This Privacy Policy describes how personal data is collected, used, and managed when visiting, placing orders, or interacting with services on www.pelletteriaartigiana.com, pursuant to Article 13 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended.

1. Data Controller

The Data Controller is responsible for the processing of personal data collected through this website. For any questions or to exercise your rights, please reach out via the contact details provided above.

2. Categories of Data Processed and Purposes

2.1. Navigation Data

The computer systems and software procedures used to operate this website collect certain personal data as a standard part of internet communication protocols (e.g., anonymized IP addresses, request timestamps, server response status). This data is processed solely to gather anonymous statistical information regarding site usage and to ensure system stability and security.

2.2. Data Provided Voluntarily by the User

• Inquiries and Contact Forms: Submitting messages via contact forms involves collecting your name, email address, and any personal information included in your message, necessary to handle and respond to your inquiry.
• E-commerce and Order Fulfillment: Purchasing products involves processing identity, shipping/billing address, phone number, and payment details required to manage orders, issue tax invoices, and deliver goods.
• Newsletter Subscription: Upon explicit consent, your email address will be used to send promotional materials, commercial updates, and news about our products.

2.3. Cookies and Tracking Technologies

This website uses technical cookies and, subject to optional user consent, analytics and profiling cookies. For detailed information, please review our Cookie Policy.

3. Legal Bases for Processing

Personal data is processed based on the following legal grounds:

• Contract performance or pre-contractual steps (Art. 6.1.b GDPR): To process purchase orders, deliver services, and respond to customer requests.
• Legal obligation compliance (Art. 6.1.c GDPR): To satisfy accounting, tax, and statutory requirements.
• Legitimate interest of the Controller (Art. 6.1.f GDPR): To ensure website security, prevent fraud, or manage legal claims.
• User consent (Art. 6.1.a GDPR): For marketing/newsletter communications and non-essential third-party or profiling cookies.

4. Processing Methods and Retention Period

Data processing is conducted using automated and manual tools with organizational measures designed to ensure security and confidentiality. Data is retained only for as long as necessary to fulfill the purposes for which it was collected:

• Contractual and Tax Records: Retained for 10 years in compliance with statutory obligations.
• Customer Support and Inquiries: Retained for the time needed to process the request, up to a maximum of 12 months.
• Marketing and Newsletter Data: Retained until consent is withdrawn (opt-out) by the user.

5. Data Recipients and Disclosure

Personal data is never disclosed to the public without authorization. It may be shared with trusted third parties bound by confidentiality obligations and appointed as Data Processors under Article 28 of the GDPR where necessary:

• Hosting, IT infrastructure, and e-commerce platform providers.
• Couriers and logistics partners for product delivery.
• Financial institutions and digital payment processing services.
• Tax, legal, and accounting advisors.

6. Non-EU Data Transfers

Any transfer of personal data to countries outside the European Economic Area (EEA) takes place strictly in compliance with Articles 44 et seq. of the GDPR, relying on adequacy decisions (such as the EU-U.S. Data Privacy Framework) or Standard Contractual Clauses (SCC) approved by the European Commission.