. The legal basis is the performance of a contract, taking steps requested before entering into a contract, compliance with legal obligations, or legitimate interests, as applicable.

Accounting, taxation, and legal compliance. We process and retain relevant business and transaction records to comply with accounting, tax, consumer-protection, and other applicable laws. The legal basis is compliance with legal obligations.

Security and fraud prevention. We use relevant technical, account, and transaction information to protect the Site, investigate suspicious activity, prevent fraud, and defend legal claims. The legal basis may be compliance with legal obligations or our legitimate interests, provided those interests do not override your rights and freedoms.

Newsletter and direct marketing. We send promotional communications where we have obtained consent or where another legal basis is expressly permitted by applicable law. Where consent is the legal basis, it may be withdrawn at any time.

Analytics and advertising. Where implemented, we may use analytics and advertising technologies to measure the performance of the Site, understand how visitors interact with it, and measure or deliver advertising. Where required by applicable law, these activities rely on your prior consent.

We do not use personal data for purposes incompatible with those described in this Policy without providing further information and obtaining consent where required.

4. How We Share Personal Data

We may share personal data with the following categories of recipients where necessary for the purposes described in this Policy.

4.1 Redi S.r.l.

Redi S.r.l. is our commercial partner and may receive relevant customer and order information for commercial coordination, order administration, fulfilment coordination, customer-related operations, and other activities associated with its role in the Exellious project.

The information shared is limited to what is necessary for the relevant activity.

Redi's data-protection role depends on the processing involved. Where Redi determines its own purposes and means of processing, it is responsible for that processing as an independent controller. Where it processes personal data solely on Volturia's documented instructions, the parties must establish the appropriate data-processing arrangements.

4.2 Brand Partners and Product Suppliers

The brand partner or supplier associated with an order may receive the information necessary to prepare, dispatch, and fulfil that order.

This may include the customer's name, shipping address, contact details, order reference, products purchased, selected sizes, and delivery information.

Brand partners may also process relevant information to meet their own legal obligations or manage independent business activities. Where a brand processes personal data as an independent controller, its own privacy information and legal obligations may apply.

Your saved account credentials and VTO body measurements are not routinely shared with brand partners.

4.3 Shipping and Fulfilment Providers

Shipping carriers, fulfilment providers, and logistics partners selected for an order may receive the delivery information necessary to transport and deliver the products and provide shipment updates.

The specific providers may vary according to the product, brand, destination, and fulfilment arrangements.

4.4 Hosting and Technical Service Providers

Exellious uses a custom ecommerce architecture and may share personal data with service providers responsible for hosting, infrastructure, storage, security, and application delivery.

Our current infrastructure includes:

• Vercel: frontend hosting and delivery.
• Railway: backend application hosting and related infrastructure, including databases and VTO or brand-dashboard services hosted on that infrastructure.
• Cloudflare R2: storage of files and images.

These providers may process personal data and technical information as necessary to deliver, secure, and maintain the relevant services.

4.5 Payment Providers

Payments are handled through the relevant payment providers and integrations available at checkout, which may include Stripe, PayPal, and Google Pay.

Payment providers may process personal data to authorise payments, prevent fraud, administer transactions and refunds, comply with financial regulations, and provide their services. Depending on the processing activity, a payment provider may act as an independent controller or a processor.

The privacy policies of the applicable providers govern their own processing activities.

4.6 Email and Customer Communication Providers

We may use external providers to deliver transactional messages, account-related emails, order confirmations, newsletter communications, and customer support messages.

These providers may process contact information and message-related data as necessary to deliver their services. Their identity will depend on the services actually deployed.

4.7 Analytics and Advertising Providers

If enabled, we may use services such as Google Analytics and Meta advertising technologies, including Meta Pixel, to understand Site usage, measure advertising effectiveness, and deliver or measure advertising campaigns.

These technologies will be implemented subject to applicable privacy and consent requirements. Where prior consent is required, they will not be activated before valid consent has been obtained.

The providers and technologies actually deployed will be identified in the applicable Cookie Policy and cookie-consent settings.

4.8 Legal, Regulatory, and Business Disclosures

We may disclose personal data where reasonably necessary to comply with applicable law, respond to lawful requests from competent authorities, establish or defend legal claims, protect the rights and safety of users, or prevent fraud and other unlawful activity.

Where required, we may also disclose relevant information in connection with a corporate transaction, restructuring, or transfer of business assets, subject to appropriate safeguards.

5. International Data Transfers

Volturia S.r.l. is established in Italy. Depending on the service provider, payment method, brand partner, shipping arrangement, or destination country, personal data may be processed or transferred outside the European Economic Area (EEA).

Our international sales may involve customers in the United Kingdom, the United States, Mexico, and other countries.

Where a transfer is subject to restrictions under applicable data-protection law, we will rely on an appropriate legal transfer mechanism, such as an applicable adequacy decision or the relevant standard contractual clauses, together with supplementary measures where required.

Information concerning the safeguards applicable to a particular transfer may be requested by contacting support@exellious.com.

6. Cookies and Similar Technologies

The Site may use cookies, pixels, tags, local storage, and similar technologies to support its functionality and, where enabled, measure usage or advertising performance.

These technologies may fall into the following categories:

Strictly necessary technologies. Required for essential functionality such as security, authentication, shopping-cart operation, checkout, and remembering privacy choices.

Preference and functionality technologies. Used to remember user choices and provide requested features.

Analytics technologies. Used to measure website traffic, understand user interactions, and evaluate Site performance.

Advertising technologies. Used to measure advertising, create or manage audiences, and support targeted advertising across services or websites.

Strictly necessary technologies may operate without consent where permitted by applicable law. Non-essential cookies and similar technologies will be used only after valid consent where required.

You may withdraw or modify your consent through the Site's cookie-preference mechanism once available.

A separate Cookie Policy or cookie-information interface will identify the technologies actually deployed, their purposes, providers, and applicable retention periods.

7. Marketing Communications

We may send transactional communications necessary to administer accounts, purchases, delivery, returns, refunds, security, and customer support.

We send newsletters and other promotional communications where we have obtained the required consent or where another legal basis is permitted by applicable law.

You may unsubscribe at any time by using the unsubscribe link in a marketing email or by contacting support@exellious.com.

Withdrawing consent or unsubscribing from marketing does not prevent us from sending essential communications concerning your account, orders, or legal obligations.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, subject to applicable legal obligations and limitation periods.

Retention periods depend on the category of data and the relevant purpose:

• Account information: retained while the account remains active and deleted or anonymised following account closure, subject to legal obligations and justified retention needs.
• VTO measurements and preferences: retained while needed to provide account-based fitting features and deleted following a valid deletion request or account closure, subject to applicable obligations and limited backup-retention periods.
• Order and transaction records: retained for the time necessary to administer purchases, returns, refunds, disputes, and related legal obligations.
• Accounting and tax records: retained for the applicable statutory period, generally ten years under Italian law where that period is required for the relevant accounting documents.
• Customer support communications: retained for the time needed to resolve the relevant request and, where appropriate, establish, exercise, or defend legal claims.
• Newsletter information: retained until consent is withdrawn or the subscription ends, except for limited records necessary to document consent or respect an unsubscribe request.
• Technical logs and security data: retained for a limited period appropriate to the relevant security and operational purposes.

Personal data may be retained for longer where required by law or necessary to establish, exercise, or defend legal claims. Where retention is no longer necessary, data will be deleted or anonymised in accordance with our retention procedures.

9. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction.

These measures may include access controls, authentication, security monitoring, restricted access to production systems, and appropriate safeguards applied to service providers and stored information.

Access to personal data should be limited to authorised personnel and service providers who require it for their assigned functions.

No method of transmission over the Internet or electronic storage can guarantee absolute security. We apply measures appropriate to the nature of the data and the risks associated with the processing.

10. Your Rights Under the GDPR

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction providing similar rights, you may have the following rights, subject to applicable legal conditions:

• Right of access: request confirmation of whether we process your personal data and obtain a copy.
• Right to rectification: request correction of inaccurate or incomplete information.
• Right to erasure: request deletion of personal data where the applicable conditions are met.
• Right to restriction: request restriction of certain processing activities.
• Right to data portability: receive certain data in a structured, commonly used, machine-readable format and, where technically feasible and legally applicable, request its transfer to another controller.
• Right to object: object to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing.
• Right to withdraw consent: withdraw consent at any time where processing is based on consent.
• Rights concerning automated decision-making: where applicable, request the protections provided by law in relation to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise these rights, contact support@exellious.com.

We may request information reasonably necessary to verify your identity before responding. We will respond within the time limits prescribed by applicable law. Under the GDPR, the ordinary response period is one month, subject to permitted extensions.

You may also lodge a complaint with a competent data-protection supervisory authority. In Italy, the supervisory authority is the Garante per la protezione dei dati personali.

11. California Privacy Rights

This section applies to California residents to the extent that the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), applies to Volturia S.r.l.

Depending on the law's applicability and the circumstances, California residents may have rights to:

• Know the categories and specific pieces of personal information collected about them.
• Request access to, correction of, or deletion of personal information.
• Receive information about the categories of personal information collected, the purposes of collection, and the categories of recipients.
• Opt out of the sale or sharing of personal information, where applicable.
• Limit certain uses and disclosures of sensitive personal information, where applicable.
• Receive equal service and pricing when exercising applicable privacy rights.

The categories of personal information we may collect include identifiers and contact details, account information, commercial and transaction information, internet or electronic network activity, technical information, customer communications, and size preferences or body measurements associated with VTO functionality.

We collect this information directly from users, automatically through interactions with the Site, and from relevant payment, brand, shipping, and technical service providers.

We use and disclose these categories for account management, order processing, fulfilment, customer support, website operation, security, legal compliance, and, where enabled and legally permitted, analytics and advertising.

Volturia does not sell personal information in exchange for monetary consideration. However, where third-party advertising technologies are used to disclose information for cross-context behavioural advertising, those disclosures may constitute "sharing" under California law.

Where the CCPA/CPRA applies, users may exercise their applicable rights by contacting support@exellious.com. Where required, the Site will provide an appropriate mechanism to opt out of the sale or sharing of personal information and will honour valid opt-out preference signals.

We will not unlawfully discriminate against users for exercising their applicable privacy rights.

12. Minors

The Site is not specifically directed at children, and users should comply with the age and contractual-capacity requirements applicable in their country of residence.

Where applicable law requires parental or guardian authorisation for the processing of a minor's personal data, we will apply the relevant requirements.

If you believe that a minor has provided personal data in circumstances that are inconsistent with applicable law, please contact support@exellious.com so that we can assess the request and take appropriate action.

13. Automated Processing

We use technical systems to operate the Site, provide VTO functionality, process transactions, and maintain security.

Volturia does not currently intend to make decisions based solely on automated processing of personal data that produce legal effects or similarly significant effects on users.

Payment providers and other third parties may independently use automated systems for fraud prevention, security, or compliance. Their own privacy notices govern those activities.

If our use of automated decision-making changes in a way that requires additional information or safeguards, we will provide the information required by applicable law.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our services, technical infrastructure, commercial arrangements, data-processing practices, or applicable legal requirements.

The updated version will be published on this page together with the revised "Last updated" date.

Where required by law, we will provide additional notice of material changes.

15. Contact

For questions about this Privacy Policy, our data-processing practices, or requests relating to your personal data, please contact:

Volturia S.r.l.
Trading as Exellious
Via Enrico Toti 112, 00030 San Cesareo (RM), Italy
VAT number: 18252951001
Email: support@exellious.com