Privacy policy

Draft – not legal advice. This text was prepared as a working draft and must be reviewed and approved by a qualified lawyer before go-live. Every [TO BE COMPLETED] marker requires input from Stamperia Bertozzi.

This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and, for residents of certain U.S. states, under the applicable state privacy laws.

1. Controller

Stamperia Bertozzi S.r.l., Largo Marino Maestri 50, 47035 Gambettola (FC), Italy – info@stamperiabertozzi.it.
Data Protection Officer: [TO BE COMPLETED – state the DPO's contact details, or state that no DPO has been appointed because the conditions of Article 37 GDPR are not met.]

2. Data we process and why

Purpose	Data	Legal basis	Retention
Processing orders, payment, delivery, after-sales	Identification, contact, billing and shipping data, order history	Performance of a contract (Art. 6(1)(b))	Duration of the contract + 10 years (statutory accounting records)
Customer account	Credentials, order history	Performance of a contract (Art. 6(1)(b))	Until the account is deleted
Customs and export formalities	Recipient identification data transmitted to carriers and customs authorities	Legal obligation (Art. 6(1)(c))	As required by customs law
Newsletter and marketing	E-mail, name, country, preferences	Consent (Art. 6(1)(a)); soft spam-in for existing customers	Until consent is withdrawn
Analytics and profiling cookies	See the Cookie policy	Consent (Art. 6(1)(a))	See the Cookie policy
Fraud prevention, security, defence of legal claims	Log data, transaction data	Legitimate interest (Art. 6(1)(f))	[TO BE COMPLETED]

3. Recipients

Data may be disclosed to: payment service providers, carriers and customs brokers, the e-commerce hosting provider, the e-mail and marketing platform, the accounting firm and, where required, public authorities. A full list of processors appointed under Article 28 GDPR is available on request. [TO BE COMPLETED – list the actual providers, e.g. PayPal, Stripe, the carrier, the hosting provider.]

4. Transfers outside the EEA

Because we ship to the United States, personal data is necessarily transferred to U.S. carriers, customs brokers and authorities. Transfers to processors are covered by the European Commission's Standard Contractual Clauses or, where applicable, by the EU–U.S. Data Privacy Framework. Transfers strictly necessary to perform the shipping contract also rely on Article 49(1)(b) GDPR.

5. Your rights (GDPR)

You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest or direct marketing, by writing to info@stamperiabertozzi.it. You may withdraw consent at any time without affecting the lawfulness of prior processing. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).

6. Additional notice for U.S. residents

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas or another U.S. state with a comprehensive privacy law, you may have the right to know, delete, correct and obtain a copy of your personal information, and to opt out of the "sale" or "sharing" of personal information and of targeted advertising.

We do [TO BE COMPLETED – do / do not] sell or share personal information as those terms are defined under the CCPA/CPRA.
To exercise a request, write to info@stamperiabertozzi.it. We will verify your identity before responding and will not discriminate against you for exercising a right.
We honour Global Privacy Control (GPC) browser signals as an opt-out of sale/sharing where applicable.

7. Children

The shop is not directed at children under 16. We do not knowingly collect their data.

8. Updates

Last update: [TO BE COMPLETED].