Last updated: 7 October 2026
This policy explains how we process the personal data of people who visit the website www.prodelmec.it (the “Website”), buy from it or write to us, pursuant to art. 13 of Regulation (EU) 2016/679 (“GDPR”).
1. Data controller
Prodelmec di Ermanno Francolini, VAT number IT09688490581
Email: info@prodelmec.it
2. Data we process
- Orders: first and last name, shipping and billing address, email, phone number, products purchased and amounts.
- Invoice, only if you request one: tax code or VAT number, company name, SDI recipient code or PEC address.
- Messages sent through the contact form or by email: first and last name, email, phone number, message text, any order number or VAT number.
- Withdrawal and guarantee: name, order number, email, products concerned, description of the problem and any photos.
- Browsing: IP address, browser, pages requested, date and time, recorded by the server. For visit statistics the same data are collected with a truncated IP address.
Payment card details are entered in the payment providers’ forms and never reach us: we only receive the outcome, the card network and the last four digits of the card.
3. Purposes, legal basis and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Handling the order: payment, shipping, order communications | Performance of the contract (art. 6.1.b) | 10 years, with the accounting records |
| Invoicing and accounting | Legal obligation (art. 6.1.c) | 10 years (art. 2220 of the Italian Civil Code) |
| Withdrawal, returns, guarantee and complaints | Performance of the contract and legal obligation (art. 6.1.b and c) | Until the guarantee expires (26 months after delivery), then with the order records |
| Replying to messages | Request of the data subject (art. 6.1.b) or our legitimate interest in replying (art. 6.1.f) | As long as needed to handle the request |
| Preventing payment fraud | Legitimate interest in avoiding fraudulent payments (art. 6.1.f) | According to the payment providers’ retention periods |
| Website security (server logs) | Legitimate interest in protecting the Website (art. 6.1.f) | As long as strictly necessary |
| Aggregate visit statistics (Matomo, on our own server) | Legitimate interest in understanding how the Website is used (art. 6.1.f) | 13 months for detailed data, then only aggregate, anonymous totals |
| Protecting our rights in the event of a dispute | Legitimate interest (art. 6.1.f) | Until the dispute is closed |
We do not use the data for marketing or profiling and we do not take decisions based solely on automated processing.
4. Whether providing data is required
The data marked as required at checkout are needed to conclude and perform the contract: without them we cannot process the order. Invoice data are needed only if you request an invoice. In the contact form, the data requested are needed to reply to you.
5. Recipients
The data are processed by our authorised staff and may be disclosed to:
- payment providers: Stripe and PayPal, which also process the data as independent controllers, under their own privacy policies;
- couriers responsible for delivery;
- IT service providers: Website hosting and email delivery;
- accounting and tax advisers; the Italian Revenue Agency, through the Exchange System (SDI), for electronic invoices;
- public authorities, when required by law.
Providers that process data on our behalf are appointed as processors (art. 28 GDPR).
6. Transfers outside the European Union
Stripe may also process data in the United States. The transfer is based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework or on Standard Contractual Clauses (arts. 45 and 46 GDPR).
7. Your rights
You can ask us for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest (arts. 15–21 GDPR), by writing to info@prodelmec.it. We reply within one month.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
8. Changes
The current version of this policy is always published on this page, with the date of the last update.
9. Cookies
The Website only uses technical cookies and similar tools, needed for the cart, payment and language selection to work. At payment, Stripe and PayPal use their own technical cookies for security and fraud prevention, under their own privacy policies.