PRIVACY POLICY

​Privacy notice provided pursuant to Article 13 of Regulation (EU) 2016/679 to users of the website www.profumeriaartisticadivinatoscana.it and to customers of the online shop. Last updated: 04/10/2026.

1. Data controller

The data controller is MEZZETTI MICHELA, a sole proprietorship trading as «Divina Toscana — Profumeria Artistica», Via San Giovanni 31, 53037 San Gimignano (SI), Italy, VAT no. IT01258300522, REA SI-133280. For any matter concerning personal data: info@profumeriaartisticadivinatoscana.it, +39 392 789 6648, or by post to the registered address.

2. Data protection officer

The Controller has not appointed a Data Protection Officer, as the conditions set out in Article 37 of the GDPR do not apply.

3. What data we process, why and for how long

We process the data you provide through the website — cart and checkout, customer account, contact forms, newsletter sign-up, reviews, purchase of gift cards — and the data generated by your browsing.

Order fulfilment (conclusion of the contract, payment, shipping, returns, withdrawal and refunds): first name, surname, shipping and billing addresses, e-mail, telephone, country, order details and payment outcome. Legal basis: performance of the contract (Art. 6(1)(b)). Retention: 10 years for the part included in accounting records; otherwise until the expiry of the statutory warranty period (26 months from delivery) and of any claims.

Tax and accounting obligations: billing and payment data, tax code or VAT number if you request an invoice. Legal basis: legal obligation (Art. 6(1)(c); Art. 2220 of the Italian Civil Code). Retention: 10 years.

Payment fraud prevention: transaction data, IP address and device identifiers collected at checkout by the payment provider’s anti-fraud service. Legal basis: legitimate interest in preventing fraud and abuse (Art. 6(1)(f)). Retention: for the time needed for verification and to handle disputes.

Customer account, order history and wishlist: credentials, identification details, saved addresses, purchase history, saved products. Legal basis: performance of the contract (Art. 6(1)(b)). Retention: until the account is deleted or after 24 months of inactivity, after which only accounting data are kept.

Gift cards: the buyer’s data; the recipient’s name, e-mail address and message, provided by the buyer. Legal basis: performance of the contract for the buyer (Art. 6(1)(b)); legitimate interest in delivering the gift card for the recipient (Art. 6(1)(f)), who is informed at the first contact. Retention: until the gift card expires or is used, then 10 years for the accounting part.

Support, information requests and complaints (e-mail, telephone, WhatsApp, forms): contact details, order number and content of the request. Legal basis: performance of the contract if the request concerns an order, otherwise legitimate interest in replying (Art. 6(1)(f)). Retention: 12 months from the closure of the request; if the request concerns an order, up to 26 months from delivery (limitation period for the statutory warranty, Art. 133 of Italian Legislative Decree 206/2005).

Newsletter: e-mail address and preferences. Legal basis: consent given by ticking the sign-up box (Art. 6(1)(a)), which you may withdraw at any time. Retention: until you withdraw consent or unsubscribe.

E-mail communications about products similar to those you purchased: the e-mail address provided at the time of purchase. Legal basis: Article 130(4) of Italian Legislative Decree 196/2003, with the right to object free of charge at the time of collection and in every message. Retention: 24 months from the last purchase.

Reviews: name or nickname, rating, text and order data used to verify the purchase. Legal basis: consent to publication (Art. 6(1)(a)); legitimate interest in verifying the purchase (Art. 6(1)(f)). Retention: until you request removal or the product is withdrawn from the catalogue.

Website usage statistics: browsing data and identifiers collected through cookies or similar technologies. Legal basis: consent given through the banner (Art. 6(1)(a); Art. 122 of Italian Legislative Decree 196/2003); anonymised statistics without consent within the limits set by the Italian Data Protection Authority. Retention: for the periods indicated in the Cookie Policy.

Establishment, exercise or defence of legal claims: the data required for the specific dispute. Legal basis: legitimate interest (Art. 6(1)(f)). Retention: for the duration of the dispute and of the time limits for appeal.

We do not process special categories of data and we do not take decisions based solely on automated processing that produce legal effects concerning you. Anti-fraud checks on payments are carried out by the payment provider: a declined transaction does not prevent you from completing your purchase with another payment method or from contacting us.

4. Whether providing data is mandatory

The data marked as mandatory at checkout are necessary to conclude and perform the contract: without them it is not possible to purchase. Data for the newsletter, reviews and wishlist are optional and failure to provide them has no consequence on your purchase. Anyone purchasing a gift card warrants that they are entitled to provide the recipient’s data.

5. Who we share data with

Within the limits of the purposes indicated, data may be disclosed to: Wix.com Ltd. (Tel Aviv, Israel) and its group companies, which provide the platform, hosting, online shop, forms, reviews and customer account, as data processor; the card payment provider Wix Payments, with the Forter anti-fraud service, as an independent controller for transaction data; Apple (Apple Pay), Google Ireland Ltd. (Google Pay) and Klarna Bank AB (publ) (deferred payment), as independent controllers, when you choose that payment method; the couriers DHL and FedEx for delivery; Visitor Analytics GmbH (Ottobrunn, Germany) for usage statistics, as data processor; Wix.com Ltd. also for sending the newsletter (Wix Email Marketing); the agency that maintains the website and the provider of the domain name and e-mail service (My Like Web Italia S.r.l., Bettona PG, with hosting by Server Plan S.r.l., Cassino FR), as data processors; professionals and consultants for accounting, tax and legal obligations; authorities and public bodies where disclosure is required by law. The Controller does not store full payment card data. Data are not disseminated, except for reviews published under the name or nickname you have chosen. An up-to-date list of data processors is available from the Controller on request.

6. Transfer of data outside the European Union

The Wix platform is based in Israel, a country for which the European Commission has adopted an adequacy decision (Decision 2011/61/EU), and also uses infrastructure in the United States; payment, anti-fraud and digital wallet services may involve processing in the United States. In such cases the transfer takes place on the basis of an adequacy decision — including, for certified providers, the EU-U.S. Data Privacy Framework — or of the standard contractual clauses approved by the European Commission (Art. 46(2)(c)), supplemented by the measures indicated by the providers. Usage statistics are processed on servers located in Germany. You may ask us for a copy of the safeguards adopted.

7. How we protect data

Data are processed by electronic means and, for accounting purposes, also on paper, by persons authorised and instructed by the Controller, with technical and organisational measures appropriate to the risk: protected access and multi-factor authentication for the management dashboard, encrypted connection (HTTPS), payments handled in the providers’ PCI DSS-certified environments, access limited to those who need it.

8. Your rights

You may at any time exercise the rights provided for in Articles 15 to 22 of the GDPR: access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest and, in any case, objection to commercial communications. You may withdraw your consent to the newsletter and reviews as easily as you gave it — via the link in every e-mail or by writing to us — without affecting the lawfulness of processing already carried out. Write to info@profumeriaartisticadivinatoscana.it or to the registered address: we reply within one month, which may be extended by two months in complex cases; exercising your rights is free of charge except in the cases provided for in Article 12(5). If you believe that the processing infringes the GDPR you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy — www.garanteprivacy.it) or with the supervisory authority of the country where you live or work, without prejudice to your right to bring court proceedings.

9. Cookies

The use of cookies and similar technologies is described in the Cookie Policy, which forms an integral part of this notice.

10. Updates

This notice may be updated following changes in the law, in the services offered or in the providers used. The version in force is the one published on this page with its last-updated date; material changes are communicated to registered users and newsletter subscribers.