The data controller is:
DueNoveSei di Marco Prosseda
Via Ereto 2 – 00010 Moricone (RM), Italy
info@duenovesei.com
The Controller determines the purposes and means of the processing of personal data.
Types of data processed
The types of data processed on this website are listed below
a) Browsing data
The website uses log files in which information is collected automatically during users’ visits.
This information may include:
- IP address
- type of browser and device used
- operating system
- date and time of access
- pages visited
- referring page, if any
This data is processed in aggregate form to ensure the proper functioning of the website and for security reasons.
b) Data provided voluntarily by the user
The user may provide personal data in the following cases:
- registering an account
- completing an order
- filling in the contact form
- subscribing to the newsletter
- requesting information
The data collected may include:
- first and last name
- billing and shipping address
- tax code or VAT number
- email address
- telephone number
- data necessary to process the order
Payment data is processed directly by the payment providers and is not stored in full by the website.
Purposes of processing
The data collected is used for the following purposes:
- to allow registration on the website
- to manage orders, shipments and deliveries
- to fulfil tax and accounting obligations
- to provide customer support
- to respond to requests sent via the contact form
- to send promotional communications and newsletters (subject to consent)
- to ensure the security of the website
- to carry out statistical analysis, subject to consent through the cookie management tools
The processing necessary to manage orders is based on the performance of a contract.
Marketing activities are based on the consent expressed by the user, which may be withdrawn at any time.
Processing methods
Data processing is carried out using IT and electronic tools, with organisational and logical methods strictly related to the stated purposes.
Appropriate security measures are adopted to prevent unauthorised access, disclosure, alteration or destruction of the data.
No automated decision-making processes producing legal effects on the user are carried out.
Data retention
Personal data is retained for the time strictly necessary to achieve the stated purposes and in particular:
- order-related data: up to 10 years (tax obligations)
- customer account data: until deletion is requested
- marketing data: until consent is withdrawn and in any case no longer than 24 months
- browsing data for security: up to 12 months
Disclosure of data
Data may be disclosed to third parties involved in the management of the service, such as:
- IT and hosting service providers
- payment providers
- couriers and logistics operators
- tax and administrative consultants
- newsletter service providers
These parties act as Data Processors pursuant to art. 28 GDPR or as independent controllers, where applicable.
Transfer of data outside the EU
Should some providers be based outside the European Union, the transfer of data will take place in compliance with art. 44 et seq. of the GDPR, on the basis of:
- an Adequacy Decision of the European Commission (e.g. the EU–US Data Privacy Framework 2023), or
- Standard Contractual Clauses approved by the European Commission.
