DATA CONTROLLER

The Data Controller responsible for the processing of Personal Data is:

A&D Ties di Andrea Galliani
Sole proprietorship owned by Andrea Galliani
Registered office: Via Adige, 5 – 20095 Cusano Milanino (MI), Italy
VAT No.: IT12866480960
Certified Email (PEC):
a.galliani93@pec.it

METHODS AND PLACE OF PROCESSING OF COLLECTED DATA

Methods of Processing

The Data Controller processes Users’ Personal Data by adopting appropriate technical and organizational security measures to prevent unauthorized access, disclosure, modification, or destruction of Personal Data.

Processing is carried out using IT and/or electronic tools, with organizational methods and procedures strictly related to the purposes indicated in this Privacy Policy.

In addition to the Data Controller, Personal Data may, where necessary, be accessible to authorized persons involved in the operation of the website, including administrative, commercial, marketing, legal, and technical personnel, as well as external service providers such as hosting companies, IT service providers, payment service providers, shipping companies, and communication agencies.

Where required by applicable law, external parties processing Personal Data on behalf of the Data Controller are appointed as Data Processors pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR).

An updated list of Data Processors may be requested by contacting the Data Controller.

Place of Processing

Personal Data are processed at the Data Controller’s registered office and at other locations where authorized persons or service providers involved in the processing activities operate.

Where Personal Data are transferred outside the European Economic Area (EEA), such transfers shall take place in accordance with the applicable provisions of the GDPR, including the use of adequacy decisions, Standard Contractual Clauses, or other appropriate safeguards where required.

For further information regarding the location of data processing or international transfers, Users may contact the Data Controller using the contact details provided above.

Data Retention Period

Personal Data are retained only for the period necessary to fulfill the purposes for which they were collected, unless a longer retention period is required or permitted by applicable law.

In particular:

  • Customer account data: retained for as long as the account remains active and, following its closure, for any additional period necessary to comply with legal obligations or establish, exercise, or defend legal claims.
  • Order, transaction, and invoicing data: retained for the periods required by applicable accounting and tax legislation, generally up to 10 years where applicable.
  • Customer support and contact requests: retained for the time necessary to handle the request and for any additional period justified by applicable legal obligations or legitimate interests.
  • Marketing data: retained until consent is withdrawn or for the applicable retention period specified in the relevant marketing information.
  • Technical and security data: retained for periods proportionate to the purposes of website security, fraud prevention, and technical maintenance.
  • Analytics and cookie-related data: retained in accordance with the settings and retention periods of the services used, as described in the Cookie Policy.

Upon expiry of the applicable retention period, Personal Data will be deleted or anonymized, unless further retention is legally required or justified.

Users may exercise their rights regarding their Personal Data, including the right to request erasure where applicable, by contacting the Data Controller.

Purposes of Processing of Collected Data

Users’ Personal Data are collected and processed by the Data Controller for the following purposes:

  • Customer Account Management: creating and managing customer accounts, registration, authentication, and access to the online store.
  • Order Processing and Fulfillment: processing purchases, managing payments, preparing invoices where applicable, and arranging the shipment and delivery of purchased products.
  • Customer Support: responding to inquiries, contact requests, complaints, returns, and after-sales assistance.
  • Legal and Tax Compliance: fulfilling applicable accounting, tax, consumer protection, and other legal obligations.
  • Website Security and Functionality: ensuring the proper functioning, maintenance, and security of the website and preventing fraudulent or unauthorized activities.
  • Statistics and Analytics: analyzing website traffic and user interactions, subject to applicable consent requirements.
  • Marketing Communications: sending newsletters, promotional offers, and commercial communications where permitted by applicable law and, when required, with the User’s prior consent.

Legal Bases for Processing

The legal bases for processing Personal Data depend on the specific purpose and may include:

  • Performance of a contract (Article 6(1)(b) GDPR): processing necessary to manage customer accounts, purchases, payments, deliveries, and related services.
  • Compliance with legal obligations (Article 6(1)(c) GDPR): processing required to comply with accounting, tax, and other applicable legal requirements.
  • Legitimate interests (Article 6(1)(f) GDPR): processing necessary for website security, fraud prevention, and the protection of the Data Controller’s rights, where such interests are not overridden by the rights and freedoms of Users.
  • Consent (Article 6(1)(a) GDPR): processing for marketing communications, non-essential cookies, analytics, and advertising activities where consent is required.

Where processing is based on consent, Users may withdraw their consent at any time without affecting the lawfulness of processing carried out before withdrawal.

The categories of Personal Data processed, the recipients of such data, and further information regarding specific processing activities are described in the relevant sections of this Privacy Policy.