Notice provided pursuant to arts. 13 and 14 of EU Regulation 2016/679 (GDPR) and Legislative Decree 196/2003 as amended.
1. Data Controller
BOTTEGA DEI DUE MONTI di Stefano Mirella
Via Piave 59, 98071 Cap’Orlando (ME) — Italy
VAT: 01541130835 — REA Messina 145604
E-mail: info@bottegadeiduemonti.it
The Data Controller can be contacted for any matter relating to the processing of personal data.
2. Types of Data Collected
2.1 Data provided voluntarily by the user
- Personal and contact data: name, surname, e-mail address, phone number, collected during registration, order submission or completion of a contact form.
- Shipping and billing data: delivery and billing address, provided at the time of placing an order.
- Payment data: transactions are handled directly by PayPal and credit card networks (Visa, Mastercard, etc.); the Seller does not store card numbers.
- Communications: content of messages sent via e-mail or contact forms.
2.2 Data collected automatically
- Navigation data: IP address (anonymised where applicable), browser type, operating system, pages visited, visit duration.
- Cookies and similar technologies: as described in the Cookie Policy.
2.3 Data of minors
The site is intended for adults. The Data Controller does not knowingly collect data from children under 16 years of age. If such data is inadvertently collected, it will be promptly deleted upon notification.
3. Purposes and Legal Bases for Processing
| Legal basis (art. 6 GDPR) | Conservazione | |
|---|---|---|
| Order management: processing, shipping, invoicing, after-sales support | Performance of a contract — art. 6(b) | 10 years (fiscal obligations) |
| Tax, accounting and legal compliance | Legal obligation — art. 6(c) | 10 years |
| Fraud prevention, IT security, protection of rights in legal proceedings | Legitimate interest — art. 6(f) | Until resolution of the dispute |
| Statistical analysis of traffic (Google Analytics with anonymised IP) | Legitimate interest — art. 6(f) (aggregated and anonymous data) | 26 months (GA4 setting) |
| Newsletter and commercial communications | Consent — art. 6(a) (revocable at any time) | Until withdrawal of consent |
| Profiling and advertising remarketing (when active) | Consent — art. 6(a) (via cookie banner) | Until withdrawal of consent |
4. External Data Processors
Personal data may be communicated, only to the extent strictly necessary for the respective purposes, to the following categories of recipients:
| Soggetto | Purpose | Paese |
|---|---|---|
| Packlink PRO Shipping and contracted couriers | Shipment management and order delivery | UE |
| PayPal (Europe) S.àr.l. | Payment processing | EU / USA |
| Stripe Payments Europe Ltd. (if active) | Card payment processing | EU / USA |
| Google LLC — Google Analytics | Statistical traffic analysis (anonymised IP) | USA — SCC |
| Automattic Inc. — WordPress.com / Akismet | CMS platform, anti-spam filter | USA — SCC |
| Consulente fiscale / CAF | Accounting and tax compliance | Italia |
| Public authorities | Upon legal request or court order | Italy / EU |
Data is not sold to third parties or transferred for purposes other than those indicated.
5. Transfers to Non-EU Countries
Some providers (Google LLC, PayPal, Automattic Inc.) transfer data to the USA. Such transfers take place under the EU-US Data Privacy Framework and/or Standard Contractual Clauses adopted by the European Commission.
For profiling and remarketing services that may be activated in the future (Meta Pixel, LinkedIn Insight Tag, TikTok Pixel), the transfer will take place exclusively after the user’s explicit consent via the cookie banner.
6. Third-Party Tools Currently Used
Google Analytics (Google LLC)
We use Google Analytics with the IP anonymisation function active. Data is processed in aggregate form and does not allow identification of individual users. Opt-out: Google Analytics Opt-out Add-on.
Future Analysis and Marketing Tools (not yet active)
The site may in the future integrate behavioural analysis tools (e.g. Microsoft Clarity) and advertising pixels (Meta, LinkedIn, TikTok, Pinterest). Activation will be communicated with an update to the Cookie Policy before going live.
7. Newsletter and Commercial Communications
If you have given your consent to newsletter subscription, we use your e-mail to send you updates on seasonal new arrivals, exclusive offers and stories from our producers. You can unsubscribe at any time:
- by clicking the unsubscribe link at the bottom of each e-mail;
- by writing to info@bottegadeiduemonti.it.
Withdrawal of consent does not affect the lawfulness of processing carried out up to that point.
8. Automated Decision-Making Processes
The Data Controller does not carry out processing based on automated decisions, including profiling, that produce legal effects or similarly significantly affect the data subject.
9. Rights of the Data Subject
Pursuant to arts. 15–22 GDPR, you have the right to:
- Access (art. 15): obtain confirmation of processing and a copy of the data;
- Rectification (art. 16): correct inaccurate or incomplete data;
- Erasure (art. 17): obtain deletion of data (right to be forgotten), where not prevented by legal obligations;
- Restriction (art. 18): obtain restriction of processing in certain cases;
- Portability (art. 20): receive your data in a structured, machine-readable format;
- Objection (art. 21): object to processing based on legitimate interest or for direct marketing purposes;
- Withdrawal of consent (art. 7): withdraw at any time the consent given, without affecting the lawfulness of processing carried out prior to withdrawal.
To exercise your rights write to: info@bottegadeiduemonti.it.
We will respond within 30 days of receiving the request.
10. Complaint to the Supervisory Authority
You have the right to lodge a complaint with the Italian Data Protection Authority:
Piazza Venezia 11, 00187 Roma — www.garanteprivacy.it
11. Cookies
For full information on the use of cookies and tracking technologies please see the Cookie Policy.
12. Changes to This Privacy Policy
The Data Controller reserves the right to update this policy in the event of regulatory changes, activation of new tools, or changes to processing methods. We recommend checking this page periodically.
Last updated: 29 March 2026