This Privacy Policy describes the methods and purposes of processing personal data collected from users who consult and use the services on the website www.giada-todesco.com, in accordance with EU Regulation 2016/679 (General Data Protection Regulation - GDPR) and applicable data protection legislation.
1. Data Controller
The Data Controller is:
MY CHERRY DI GIADA TODESCO (Sole Proprietorship)
VAT Number: 02943210308
Tax Code: TDSGDI96T59G284P
Email: info@giada-todesco.com
Certified Email (PEC): giadas.tdsc@pec.it
2. Categories of Personal Data Collected
Through the website, the following categories of data may be collected and processed:
- Identification and contact details: Name, surname, email address, phone number, shipping and billing addresses provided when completing a purchase, contacting our concierge, or requesting private consultations.
- Navigation data: IP addresses, browser specifications, operating system details, timestamps, and anonymous traffic metrics collected automatically during browsing.
- Financial and payment details: Handled directly and securely by specialized certified payment gateways (Stripe, PayPal). No credit card numbers or bank credentials pass through or reside on our servers.
3. Purpose and Legal Basis of Processing
Personal data is processed for the following purposes:
a) E-commerce and Order Fulfillment: Managing purchases, deliveries, customer support, and invoicing of artworks (Legal basis: performance of a contract, Art. 6.1.b GDPR).
b) Inquiries & Private Consultation Requests: Answering inquiries and arranging bespoke artwork consultations (Legal basis: performance of pre-contractual measures, Art. 6.1.b GDPR).
c) Newsletter & Art Previews: Sending exclusive previews, exhibition announcements, and gallery updates (Legal basis: explicit consent of the data subject, Art. 6.1.a GDPR).
d) Legal and Tax Obligations: Fulfilling accounting, tax, and administrative requirements under applicable laws (Legal basis: compliance with a legal obligation, Art. 6.1.c GDPR).
4. Data Recipients
Personal data may be communicated to trusted third parties strictly necessary for providing our services, designated as Data Processors where applicable:
- Premium shipping and logistics couriers (e.g., DHL) for artwork transport.
- Certified payment service providers and banking institutions.
- Legal, tax, and accounting consultants.
- IT infrastructure, hosting, and communication service providers.
5. International Data Transfers
Certain IT providers may process data outside the European Economic Area (EEA). In such cases, transfers occur strictly in compliance with Chapter V of the GDPR, relying on European Commission adequacy decisions (such as the EU-U.S. Data Privacy Framework) or standard contractual clauses (SCCs).
6. Data Retention Period
Personal data is retained only for the duration strictly necessary for the purposes for which it was gathered:
- Purchase and billing records are maintained for 10 years in compliance with Italian statutory tax regulations.
- Newsletter and marketing data is retained until consent is revoked (unsubscription is available at any time via the link in each email).
7. Nature of Data Provision
Providing personal data for contractual and pre-contractual purposes (points 3.a and 3.b) is required to complete orders or receive customer replies. Providing data for newsletters (point 3.c) is entirely optional.
8. Rights of the Data Subject
Users may exercise their rights under Articles 15–22 of the GDPR at any time:
- Right of access, rectification, and erasure.
- Right to restriction of processing or objection.
- Right to data portability.
- Right to lodge a complaint with the competent Data Protection Authority (Garante per la Protezione dei Dati Personali - www.garanteprivacy.it).
Requests can be submitted via email to: info@giada-todesco.com.