Privacy

Data Controller

Controller: Pellecchia S.r.l.

Registered office: Via Aniello Palumbo n. 160, 80014 Giugliano in Campania (NA) – Italy

VAT number: 06170981218

Email: info@pellecchia.it

           Certified Email (if available): pellecchiasrl@arubapec.it

The Controller can be contacted for any request regarding the processing of personal data and the exercise of data subjects' rights.

Types of data processed

Personal and contact data: name, surname, address, email, phone number.

Data necessary for order fulfillment and invoicing: shipping address, tax code/VAT number, payment data (only token or transaction outcome; full card details are not stored by the Controller).

Browsing data: IP addresses, logs, device identifiers, session data, information collected through cookies and similar tools (see § 10).

Data voluntarily provided by the user: messages sent via contact forms, support requests, unsolicited applications.

4. Purposes and legal bases of processing

Users' personal data are processed for the following purposes and with the respective legal bases:

Purpose	Legal basis	Examples
Website registration and account management	Performance of a contract or pre-contractual measures (Art. 6.1.b GDPR)	Profile creation, access to restricted area
Purchase of products/services, order fulfillment, after-sales support	Performance of a contract (Art. 6.1.b)	Shipping, returns, warranty
Tax, accounting, and legal compliance	Legal obligation (Art. 6.1.c)	Invoicing, document retention
Responding to requests sent via form/email	Legitimate interest of the Controller (Art. 6.1.f) or pre-contractual measures	Customer support
Sending newsletters and promotional communications	Consent of the data subject (Art. 6.1.a)	Email marketing
Profiling (optional) for personalized offers	Consent (Art. 6.1.a)	Analysis of purchase preferences
Website security, fraud prevention, and abuse	Legitimate interest (Art. 6.1.f)	Access monitoring, security logs

 

Processing methods

Processing is carried out using manual, IT, and/or telematics tools, with logic strictly related to the stated purposes and adopting appropriate technical and organizational measures to ensure data security (Articles 5 and 32 GDPR), aimed at preventing unauthorized access, disclosure, modification, or destruction.

6. Recipients or categories of data recipients

Data may be communicated to:

authorized internal staff (administration, sales, marketing, IT, logistics);

technical service providers (hosting provider, IT maintenance, e-commerce platforms, payment systems, newsletter services);

couriers and shippers;

consultants and professionals (accountants, lawyers) within the limits of the purposes indicated above;

competent authorities, if required by legal obligations or authority orders.

Such subjects act, where applicable, as Data Processors pursuant to Art. 28 GDPR, on the basis of specific written agreements. The updated list of Data Processors can be requested from the Controller.

Data transfers to countries outside the EU/EEA

If data is transferred outside the European Economic Area, the Controller guarantees that the transfer takes place in compliance with Articles 44 et seq. GDPR, in the presence of an adequacy decision by the European Commission or through the adoption of standard contractual clauses (SCC) or other adequate safeguards. Copies or indications of the adopted safeguards can be requested from the Controller.

Data retention period

Data is retained for the time strictly necessary to achieve the purposes for which it was collected or to comply with legal obligations:

billing data: 10 years (civil/tax obligations);

account data: until a request for deletion or account closure, subject to legal requirements;

marketing/newsletter data: until consent is revoked;

browsing and log data: for the technical time necessary for site security and in any case no longer than [insert indicative period, e.g., 6-12 months];

in case of litigation: for the entire duration thereof and within the limits provided by law.

Data Subject Rights

Users may exercise their rights under Articles 15-22 of the GDPR and Article 2-undecies et seq. of Legislative Decree 196/2003 (as amended by Legislative Decree 101/2018) at any time, including:

to obtain confirmation as to whether or not personal data concerning them exist and access thereto (Article 15);

to request rectification (Article 16), updating, or integration thereof;

to request deletion (Article 17) or restriction of processing (Article 18);

to object to processing (Article 21), particularly direct marketing;

to request data portability (Article 20) where applicable;

to withdraw consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal.

Requests can be sent to the Data Controller at the contact details indicated in § 1. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or another competent supervisory authority.

Cookies and similar technologies

The site uses technical cookies and, with prior consent, analytical and profiling cookies, both proprietary and/or third-party, for site operation, statistical, and marketing purposes. For more information, to view the list of cookies used, and to manage or withdraw consent at any time, please consult the dedicated Cookie Policy and the appropriate preference management banner.

Credit card payments and third-party providers

For credit/debit card payments, the data necessary for the transaction (card number, expiry date, CVV) are processed directly by the payment service provider and/or by anti-fraud control bodies via encrypted protocol. Such information is neither viewed nor stored by Pellecchia S.r.l.

Data Security

Pellecchia S.r.l. adopts appropriate technical and organizational measures to prevent loss, unlawful or incorrect use, and unauthorized access to data. However, absolute security cannot be guaranteed: users are advised to use secure devices and connections, update antivirus software, and adopt appropriate IT security practices.

Minors under 14 years of age (or 16 years, if applicable)

The site's services are not directed at minors under the age provided by applicable national law (14 years in Italy for digital consent, unless otherwise indicated). If the Data Controller becomes aware that data of minors have been collected without the consent of parents/guardians, it will proceed to delete them.

Changes to this Privacy Policy

The Data Controller reserves the right to modify this Privacy Policy at any time. Changes will be published on this page and, if significant, notified through available tools (e.g., email or banner). Users are therefore invited to consult this page periodically and check the date of the last update. In case of non-acceptance of the changes, the user may request the Data Controller to delete their personal data.

Last updated: 22/07/2025