Privacy policy
Draft – not legal advice. This text was prepared as a working draft and must be reviewed and approved by a qualified lawyer before go-live. Every [TO BE COMPLETED] marker requires input from Stamperia Bertozzi.
This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and, for residents of certain U.S. states, under the applicable state privacy laws.
1. Controller
Stamperia Bertozzi S.r.l., Largo Marino Maestri 50, 47035 Gambettola (FC), Italy – info@stamperiabertozzi.it.
Data Protection Officer: [TO BE COMPLETED – state the DPO's contact details, or state that no DPO has been appointed because the conditions of Article 37 GDPR are not met.]
2. Data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Processing orders, payment, delivery, after-sales | Identification, contact, billing and shipping data, order history | Performance of a contract (Art. 6(1)(b)) | Duration of the contract + 10 years (statutory accounting records) |
| Customer account | Credentials, order history | Performance of a contract (Art. 6(1)(b)) | Until the account is deleted |
| Customs and export formalities | Recipient identification data transmitted to carriers and customs authorities | Legal obligation (Art. 6(1)(c)) | As required by customs law |
| Newsletter and marketing | E-mail, name, country, preferences | Consent (Art. 6(1)(a)); soft spam-in for existing customers | Until consent is withdrawn |
| Analytics and profiling cookies | See the Cookie policy | Consent (Art. 6(1)(a)) | See the Cookie policy |
| Fraud prevention, security, defence of legal claims | Log data, transaction data | Legitimate interest (Art. 6(1)(f)) | [TO BE COMPLETED] |
3. Recipients
Data may be disclosed to: payment service providers, carriers and customs brokers, the e-commerce hosting provider, the e-mail and marketing platform, the accounting firm and, where required, public authorities. A full list of processors appointed under Article 28 GDPR is available on request. [TO BE COMPLETED – list the actual providers, e.g. PayPal, Stripe, the carrier, the hosting provider.]
4. Transfers outside the EEA
Because we ship to the United States, personal data is necessarily transferred to U.S. carriers, customs brokers and authorities. Transfers to processors are covered by the European Commission's Standard Contractual Clauses or, where applicable, by the EU–U.S. Data Privacy Framework. Transfers strictly necessary to perform the shipping contract also rely on Article 49(1)(b) GDPR.
5. Your rights (GDPR)
You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest or direct marketing, by writing to info@stamperiabertozzi.it. You may withdraw consent at any time without affecting the lawfulness of prior processing. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).
6. Additional notice for U.S. residents
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas or another U.S. state with a comprehensive privacy law, you may have the right to know, delete, correct and obtain a copy of your personal information, and to opt out of the "sale" or "sharing" of personal information and of targeted advertising.
- We do [TO BE COMPLETED – do / do not] sell or share personal information as those terms are defined under the CCPA/CPRA.
- To exercise a request, write to info@stamperiabertozzi.it. We will verify your identity before responding and will not discriminate against you for exercising a right.
- We honour Global Privacy Control (GPC) browser signals as an opt-out of sale/sharing where applicable.
7. Children
The shop is not directed at children under 16. We do not knowingly collect their data.
8. Updates
Last update: [TO BE COMPLETED].