Privacy notice

1. Controller and processor

The data controller is Dolciumi da Franco e Agnese e Figli S.A.S di Giuliano Raffaele & C., Via Siepe Nuova 15, 80027, Frattamaggiore, NA, Italia, 10939091210, NA - 1143680, email dolciumidafrancoeagnesesas@gmail.com, certified email dolciumidafrancoeagnese@pec.it (the "Controller").

The website and platform are hosted, maintained and managed by ByteTech OÜ, Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia, Reg. 17558441, VAT EE103036861, email info@bytetech.ee, which processes data on behalf of the Controller as data processor (art. 28 GDPR) under a data processing agreement.

2. What data we process

• Account data: first and last name, email, phone (optional), date of birth (optional), preferred language, password (stored only in hashed form, never readable).
• Addresses: home address (optional) and delivery and billing addresses, with any courier notes, doorbell name, staircase/floor; Italian tax code (optional).
• Orders: products purchased, amounts, delivery fee, method (delivery or pickup), order status with date and time of delivery or pickup, delivery address and phone, payment receipts and communications about the order.
• Withdrawal: withdrawal declarations sent with the “Withdraw from contract” button (name, email, order number, products, optional reason, date and time).
• Payments: handled directly by Stripe. We never receive or store full card details.
• Consents: date of acceptance of the Terms and Privacy notice, optional marketing consent and its date.
• Technical data: technical cookies (see Cookie policy), IP address and browser information used temporarily for security (e.g. limiting login attempts).

3. Purposes and legal bases

• Creating and managing your account, fulfilling orders, deliveries and pickups, handling returns and support — performance of the contract (art. 6.1.b GDPR).
• Sending service emails: email confirmation, password reset, payment receipt, order status updates, withdrawal acknowledgment — performance of the contract and legal obligations (art. 6.1.b and 6.1.c).
• Complying with tax and accounting obligations (keeping sales records) — legal obligation (art. 6.1.c).
• Sending news and offers by email, only if you consented — consent (art. 6.1.a), which you can withdraw at any time from your profile.
• Protecting the website and accounts from abuse and fraud (attempt limits, technical logs) — the Controller's legitimate interest (art. 6.1.f).

Data marked as required is needed to create the account or fulfil the order; optional data (phone, date of birth, home address, tax code) can be left out.

4. Address search

To help you fill in addresses, the text you type in the search field is sent from our server to the Photon service of komoot GmbH (Germany), based on OpenStreetMap open data. The service only receives the address text searched: not your name, your email or your IP address. Using the search is optional: you can always fill in the fields by hand.

5. Who receives the data

Data is processed by the Controller's authorised staff and, on its behalf, by the following providers:

• ByteTech OÜ (Estonia, EU) — technical management of the website and platform.
• Supabase, Inc. — database provider (accounts, addresses, orders, receipts, withdrawal requests) and product photo storage, on servers in the European Union (Ireland, AWS eu-west-1).
• Vercel Inc. — website hosting: runs the pages and server code, with processing in the European Union (Dublin, Ireland) and content delivered through its global network; logs technical access data (e.g. IP address, time, page requested) for security and operation.
• Resend (Plus Five Five, Inc.) — sending service emails: email confirmation, password reset, payment receipts, order updates, withdrawal acknowledgements (United States; transfer based on the EU Commission's Standard Contractual Clauses).
• Stripe Payments Europe Ltd. (Ireland) — payment processing, which also acts as independent controller for anti-money-laundering and anti-fraud obligations.
• komoot GmbH (Germany) — address search (see point 4).
• Couriers in charge of delivery, limited to name, address, phone and delivery notes.

Data is never sold or passed on to third parties for marketing purposes.

6. Transfers outside the EU

Some providers (Vercel, Resend, Stripe and Supabase, companies based in the United States or part of US groups) may process or give access to data in the United States. In those cases the transfer is based on the Standard Contractual Clauses approved by the European Commission and/or the EU-US Data Privacy Framework.

7. How long we keep data

• Account and addresses: as long as the account is active; you can delete it at any time from your profile.
• Orders, receipts and sales records: 10 years, as required by tax law (art. 2220 Italian Civil Code); after account deletion, orders are kept unlinked from the account.
• Withdrawal declarations: as long as needed to handle the withdrawal and refund, then for the limitation period of the related rights (10 years).
• Marketing consent: until withdrawn.
• Email confirmation and password reset links: 48 hours and 1 hour; login sessions: 30 days or until logout.
• Anti-abuse security counters (login attempts, form submissions), holding only an irreversible hashed code of the IP address or email: 24 hours at most.
• Security technical data: only as long as strictly necessary (usually minutes or a few days).

8. Your rights

You can exercise at any time the rights under arts. 15-22 GDPR: access, rectification, erasure, restriction, portability, objection and withdrawal of consent, without affecting the lawfulness of prior processing.

From your profile you can edit your data, download a copy of your data (JSON format) and delete your account yourself.

For any other request write to dolciumidafrancoeagnesesas@gmail.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the supervisory authority of your EU country.

9. Security and automated decisions

We take appropriate technical and organisational measures: encrypted connections (HTTPS), passwords stored in hashed form, access to data limited to authorised staff, and database protection. We do not make decisions based solely on automated processing, nor do we profile customers.