Privacy Policy
This privacy notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Privacy Code”) and describes how personal data of users browsing mad56.it and purchasing through its online store is processed. This English version is a translation provided for convenience; the Italian version prevails. Last updated: June 2026.
1. Data Controller
The Data Controller is Mad56 di Massimo Dante (sole proprietorship), registered office at Località alla sega, 1, 38068 Rovereto (TN), Italy – VAT no. 02233610225.
Contact e-mail for any privacy matter: [email protected].
The Controller has not appointed a Data Protection Officer (DPO), as the conditions of mandatory designation under Art. 37 GDPR do not apply.
2. Categories of data processed
- Identification and contact data: first and last name, billing and shipping address, e-mail, phone number.
- Order data: products purchased, amounts, purchase history, order notes.
- Payment data: card or account details are collected and processed directly by the payment providers (Stripe, PayPal); the Controller does not store full card numbers.
- Account data: login credentials (e-mail and encrypted password) for registered users.
- Browsing data and cookies: IP address, browser and device type, pages visited, cookie identifiers (see Cookie Policy).
- Data provided voluntarily: content of messages sent by e-mail or contact forms.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Performance of the sales contract: order management, shipping and after-sales support | Art. 6(1)(b) GDPR (performance of a contract) | Duration of the relationship and, thereafter, 10 years for civil and tax obligations |
| Accounting, tax and legal obligations (invoicing) | Art. 6(1)(c) GDPR (legal obligation) | 10 years (Art. 2220 Italian Civil Code) |
| Management of the registered customer account | Art. 6(1)(b) GDPR | Until the account deletion is requested |
| Responding to contact and support requests | Art. 6(1)(b) and (f) GDPR | Time needed to handle the request and up to 24 months |
| Statistics and traffic analysis via cookies | Art. 6(1)(a) GDPR (consent) | As stated in the Cookie Policy |
| Website security, fraud and abuse prevention (logs, application firewall) | Art. 6(1)(f) GDPR (legitimate interest) | Time strictly necessary for security purposes |
4. Processing methods
Data is processed using IT and electronic tools, applying technical and organisational measures appropriate to ensure its security, integrity and confidentiality under Art. 32 GDPR, and is accessible only to authorised staff and to providers appointed as Data Processors.
5. Recipients and Data Processors
Within the limits of the purposes above, data may be disclosed to the following categories of recipients, many of which act as Data Processors under Art. 28 GDPR:
- Hosting and IT/maintenance provider;
- Stripe Payments Europe, Ltd. – card payment processing;
- PayPal (Europe) S.à r.l. et Cie, S.C.A. – PayPal payment processing;
- Google Ireland Ltd. – statistics via Google Tag Manager/Google Analytics and web-font delivery;
- Couriers and shipping carriers – order delivery;
- Tax/accounting consultant – accounting and tax compliance;
- Competent authorities, where required by law.
Data is not disseminated and is not sold to third parties for purposes other than those stated.
6. Transfers to third countries
Some recipients (in particular Stripe, PayPal and Google) may process personal data outside the European Economic Area, notably in the United States. Such transfers take place under appropriate safeguards pursuant to Articles 44-49 GDPR: a European Commission adequacy decision (EU-U.S. Data Privacy Framework) where the recipient adheres to it, or the Standard Contractual Clauses adopted by the European Commission under Art. 46 GDPR.
7. Cookies and tracking tools
The site uses technical cookies and, subject to consent, analytics and third-party cookies. For details of the types, purposes and consent management, see the Cookie Policy.
8. Data subject rights
At any time the data subject may exercise the following rights under Articles 15-22 GDPR:
- right of access (Art. 15);
- right to rectification (Art. 16);
- right to erasure / “right to be forgotten” (Art. 17);
- right to restriction of processing (Art. 18);
- right to data portability (Art. 20);
- right to object to processing (Art. 21), including direct marketing;
- right not to be subject to automated decision-making (Art. 22);
- right to withdraw consent at any time (Art. 7(3)), without affecting the lawfulness of processing carried out before withdrawal.
Requests may be sent to [email protected]. The Controller responds without undue delay and, in any case, within one month of receiving the request (Art. 12 GDPR).
9. Complaint to the Supervisory Authority
Without prejudice to any other remedy, a data subject who believes their rights have been infringed may lodge a complaint (Art. 77 GDPR) with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it.
10. Nature of data provision
Providing identification, contact and payment data is necessary to conclude and perform the sales contract: refusal makes it impossible to fulfil the order. Providing data for marketing and newsletter purposes is optional and any refusal does not affect the ability to purchase.
11. Automated decision-making and profiling
The Controller does not carry out automated decision-making or profiling producing legal effects or similarly significantly affecting the data subject under Art. 22 GDPR.
12. Changes to this notice
The Controller may update this notice to reflect regulatory or organisational changes. The current version is always published on this page, with the date of last update.