Information notice on the processing of personal data pursuant to Articles 13-14 of Regulation (EU) 2016/679 (GDPR)
Last updated: 23 July 2026 — supersedes the version in force since 21 November 2022
1. Data Controller and DPO
The Data Controller is Rondolino Società Cooperativa Agricola, with registered office at Tenuta Colombara, 13046 Livorno Ferraris (VC), Italy — VAT No. 01986880027 (the "Controller"). Email: shop@acquerello.it — Tel.: 0161 477832.
The Controller has appointed a DPO: Luigi Mattea, who can be contacted at dpo@acquerello.it.
This document concerns the website https://shop.acquerello.it/ (the "Site"). By entering third-party data, the user warrants that they are entitled to do so and holds the Controller harmless.
2. Categories of data processed
Personal and contact data (first name, surname, email, telephone), billing and shipping addresses, account data (credentials), data relating to orders and purchases, payment data (handled directly by the payment service providers — the Controller does not store full card data), browsing data and cookies (see Cookie Policy). No special or judicial data are processed.
3. Purposes, legal bases and nature of the provision of data
| Purpose | Legal basis | Provision |
|---|---|---|
| a) Registration and management of the account | Pre-contractual measures / performance of the contract (Art. 6(1)(b)) | Optional; without the data it is not possible to register |
| b) Conclusion and performance of the purchase contract, shipping, after-sales assistance, returns and refunds | Performance of the contract (Art. 6(1)(b)) | Necessary for the purchase |
| c) Tax, accounting and legal obligations (e.g. invoicing) | Legal obligation (Art. 6(1)(c)) | Mandatory |
| d) Sending by email offers on products/services similar to those purchased ("soft spam") | Legitimate interest (Art. 6(1)(f); Art. 130(4) of the Privacy Code) | Objection possible at any time |
| e) Reminders for uncompleted purchases (abandoned cart) | Legitimate interest (Art. 6(1)(f)) | Objection possible |
| f) Responding to requests for information/assistance | Legitimate interest (Art. 6(1)(f)) | Optional |
| g) Newsletter and general marketing of the Controller and/or third parties | Consent (Art. 6(1)(a)) | Optional and revocable |
| h) Profiling of purchasing habits for personalised communications | Consent (Art. 6(1)(a)) | Optional and revocable |
| i) Statistical and marketing cookies | Consent (Art. 6(1)(a); Art. 122 of the Privacy Code) | Optional |
| l) Establishing, exercising or defending a legal claim | Legitimate interest (Art. 6(1)(f)) | — |
The withdrawal of consent does not affect prior processing. It is possible to object to marketing and soft spam through the unsubscribe link in every email or by contacting the Controller.
4. Methods of processing
Processing is carried out using electronic and, where necessary, paper-based tools, with technical and organisational measures adequate to ensure security and confidentiality (Art. 32 GDPR). The data are accessible only to authorised personnel and to the designated data processors.
5. Recipients and data processors
For the purposes indicated, the data may be disclosed to parties acting as data processors pursuant to Art. 28 GDPR or as independent controllers, including:
- the hosting/management provider of the PrestaShop platform;
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — payment service;
- Payplug SAS (France) — payment service (VISA/Mastercard/American Express cards, Apple Pay, Google Pay, Satispay);
- the courier(s)/carrier(s) appointed for delivery;
- The Rocket Science Group LLC (Mailchimp / Intuit) — sending of newsletters/email marketing;
- Google Ireland Ltd / Google LLC — statistics (GA4), tags and advertising (Google Ads/Tag Manager);
- Meta Platforms Ireland Ltd — advertising pixel;
- Usercentrics A/S (Cookiebot) — management of cookie consent;
- consultants and professionals (legal, tax, IT), Public Authorities and parties to whom communication is required by law.
The Controller does not transfer the data to third parties for their own purposes without consent. An up-to-date list of the data processors is available upon request.
6. Transfer of data outside the EU
Any transfers to the United States (Google, Meta, Mailchimp) take place with adequate safeguards: the EU-US Data Privacy Framework adequacy decision of 10 July 2023 (for certified entities) and/or Standard Contractual Clauses approved by the European Commission, together with any supplementary measures where necessary. PayPal, Payplug and Cookiebot operate within the EU/EEA.
7. Retention period
- Account data: for the duration of the account; deletion/anonymisation after a period of inactivity of 24 months or upon request.
- Data relating to orders and contracts: 10 years from the date of the order, for evidentiary and defence purposes and for civil-law obligations.
- Tax/accounting documents (invoices): 10 years (Art. 2220 of the Italian Civil Code and tax legislation).
- Marketing/profiling: until consent is withdrawn; inactive users deleted after 24 months from the last interaction.
- Customer assistance: until the conclusion of the requested service and for a further 12 months.
8. Rights of the data subject
The data subject may exercise the rights set out in Articles 15-22 GDPR: access, rectification, erasure, restriction, objection, portability, as well as the withdrawal of consent. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it). Requests should be addressed to the Controller (shop@acquerello.it) or to the DPO (dpo@acquerello.it).
9. Amendments
The Controller reserves the right to update this information notice. The version in force is published on this page together with its date; in the event of substantial changes, notice may also be given by email.
This is a courtesy translation; in the event of any discrepancy, the Italian-language version shall prevail.