This Application collects certain Personal Data from its Users.
This document can be printed using the print command available in any browser’s settings.
Via Borgovalle, snc, 06023 Gualdo Tadino (PG), Italy
Italian Tax Code/VAT Number: 03863110544
Phone: +39 331 786 1266
Data Controller’s email address: [email protected]
Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically when using this Application.
Unless otherwise specified, all Data requested by this Application is mandatory. If the User refuses to provide it, this Application may be unable to provide the Service. Where this Application indicates that certain Data is optional, Users may choose not to provide it without affecting the availability or operation of the Service.
Users who are unsure which Data is mandatory are encouraged to contact the Data Controller.
Any use of Cookies or other tracking technologies by this Application or by the owners of third-party services used by this Application is intended to provide the Service requested by the User, as well as for the other purposes described in this document and the Cookie Policy.
The User is responsible for any third-party Personal Data obtained, published or shared through this Application.
Methods and place of processing of collected Data:The Data Controller adopts appropriate security measures to prevent unauthorized access, disclosure, modification or destruction of Personal Data.
Processing is carried out using IT and/or electronic tools, with organizational methods and procedures strictly related to the stated purposes. In addition to the Data Controller, in some cases Data may be accessible to persons involved in the operation of this Application (administrative, sales, marketing and legal staff, system administrators) or external parties (such as third-party technical service providers, postal carriers, hosting providers, IT companies and communications agencies), who may also be appointed as Data Processors by the Controller where necessary. An updated list of Data Processors may be requested from the Controller at any time.
Data is processed at the Data Controller’s operating offices and in any other location where the parties involved in processing are situated. For further information, please contact the Data Controller.
The User’s Personal Data may be transferred to a country other than the one in which the User is located. For more information about processing locations, Users may refer to the section detailing the processing of Personal Data.
Unless otherwise specified in this document, Personal Data is processed and stored for as long as required for the purpose for which it was collected and may be retained for longer where required by legal obligations or on the basis of the User’s consent.
The User’s Data is collected to enable the Controller to provide the Service, comply with legal obligations, respond to requests or enforcement actions, protect its rights and interests (or those of Users or third parties), detect malicious or fraudulent activity, and for the following purposes:
For detailed information on the purposes of processing and the Personal Data processed for each purpose, Users may refer to the section “Details on the Processing of Personal Data”.
This Application may request certain Facebook permissions that allow it to perform actions using the User’s Facebook account and collect information, including Personal Data, from that account. This service allows this Application to connect with the User’s account on the Facebook social network, provided by Facebook Inc.
For more information on the following permissions, please refer to the Facebook permissions documentation and Facebook’s Privacy Policy.
The permissions requested are:
Basic information about a User registered on Facebook, usually including the following Data: ID, name, picture, gender and language/locale and, in some cases, Facebook “Friends”. If the User has made other Data public, that Data will also be available.
Provides access to the User’s primary email address.
A Tracker means any technology — for example, Cookies, unique identifiers, web beacons, embedded scripts, e-tags and fingerprinting — that enables the tracking of Users, such as by collecting or storing information on the User’s device.
Personal Data is collected for the following purposes and through the following services:
These services allow this Application to retrieve Data from the User’s accounts on third-party services and perform actions using those accounts.
These services are not activated automatically and require the User’s express authorization.
This service allows this Application to connect with the User’s account on the Facebook social network, provided by Meta Platforms, Inc.
Permissions requested: Usage Data; Email; device information; Trackers.
Place of processing: United States – Privacy Policy – Opt out.
By filling in the contact form with their Data, the User agrees to the use of such Data to respond to requests for information, quotations or any other requests indicated by the form’s heading.
Personal Data processed: Usage Data; email address.
By subscribing to the mailing list or newsletter, the User’s email address is added to a list to receive informational and commercial communications relating to this Application. The Data Controller may also manually import contacts into Brevo, subject to the applicable legal requirements. Making a purchase or submitting a contact form does not, in itself, constitute consent to receive promotional communications.
Personal Data processed: Usage Data; email address; Trackers.
Brevo is the platform used to send newsletters and promotional messages. Email addresses are collected through a website subscription form and may also be added by manually importing contacts from customers or people who have requested information. Marketing emails are sent where valid consent has been obtained or, only where all legal conditions are satisfied, under the exception for similar products or services previously purchased. Merely requesting information or completing a purchase does not automatically constitute marketing consent.
Personal Data processed: email address; where applicable, first and last name and other data voluntarily entered in forms or transmitted to the service; subscription preferences; evidence and date of consent where recorded; information about email sending and delivery, unsubscribes and, where monitoring is enabled, opens, clicks and other interaction data.
Purposes: subscription management, sending and administering campaigns, managing objections and unsubscribes, and measuring the effectiveness of communications within the limits permitted by law.
Legal basis: promotional communications sent through Brevo are based on the data subject’s consent, except where the specific conditions set out in Article 130(4) of the Italian Privacy Code for promoting products or services similar to those previously purchased apply. Subscriptions through forms and manual contact imports require a valid legal basis. Simply requesting information does not automatically authorize the sending of newsletters.
Place of processing: according to Brevo, its main databases are stored in the European Union (France, Germany and Belgium); any other processing and transfers must be assessed in light of the provider’s privacy notice and Data Processing Agreement (DPA).
Retention: newsletter recipients’ Data is retained for as long as necessary for commercial communication purposes, provided a valid legal basis exists, with periodic review of the relevance and necessity of retention. The Data Controller has identified an indicative 24-month interval as its operational review criterion; implementation of the relevant procedure is ongoing. Following an unsubscribe, promotional messages are stopped, without prejudice to the retention of Data strictly necessary to honor the objection and demonstrate legal compliance. No general automatic deletion of Brevo contacts is currently enabled.
Manually imported contacts come from customers and people who requested information, after verifying that sending the communications is lawful. The platform is configured to track email opens and clicks; such processing must comply with the applicable rules on tracking.
Rights: every promotional communication must provide an easy way to unsubscribe; Users may also contact the Data Controller.
Provider’s Privacy Policy: https://www.brevo.com/legal/privacypolicy/
The main components of this Application are created and managed directly by the Data Controller using the software listed below.
This Application is developed and managed by the Data Controller using the WordPress Content Management System (CMS).
Personal Data processed: date of birth; Usage Data.
The website and hosting services are managed by Fleanet Informatica. In providing the service, the provider may process IP addresses, technical logs and data hosted on the website or in its databases, including customer and order data, within the scope of the services supplied. For information on the location of the origin infrastructure, any subcontractors and the retention periods for backups and logs, Users may contact the Data Controller, who will request this information from the hosting provider.
WooCommerce is the WordPress e-commerce component used to manage the shopping cart, checkout, orders, customer accounts, purchase confirmations and activities relating to payment, delivery, support and accounting obligations. Data necessary for sales transactions is processed for performance of the contract and compliance with legal obligations, without requiring marketing consent.
Personal Data processed: first name, last name, email address, phone number, billing and shipping addresses, order and purchased-product information, any User account, technical information and Usage Data necessary for cart and session functionality; payment results and references supplied by external providers, without implying that the store stores complete payment-card details.
Purposes: concluding and fulfilling purchases, shipping, administrative and accounting management, customer support, fraud prevention and service security.
Legal bases: performance of a contract, compliance with legal obligations and, where appropriate, the Data Controller’s legitimate interest in security and protecting its rights.
Retention: order data and accounting and tax documents are kept for as long as necessary to manage the relationship and comply with applicable obligations, generally up to 10 years for accounting documentation, without prejudice to longer justified periods. For failed, pending or cancelled orders, where no technical deletion period has yet been configured, retention is reviewed in accordance with necessity and proportionality. A measure to be implemented has been identified to reduce retention to 30 days for failed or pending orders and 90 days for cancelled orders, unless further retention is necessary.
Unless otherwise specified, this Application processes payments made by credit card, bank transfer or other means through external payment service providers. In general, and unless otherwise stated, Users are asked to provide payment details and Personal Data directly to those providers.
This Application does not collect or process those details itself; instead, it receives a notification from the relevant payment service provider that the payment has been completed.
Google Pay is a payment service provided by Google Ireland Limited that allows Users to make online payments using their Google credentials.
Personal Data processed: last name; Usage Data; email address; payment information; first name; Trackers.
Place of processing: Ireland – Privacy Policy.
Stripe is a payment service provided by Stripe Inc.
Personal Data processed: last name; Usage Data; email address; first name; Trackers.
Place of processing: United States – Privacy Policy.
PayPal is a payment service provided by PayPal Inc. that allows Users to make online payments.
Personal Data processed: Usage Data; email address; payment information; Trackers.
Place of processing: See PayPal’s Privacy Policy – Privacy Policy.
These services allow the Data Controller to centrally manage the tags or scripts required on this Application. As a result, User Data may be processed and potentially stored by these services.
Google Tag Manager is a tag management service provided by Google LLC. For information about Google’s use of Data, please refer to its partner policy and Business Data page.
Personal Data processed: Usage Data; Trackers.
Place of processing: United States – Privacy Policy.
Support and contact request management:These services allow Users to interact with third-party live chat platforms directly from pages of this Application, so they can contact and be contacted by this Application’s support service.
If a live chat platform integration is installed, it may collect Usage Data relating to the pages on which it is installed, even when Users do not use it. Live chat conversations may also be recorded.
The WhatsApp Business Chat widget is an interaction service for the WhatsApp live chat platform provided by Meta Platforms Ireland Limited.
Personal Data processed: last name; message or email content; user content; message date; Data provided while using the service; profile picture; message sender; first name; phone number; time the message was sent; answers to questions.
Place of processing: Ireland – Privacy Policy.
Interaction with social networks and external platforms:These services allow this Application to distribute its content through servers located in different areas and to optimize its performance.
The Personal Data processed depends on the characteristics and implementation of these services, which by their nature filter communications between this Application and the User’s browser.
Given the distributed nature of such systems, it is difficult to determine where content may be transferred; such content may contain the User’s Personal Data.
Cloudflare is a traffic optimization and distribution service provided by Cloudflare Inc. Its integration involves filtering all traffic to this Application, meaning communications between this Application and the User’s browser, and may also allow the collection of related statistical data.
Personal Data processed: Trackers; various types of Data as specified in the service’s Privacy Policy.
Place of processing: United States – Privacy Policy.
jsDelivr distributes web libraries and resources through a content delivery network (CDN). When a User’s browser requests a resource hosted on cdn.jsdelivr.net, the provider and its infrastructure operators may receive technical request data.
Personal Data processed: Usage Data, including IP address and technical request information (for example, browser, date and time, resource address and referring domain, as described in the provider’s notice).
Purposes: file distribution and website performance improvement, infrastructure security and aggregate download statistics. jsDelivr states that it does not use tracking cookies for its CDN service and does not track individual Users.
Legal basis: the Data Controller’s legitimate interest in the proper operation and delivery of resources, to be assessed in relation to the actual integration and the principle of data minimization.
Place of processing: distributed, depending on the CDN operators; the service also uses Cloudflare and Fastly. Any transfers are governed by the privacy notices of the providers involved.
Provider’s Privacy Policy: https://www.jsdelivr.com/terms/privacy-policy
These services allow User Data to be used for commercial communications. Such communications are displayed on this Application in the form of banners and other advertisements, including advertisements based on the User’s interests.
This does not mean that all Personal Data is used for this purpose. The Data and conditions of use are described below.
Some of the services listed below may use Trackers to identify the User or engage in behavioral retargeting, meaning displaying personalized advertisements based on the User’s interests and behavior, or measuring advertising performance.
For further details, Users should consult the privacy notices of the respective services.
These services generally allow Users to opt out of this type of tracking. Users can learn how to opt out of interest-based advertising in the relevant opt-out section of this document.
Google Ads conversion tracking is an analytics service provided by Google LLC that connects data from the Google advertising network with actions performed on this Application. For information about Google’s use of Data, please consult its partner policy and Business Data page.
Personal Data processed: Usage Data; Trackers.
Place of processing: United States – Privacy Policy.
Meta Ads conversion tracking (Meta Pixel) is an analytics service provided by Meta Platforms Ireland Limited that links data from the Meta advertising network to actions performed on this Application. Meta Pixel tracks conversions attributable to advertisements on Facebook, Instagram and Audience Network.
Personal Data processed: Usage Data; Trackers.
Place of processing: Ireland – Privacy Policy – Opt out.
Google Conversion Linker is an analytics service provided by Google Ireland Limited that links Data from Google’s advertising services with actions performed on this Application. Depending on the service settings, such Data may also be processed for retargeting purposes. For information about Google’s use of Data, please consult Google’s partner policies.
Personal Data processed: Usage Data; Trackers.
Place of processing: Ireland – Privacy Policy – Opt out.
The services in this section allow the Data Controller to monitor and analyze website traffic and track User behavior.
Google Analytics is an analytics service provided by Google LLC (“Google”). Google uses the Personal Data collected to track and examine use of this Application, prepare reports and share them with other Google services. Google may use Personal Data to contextualize and personalize advertisements in its advertising network. In Google Analytics 4, IP addresses are used at the time of collection and then discarded before data is recorded in any data center or server. For further information, please consult Google’s official documentation. For information about Google’s use of Data, please consult its partner policy and Business Data page.
Personal Data processed: Usage Data; number of Users; session statistics; Trackers.
Place of processing: United States – Privacy Policy – Opt out.
Meta Events Manager is an analytics service provided by Meta Platforms, Inc. Through integration with Meta Pixel, Meta Events Manager may provide the Data Controller with information about traffic and interactions on this Application.
Personal Data processed: postal code; city; last name; email address; first name; phone number; Trackers.
Place of processing: United States – Privacy Policy – Opt out.
WooCommerce Order Attribution Tracking is a WooCommerce analytics feature that links online order data to marketing activities, channels or campaigns to measure their effectiveness.
Personal Data processed: Usage Data; page views; Trackers; referring URL.
FunnelKit Automations is a WordPress/WooCommerce component used to detect incomplete shopping carts. The system may capture an email address while the checkout form is being filled in, before the order is submitted, and associate it with products in the cart. The cart is marked as abandoned after 60 minutes and as lost after 7 days. The Data Controller may send recovery reminders and, where permitted, subsequent emails containing coupons and offers.
Personal Data processed: email address; identification and contact details already entered, where applicable; products and quantities in the cart, amounts and other purchase-session information; abandonment or recovery status and timestamps; any events relating to communications sent and objection preferences.
Purposes: detection and management of incomplete carts, possible sending of recovery reminders, measurement of recovery activities and management of objections.
Legal basis: sending cart-recovery emails for promotional purposes normally requires the data subject’s prior consent; any reliance on the “soft spam” exception is restricted to customers who have already made a purchase and subject to the conditions of Article 130(4) of the Italian Privacy Code. The information notice provided by the plugin does not, by itself, constitute valid consent. Collection and retention of cart data must be assessed separately, taking account of necessity, proportionality and duration.
Retention: a cart is marked as abandoned after 60 minutes and as lost after 7 days; these classifications do not automatically delete it. Automatic periodic deletion of lost carts is not currently configured. The Data Controller has identified a reference retention period of 90 days after abandonment for unrecovered carts, to be implemented through a deletion or anonymization procedure, without prejudice to any Data needed for legal obligations, disputes or evidence of consent. Completed-order Data is processed separately in WooCommerce.
User choices and objection to recovery emails: during checkout, near the email field, Users are informed that they may receive messages about an incomplete cart and can choose not to receive them using the option provided in the form. If they receive a recovery message, they may also use the unsubscribe link in the email to object to further communications of this kind. Checkout separately includes an optional, unticked checkbox to consent to promotional communications, including any offers and coupons relating to abandoned carts. Objections must be respected for future emails; promotional communications are sent only where an appropriate legal basis exists. The availability of opt-out or unsubscribe options does not replace prior consent where the law requires it.
Place of processing: Data handled by the component may be stored in the website’s WordPress/WooCommerce environment; any external services used to deliver emails must be described according to the actual configuration.
These services allow content hosted on external platforms to be displayed directly within pages of this Application and allow Users to interact with it. Such services are often referred to as widgets: small components included in a website or application. They provide specific information or perform a particular function, often allowing User interaction.
Such services may nevertheless collect web traffic data relating to pages where the service is installed, even when Users do not interact with it.
Google Fonts is a font-display service managed by Google LLC, which allows this Application to incorporate fonts into its pages.
Personal Data processed: Usage Data; Trackers.
Place of processing: United States – Privacy Policy.
Google Maps is a map-display service managed by Google LLC that allows this Application to integrate maps into its pages.
Personal Data processed: Usage Data; Trackers.
Place of processing: United States – Privacy Policy.
Font Awesome is an icon library that may be used to display graphical elements and symbols on the pages of this Application. Where resources are requested directly from Font Awesome’s servers or third-party CDNs, the User’s browser makes external connections that may transmit technical data. If, instead, the files are served entirely from the website, this function alone does not establish a direct connection to Font Awesome’s servers.
Personal Data potentially processed when remotely loaded: IP address, Usage Data and other technical request information within the limits described in the provider’s notice or the relevant CDN’s notice.
Purposes: displaying icons and graphical components of the website.
Legal basis: legitimate interest in the operation and graphic presentation of the service, to be assessed according to the actual technical loading method.
Place of processing and recipients: depend on the actual distribution method used (Font Awesome kit, CDN or local files).
Provider’s Privacy Policy: https://fontawesome.com/privacy
In addition to any opt-out features offered by the services listed in this document, Users can find out more about how to opt out of interest-based advertising in the relevant section of the Cookie Policy.
This Application uses Trackers. For more information, please consult the Cookie Policy.
Additional information for Users:The Data Controller processes Personal Data relating to the User where one of the following conditions applies:
Users may always ask the Data Controller to clarify the specific legal basis for each processing operation, including whether processing is based on law, required by a contract or necessary to enter into a contract.
Unless otherwise stated in this document, Personal Data is processed and stored for as long as necessary for the purpose for which it was collected and may be retained longer to meet legal obligations or on the basis of the User’s consent.
Accordingly:
At the end of the applicable retention period, and subject to any legal requirements or need to protect rights, Personal Data is deleted or anonymized. Data subject rights remain exercisable within the limits provided by law.
Users may exercise certain rights concerning the Data processed by the Data Controller.
In particular, within the limits prescribed by law, Users have the right to:
Users have the right to obtain information about the legal basis for transferring Data abroad, including to any international organization governed by international law or established by two or more countries, such as the United Nations, and about the security measures adopted by the Controller to protect their Data.
Where Personal Data is processed in the public interest, in the exercise of official authority vested in the Controller, or for the Controller’s legitimate interests, Users have the right to object to such processing on grounds relating to their particular situation.
Users are reminded that, where their Data is processed for direct marketing purposes, they may object at any time, free of charge and without providing a reason. If Users object to processing for direct marketing, their Personal Data will no longer be processed for those purposes. To determine whether the Controller processes Data for direct marketing, Users may refer to the relevant sections of this document.
Requests to exercise User rights may be addressed to the Data Controller using the contact details provided in this document. Requests are free of charge, and the Controller will respond as soon as possible and in any event within one month, providing all information required by law. Any rectification, erasure or restriction of processing will be communicated by the Controller to each recipient to whom the Personal Data was disclosed, where applicable, unless this proves impossible or involves disproportionate effort. The Controller will inform the User of these recipients upon request.
The User’s Personal Data may be used by the Data Controller in legal proceedings or in preparation for potential legal proceedings to defend against improper use of this Application or related Services by the User.
The User acknowledges that the Controller may be required to disclose Data by order of public authorities.
Upon the User’s request, in addition to the information contained in this Privacy Policy, this Application may provide additional, contextual notices concerning specific Services or the collection and processing of Personal Data.
For operational and maintenance purposes, this Application and any third-party services it uses may collect system logs, meaning files that record interactions and may also contain Personal Data, such as the User’s IP address.
Further information concerning the processing of Personal Data may be requested from the Data Controller at any time using the contact details provided.
The Data Controller reserves the right to amend this Privacy Policy at any time by notifying Users on this page and, where possible, through this Application, as well as, where technically and legally feasible, by contacting Users through one of the contact details held by the Controller. Users are therefore encouraged to consult this page frequently and refer to the last updated date shown below.
Where changes concern processing based on consent, the Controller will obtain the User’s consent again if necessary.
Personal Data means any information that, directly or indirectly, including when combined with any other information such as a personal identification number, identifies or makes a natural person identifiable.
Information automatically collected through this Application (including through third-party applications integrated into it), which may include: IP addresses or domain names of computers used by Users connecting to this Application; URI (Uniform Resource Identifier) addresses; time of request; method used to submit a request to the server; size of the file received in response; numeric code indicating the status of the server response (successful, error, etc.); country of origin; features of the browser and operating system used by the visitor; time-related details of the visit (such as time spent on each page); and details of the path followed within the Application, particularly the sequence of pages visited and parameters relating to the User’s operating system and IT environment.
The individual who uses this Application and who, unless otherwise specified, is the Data Subject.
The natural person to whom the Personal Data relates.
A natural or legal person, public authority, agency or other body that processes Personal Data on behalf of the Controller, as described in this Privacy Policy.
The natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing Personal Data and the measures adopted, including security measures relating to the operation and use of this Application. Unless otherwise specified, the Data Controller is the owner of this Application.
The hardware or software through which Users’ Personal Data is collected and processed.
The Service provided by this Application as described in its relevant terms (if available) on this website/Application.
Unless otherwise specified, any reference to the European Union in this document includes all current Member States of the European Union and the European Economic Area.
Cookies are Trackers consisting of small pieces of data stored in the User’s browser.
TrackerA Tracker means any technology — such as Cookies, unique identifiers, web beacons, embedded scripts, e-tags and fingerprinting — that allows Users to be tracked, for example by collecting or storing information on a User’s device.
This notice has been prepared to describe processing activities related to this website under Regulation (EU) 2016/679 and applicable Italian law, without prejudice to any other laws that may apply.
Unless otherwise specified, this Policy applies exclusively to this Application.
Text last updated: November 3, 2026
Maximus
VAT Number 03863110544
Gualdo Tadino (PG)
