Privacy Policy

Privacy Policy

Last updated:

This policy explains which personal data we collect, the purposes for which we use them, how long we retain them and which rights you may exercise.

1. Who processes your data

Data ControllerHOBBYKIT SRLS
VAT No.02966380640
Registered officeVia Michelangelo Buonarroti, 45
83035 Grottaminarda (AV) – Italy

2. What data we collect

2.1 Account and purchase data

  • Personal and contact details, such as first name, surname, email address and telephone number.
  • Shipping and billing addresses.
  • Data required to manage orders, payments, returns and support.

2.2 Login with Facebook or Google

If you choose “Sign in with Facebook” or “Sign in with Google”, we receive the following platform data from the relevant providers:

  • App-scoped user ID or another identifier internal to the application.
  • First name and surname included in the basic public profile.
  • Email address, if available and authorised.

We do not request additional permissions and do not access the content of your profile. We use these data exclusively to authenticate you, create or recognise your customer account and pre-fill profile fields.

2.3 Technical data and cookies

  • Log data, such as IP address, user agent, pages visited and times, used for website security and operation.
  • Cookies and similar technologies. For more information, please see the Cookie Policy.

3. Why we process data: purposes and legal bases

PurposeData usedLegal basisRetention
Registration and login, via email/password or Social LoginName, email address, app-scoped IDPerformance of pre-contractual measures or the contract, Art. 6(1)(b) GDPRFor as long as the account remains active or until a deletion request is made
Management of orders, payments, shipments and returnsAccount data, addresses and order dataContract, Art. 6(1)(b), and legal or tax obligations, Art. 6(1)(c) GDPRUp to 10 years for civil-law and tax obligations
Customer supportContact details and content of requestsContract or legitimate interest in providing support, Art. 6(1)(b) and 6(1)(f) GDPRUp to 24 months after the last exchange
Website security and prevention of abuseTechnical logs and IP addressLegitimate interest, Art. 6(1)(f) GDPRUp to 12 months
Statistical analysis and consent-based marketingCookies and non-technical online identifiersConsent, Art. 6(1)(a) GDPR, collected through the cookie bannerAccording to the cookie duration or until consent is withdrawn

4. Nature of the provision of data

The data required for registration, login and purchase are mandatory. Without these data, we will not be able to create or manage the account, process the order or provide the requested services.

Analytics and marketing cookies are optional and are used only when you have given the relevant consent.

5. Recipients and processors

We share data only with providers that perform services on our behalf and that, where required, are appointed as processors pursuant to Art. 28 GDPR.

  • Hosting and servers: Netsons, for infrastructure, hosting and maintenance.
  • Email and SMTP providers: providers used to manage communications.
  • Payment services: the providers available on the website receive the data strictly necessary to complete the payment.
  • IT support and backups: persons responsible for technical maintenance and managing backup copies.
We do not sell your data. Data received through Facebook or Google are not disclosed to third parties for purposes other than authentication and account management.

6. Transfers outside the European Economic Area

We prefer providers with data centres located within the European Economic Area. Where a service involves transferring data to third countries, processing will be based on appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission, or another mechanism compliant with Articles 44–49 GDPR.

7. Retention and deletion

  • Account and Social Login: until the account is deleted or closed.
  • Orders and tax documents: for the period required by law, up to 10 years.
  • Technical logs: up to 12 months.
  • Cookies: according to the duration indicated in the Cookie Policy.

To delete your data or disconnect Social Login, you may:

8. Data subject rights

You may exercise the rights provided for in Articles 15–22 GDPR, including access, rectification, erasure, restriction, portability, objection and withdrawal of consent.

To exercise your rights, write to privacy@ideeinfeltro.com. You also have the right to lodge a complaint with the Italian Data Protection Authority.

9. Security

The website uses encrypted HTTPS connections, role-based access controls, back-office authentication tools, periodic backups and appropriate technical and organisational measures to protect personal data.

10. Minors

The service is intended for users aged 13 or over. We do not knowingly collect personal data from children under this age. If you believe that a child has provided us with personal data, please contact us so that we can assess its removal.

11. Social Login and third-party policies

When you use Social Login, Facebook and Google process certain data as independent data controllers, in accordance with their respective policies:

13. Changes to this policy

This policy may be updated to reflect regulatory changes, changes to services or changes in processing methods. The updated version will be published on this page together with the relevant date.

HOBBYKIT SRLS – Via Michelangelo Buonarroti, 45 – 83035 Grottaminarda (AV) – VAT No. 02966380640

Product added to wishlist