Privacy Policy

PRIVACY NOTICE

Last updated: July 2026

This Privacy Policy describes how this website is managed with regard to the processing of personal data belonging to users and visitors who browse the website and use its e-commerce and newsletter services. Personal data is processed in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Italian legislation.

1. DATA CONTROLLER AND TAX INFORMATION

The Data Controller is:

Full Name: Federica Italiano

VAT Number: 13465931007

Italian Tax Code: TLNFRC85P54C342P

Registered Office: Via Genè 8, 10152 Turin, Italy

Email Contact: straziostudio@gmail.com

Tax notice: Transactions are carried out pursuant to Article 1, paragraphs 54 to 89, of Law No. 190/2014, as subsequently amended (Italian flat-rate tax regime, with no VAT charged and no withholding tax applied).

2. TYPES OF DATA COLLECTED AND PURPOSES OF PROCESSING

Personal data is collected and processed for the following purposes:

• A) Order fulfilment and Shop management (Contractual Data): We collect First Name, Last Name, Shipping Address, Billing Address, Email Address and Telephone Number. This information is mandatory: failure to provide it will make it impossible for us to receive and process your purchase order.

• B) Tax and legal obligations: Billing information is processed in order to comply with the administrative, accounting and tax obligations required by Italian law.
• C) Payment Data (Encrypted): Sensitive credit card or PayPal account information does not pass through and is not stored on this website’s servers. Such information is processed securely and in encrypted form directly by authorised external payment gateways (PayPal and WooPayments/Stripe).
• D) Newsletter Subscription (Marketing): Subject to your explicit consent, provided by entering your email address in the dedicated form, we will process your email address for the purpose of sending information, updates and exclusive promotions relating to the shop.
• E) Anti-Fraud Protection (Google reCAPTCHA): The website uses Google reCAPTCHA to protect payment and contact forms against bots and automated card-testing attacks. The operation of this service involves the analysis of user browsing activity by Google LLC.
• F) Traffic Analysis and Session Recordings (Microsoft Clarity): Subject to your explicit consent provided through the cookie banner, we use Microsoft Clarity to analyse, in anonymised form, how users interact with the pages of the website through heatmaps, anonymised session recordings and behavioural metrics, solely for the purpose of improving the usability and functionality of the online store. The data collected does not allow the user to be directly identified.

3. LEGAL BASIS FOR PROCESSING

The Data Controller processes your personal data only where one of the following legal bases applies:

• Performance of a contract (Art. 6(1)(b) GDPR): for the purpose of fulfilling orders (Point A).

• Legal obligation (Art. 6(1)(c) GDPR): for accounting and tax record-keeping requirements (Point B).

• Consent of the data subject (Art. 6(1)(a) GDPR): for Newsletter subscription (Point D).

• Legitimate interest (Art. 6(1)(f) GDPR): for website security and fraud prevention through anti-bot systems (Point E).
• Consent of the data subject (Art. 6(1)(a) GDPR): for the collection of analytics and browsing data through Microsoft Clarity (Point F).

4. RECIPIENTS OF PERSONAL DATA (THIRD PARTIES)

The data collected will never be sold or disclosed to third parties for marketing purposes. However, in order to ensure the proper functioning of the online store, personal data may be disclosed to external service providers appointed as Data Processors, including:

• Web hosting and infrastructure service providers (Aruba S.p.A.).
• Payment processing platforms (PayPal Inc. and Stripe/WooPayments).
• Shipping and logistics service providers, including express couriers and Poste Italiane for parcel delivery.
  
• Tax advisers or accountants for accounting management.
  
• Technology service providers and email management platforms (Google LLC).
• Behavioural analytics and heatmap service providers (Microsoft Corporation, for Microsoft Clarity).

5. DATA RETENTION PERIOD

Your personal data will be retained only for as long as strictly necessary to fulfil the purposes described above:

• Data relating to orders and billing is retained for 10 years, in accordance with the tax and civil law obligations applicable under Italian law.
• Newsletter data is retained until you decide to withdraw your consent by unsubscribing.

6. USER RIGHTS (DATA SUBJECT RIGHTS)

In accordance with Articles 15–22 of the GDPR, you have the right, at any time, to:

1. Request confirmation as to whether or not personal data concerning you is being processed.
   
2. Obtain information about the source of the data, the purposes of the processing and the methods used.
   
3. Request the updating, rectification or completion of your personal data.
   
4. Request the complete erasure of your personal data (Right to be Forgotten), its anonymisation or the restriction of data processed unlawfully.
5. Withdraw your consent to the newsletter at any time by clicking the “Unsubscribe” link at the bottom of each email.

To exercise any of these rights, simply send an email to: straziostudio@gmail.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali): www.garanteprivacy.it.