Last updated: 9 October 2026
This notice explains how personal data of visitors to www.schiumapostdesign.com and customers of Schiuma Post Design is processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 as amended.
1. Data controller
Tommaso Schiuma – Schiuma Post Design
Via Santa Cesarea 29bis, Matera (MT), Italy
VAT no. IT01206900779
E-mail: info@schiumapostdesign.com
2. What data we collect
- Order and invoicing data: first and last name, company name if any, billing and shipping address, e-mail, phone number, tax code or VAT number, SDI code or PEC if provided, details of the products purchased.
- Payment data: card or PayPal details are entered directly on the payment providers’ systems; we do not store them and only receive the result of the transaction.
- Customer account data: if you create an account, username, e-mail, password (encrypted) and order history.
- Contact data: the information you send us by e-mail, WhatsApp or through forms on the site.
- Newsletter subscription: e-mail address and any optional data.
- Browsing data: IP address, browser and device type, pages visited, date and time, collected by the site’s systems and, with your consent where required, by analytics and marketing tools (see the Cookie Policy).
3. Purposes and legal bases
- Managing orders, payments, shipping, returns and customer support – performance of a contract (Art. 6(1)(b) GDPR).
- Tax and accounting obligations – legal obligation (Art. 6(1)(c) GDPR).
- Managing your customer account – performance of a contract at your request (Art. 6(1)(b) GDPR).
- Answering your enquiries – pre-contractual steps at your request and legitimate interest in replying (Art. 6(1)(b) and (f) GDPR).
- Sending the newsletter – consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the link in every e-mail.
- Website security and prevention of fraud and unauthorised access – legitimate interest (Art. 6(1)(f) GDPR).
- Usage statistics and personalised advertising (Google Analytics, Meta Pixel) – consent (Art. 6(1)(a) GDPR) given through the cookie banner, which you can withdraw at any time.
- Protecting the controller’s rights in case of disputes – legitimate interest (Art. 6(1)(f) GDPR).
Providing the data required for orders is mandatory: without it the purchase cannot be completed. Providing any other data is optional.
4. Who we share data with
Data is processed by the controller and, only where necessary, by providers acting as processors or as independent controllers:
- Aruba S.p.A. (Italy) – website and database hosting;
- Stripe, through Automattic’s WooPayments, and PayPal – payment processing;
- GLS Italy and other couriers – order delivery;
- Mailchimp (Intuit Inc., USA) – newsletter delivery;
- Google Ireland Ltd / Google LLC – Google Analytics and related services (Site Kit, Google Fonts);
- Meta Platforms Ireland Ltd – Meta Pixel and measurement of ads on Facebook and Instagram; WhatsApp for conversations you start;
- Automattic Inc. – services related to WooCommerce;
- our accountant and advisers, for tax obligations;
- public authorities, where required by law.
Data is never sold or made public.
5. Transfers outside the European Union
Some providers (for example Google, Meta, Mailchimp, Stripe, PayPal) may process data in the United States. Transfers rely on the EU-U.S. Data Privacy Framework adequacy decision for certified companies, or on the Standard Contractual Clauses approved by the European Commission.
6. How long we keep data
- order and invoice data: 10 years, as required by tax and civil law;
- customer account: for as long as it remains active; you can ask for it to be deleted at any time;
- contact requests: for as long as needed to handle them and no longer than 24 months afterwards;
- newsletter: until you withdraw your consent;
- analytics and marketing data: for the period stated in the Cookie Policy and in the settings of the services used;
- technical security logs: only for as long as strictly necessary.
7. Your rights
You may at any time request access to your data, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interest (Articles 15-21 GDPR). You can withdraw any consent at any time, without affecting the lawfulness of processing carried out before withdrawal. To exercise your rights, write to info@schiumapostdesign.com.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of your country.
8. Cookies
For information on the cookies we use and how to manage your preferences, please see the Cookie Policy.
9. Changes
This notice may be updated. The current version is always published on this page, with the date of the last update.