Privacy policy

Privacy Policy — Cazzaniga & Gaudenzi

1. Identity and Contact Details of the Data Controller

Cazzaniga & Gaudenzi ("we", "us", "our") is the Data Controller responsible for the processing of personal data collected through the website https://cazzanigaegaudenzi.com and in connection with our e-commerce activities.

Registered office: Italy

Website: https://cazzanigaegaudenzi.com

For any questions, requests, or concerns relating to the processing of your personal data, you may contact us at the address above or by using the contact details available on our website.

2. Scope and Applicability

This Privacy Policy applies to all personal data collected and processed by Cazzaniga & Gaudenzi when you:

  • Visit and browse our website at https://cazzanigaegaudenzi.com;
  • Create an account or register as a customer;
  • Place an order, make a purchase, or request a return or refund;
  • Subscribe to our newsletter or marketing communications;
  • Contact our customer service team;
  • Interact with us through any other digital channel we operate.

This Policy is issued in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR"), the Italian Legislative Decree No. 196/2003 (the "Italian Privacy Code") as amended by Legislative Decree No. 101/2018, and the ePrivacy Directive 2002/58/EC as implemented in Italy.

3. Personal Data We Collect

Depending on how you interact with Cazzaniga & Gaudenzi, we may collect and process the following categories of personal data:

3.1 Data You Provide Directly

  • Identity data: first name, last name, username or similar identifier;
  • Contact data: billing address, delivery address, email address, telephone number;
  • Account data: username, password (stored in encrypted form), account preferences;
  • Transaction data: details of products purchased, order history, payment references;
  • Financial data: payment card details or payment account information (processed by our authorised payment processors; we do not store full card numbers);
  • Communications data: messages sent to our customer service, feedback, reviews, and correspondence.

3.2 Data Collected Automatically

  • Technical data: IP address, browser type and version, device type and identifier, operating system, time zone setting, browser plug-in types;
  • Usage data: pages visited, clickstream data, products viewed, search queries made on the website, referral URLs, session duration;
  • Cookie data: data collected through cookies and similar tracking technologies, as described in Section 10 of this Policy.

3.3 Data from Third Parties

  • Payment data from authorised payment service providers confirming the outcome of a transaction;
  • Fraud prevention data from fraud detection services;
  • Analytics data from third-party analytics providers, in aggregated or pseudonymised form.

We do not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, health data, or data concerning a person's sex life or sexual orientation) and ask that you do not submit such data to us. We do not knowingly collect personal data from children under the age of 16.

4. Purposes and Legal Bases for Processing

We process your personal data only where we have a lawful basis to do so under Article 6 GDPR. The table below sets out our purposes and corresponding legal bases.

Purpose Personal Data Used Legal Basis (Art. 6 GDPR)
Processing and fulfilling your orders, including payment, dispatch, and delivery Identity, contact, transaction, financial data Art. 6(1)(b) — performance of a contract
Managing your customer account Identity, contact, account data Art. 6(1)(b) — performance of a contract
Sending order confirmations, shipping updates, and service-related communications Identity, contact, transaction data Art. 6(1)(b) — performance of a contract
Processing returns, refunds, and complaints Identity, contact, transaction data Art. 6(1)(b) — performance of a contract
Complying with legal obligations (e.g., tax, accounting, consumer protection law) Identity, contact, financial, transaction data Art. 6(1)(c) — compliance with a legal obligation
Preventing fraud and ensuring payment security Identity, financial, technical data Art. 6(1)(f) — legitimate interests
Improving and securing our website and e-commerce platform Technical, usage data Art. 6(1)(f) — legitimate interests
Sending personalised marketing communications (newsletter, promotional offers) Identity, contact, transaction, usage data Art. 6(1)(a) — consent
Displaying interest-based advertising and retargeting Technical, usage, cookie data Art. 6(1)(a) — consent
Conducting analytics and measuring website performance Technical, usage, cookie data Art. 6(1)(a) — consent (for non-essential cookies); Art. 6(1)(f) — legitimate interests (for aggregated, non-identifying analytics)

Where we rely on legitimate interests (Article 6(1)(f) GDPR), we have assessed that our interests are not overridden by your interests or fundamental rights. You may request information on our legitimate interests assessment by contacting us.

Where processing is based on consent (Article 6(1)(a) GDPR), you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5. How We Share Your Personal Data

Cazzaniga & Gaudenzi does not sell your personal data. We may share your data with the following categories of recipients where necessary and in accordance with the GDPR:

5.1 Data Processors (Article 28 GDPR)

We engage third-party service providers who process personal data strictly on our behalf and under our documented instructions:

  • Payment processors: to authorise and process payment transactions;
  • Logistics and courier providers: to fulfil and deliver your orders;
  • IT hosting and cloud service providers: to host our website and e-commerce platform;
  • Email and communication service providers: to send transactional and marketing emails;
  • Customer service tools: to manage support tickets and correspondence;
  • Marketing and analytics platforms: subject to your consent, to conduct analytics and personalised marketing.

All data processors are bound by data processing agreements in accordance with Article 28 GDPR and may not use your data for any purpose other than providing the contracted service.

5.2 Independent Controllers

In certain circumstances, we may share data with third parties acting as independent data controllers:

  • Tax authorities and regulatory bodies in Italy and the EU, where required by law;
  • Law enforcement authorities, where we are legally obliged or where necessary to protect our legal rights;
  • Fraud prevention agencies, to detect and prevent fraudulent transactions.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business assets, your personal data may be transferred to the acquiring entity, subject to equivalent data protection guarantees.

6. International Transfers of Personal Data

Cazzaniga & Gaudenzi is based in Italy and primarily processes personal data within the European Economic Area (EEA). Where we engage service providers located outside the EEA, we ensure that transfers are subject to appropriate safeguards as required by Chapter V GDPR, including:

  • Adequacy decisions adopted by the European Commission (Article 45 GDPR);
  • Standard Contractual Clauses (SCCs) issued by the European Commission (Article 46(2)(c) GDPR), including where applicable the supplementary measures recommended by the European Data Protection Board;
  • Any other lawful transfer mechanism recognised under the GDPR.

You may request details of the safeguards applicable to any specific international transfer by contacting us.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law. Our principal retention criteria are as follows:

Data Category Retention Period
Order and transaction records 10 years from the date of the transaction, in accordance with Italian civil and tax law obligations
Customer account data For the duration of your account, plus 2 years after account closure or last activity
Marketing and consent records Until you withdraw consent, plus a reasonable period to demonstrate compliance
Customer service correspondence 3 years from the closure of the relevant request
Cookie and browsing data As specified in our Cookie Notice (Section 10); typically 13 months maximum for analytics cookies
Fraud prevention data Up to 5 years from the relevant event, in accordance with applicable legislation

When personal data is no longer required, it is securely deleted or anonymised in accordance with our internal data retention and destruction procedures.

8. Your Rights Under the GDPR

As a data subject, you are entitled to exercise the following rights under the GDPR. You may exercise any of these rights free of charge by contacting us using the details provided in Section 1.

  • Right of access (Article 15 GDPR): You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data together with information about how it is processed.

  • Right to rectification (Article 16 GDPR): You have the right to request the correction of inaccurate personal data or the completion of incomplete personal data.

  • Right to erasure (Article 17 GDPR): You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful, subject to applicable legal retention obligations.

  • Right to restriction of processing (Article 18 GDPR): You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while the accuracy of the data is contested.

  • Right to data portability (Article 20 GDPR): Where processing is based on your consent or the performance of a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.

  • Right to object (Article 21 GDPR): You have the right to object to the processing of your personal data where we rely on legitimate interests as our legal basis. You also have an absolute right to object to the processing of your personal data for direct marketing purposes at any time.

  • Right to withdraw consent (Article 7(3) GDPR): Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

  • Right not to be subject to solely automated decision-making (Article 22 GDPR): You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, unless this is necessary for the performance of a contract, authorised by law, or based on your explicit consent.

We will respond to all verifiable requests within one month of receipt. Where requests are complex or numerous, we may extend this period by a further two months, of which we will notify you (Article 12(3) GDPR).

9. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes the GDPR or applicable Italian data protection law, you have the right to lodge a complaint with the competent supervisory authority.

In Italy, the competent supervisory authority is:

Garante per la protezione dei dati personali (Garante) Piazza Venezia 11 00187 Roma — Italy Website: https://www.garanteprivacy.it Email: garante@gpdp.it

You may also lodge a complaint with the supervisory authority of the EU member state where you habitually reside or work, or where the alleged infringement occurred.

10. Cookies and Similar Technologies

Cazzaniga & Gaudenzi uses cookies and similar tracking technologies on https://cazzanigaegaudenzi.com to ensure the proper functioning of the website and, subject to your consent, to improve your experience, conduct analytics, and deliver personalised marketing.

In compliance with the ePrivacy Directive 2002/58/EC as implemented under Italian law (Provvedimento del Garante dell'8 maggio 2014 and subsequent guidelines), we obtain your prior and informed consent before placing any non-essential cookies on your device.

10.1 Categories of Cookies We Use

  • Strictly necessary cookies: Essential for the website to function correctly (e.g., session management, shopping cart functionality, security). These do not require your consent.

  • Analytics cookies: Used to collect anonymised or pseudonymised information about how visitors use our website (e.g., pages visited, traffic sources). Deployed only with your consent.

  • Functional cookies: Used to remember your preferences and personalise your experience (e.g., language settings). Deployed only with your consent.

  • Marketing and advertising cookies: Used to track your browsing activity and deliver targeted advertising and retargeting campaigns. Deployed only with your consent.

10.2 Managing Your Cookie Preferences

You may manage, update, or withdraw your cookie consent at any time through our Cookie Preference Centre, accessible via the cookie banner or the dedicated link in the footer of our website. You may also control cookies through your browser settings; however, disabling certain cookies may affect the functionality of the website.

Detailed information about the specific cookies we use, their duration, and the third parties involved is provided in our Cookie Notice, which forms an integral part of this Privacy Policy.

11. Security of Personal Data

Cazzaniga & Gaudenzi implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure, in accordance with Article 32 GDPR. These measures include, but are not limited to:

  • Encryption of data in transit using TLS/SSL protocols;
  • Encryption of stored sensitive data, including account credentials;
  • Access controls restricting access to personal data to authorised personnel on a need-to-know basis;
  • Regular security assessments and vulnerability testing of our e-commerce platform;
  • Staff training on data protection obligations and information security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Garante within 72 hours of becoming aware of the breach (Article 33 GDPR), and will communicate the breach to affected individuals without undue delay where required (Article 34 GDPR).

12. Children's Privacy

Our website and e-commerce services are not directed at, and are not intended to be used by, children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe that we have inadvertently collected such data, please contact us immediately and we will take prompt steps to delete it.

In accordance with Article 8 GDPR and Article 2-quinquies of the Italian Privacy Code, where the processing of a child's data is based on consent in relation to information society services, such consent must be given or authorised by the holder of parental responsibility.

13. Consumer Rights Under Italian Law

In addition to the rights conferred by the GDPR, customers who are consumers resident in Italy may be entitled to additional protections under the Italian Consumer Code (Legislative Decree No. 206/2005) and applicable EU consumer protection legislation, including Directive (EU) 2019/771 on contracts for the sale of goods and Directive (EU) 2019/770 on contracts for the supply of digital content. These rights are without prejudice to your rights under this Privacy Policy.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or the structure of our business. Where changes are material, we will notify you by email (if you have a customer account) or by means of a prominent notice on our website prior to the change becoming effective. The current version of this Privacy Policy is always available at https://cazzanigaegaudenzi.com.

We encourage you to review this Policy periodically to remain informed about how we protect your personal data.