Introduction
This policy is provided pursuant to Article 13 of EU Regulation 2016/679 on the protection of personal data (hereinafter referred to as "GDPR") and in accordance with the provisions of Italian Legislative Decree 196/03 (the "Privacy Code") in order to provide the user with information on the processing of his/her personal data related to the navigation and functionality of this website.
We inform the Data Subject, user or visitor of the website, that the EU Regulation 2016/679 (hereinafter, 'GDPR') provides for the protection of the processing of their personal data. In particular, the GDPR, together with Italian Legislative Decree No. 196/2003 (the so-called 'Personal Data Protection Code', hereinafter the 'Code') and other relevant legislation in force, stipulate that the processing of personal data must be based on the principles of fairness, lawfulness and transparency in respect of the fundamental rights and freedoms, the dignity of the Data Subject, with particular reference to confidentiality, personal identity and the right to protection of personal data.
This policy is subject to updates, which are published on the website.

1.         Definitions 
2.         Data Controller and Data Protection Officer 
3.         Place of Data Processing 
4.         Purpose of processing and type of Personal Data 
5.         Methods and duration of Processing 
6.         Optional provision of data 
7.         Possible recipients of Personal Data 
8.         Information Security 
9.         Rights of the Data Subject 

1. Definitions

For the purposes of this Privacy Policy:
‘Personal data’ means any information relating to a natural person, identified or identifiable, even indirectly, by reference to any other information;
‘Authorised person’ means the natural person authorised by the Data Controller or Processor to carry out processing operations;
‘Data Subject’ means the natural person to whom the Personal Data refer;
'Data Processor' means the natural person, the legal person, the public administration and any other body, association or organisation that processes data on behalf of the Data Controller;
‘Data Protection Officer (DPO)’ means the person or entity appointed by the Data Controller pursuant to Articles 37-39 of the GDPR;
'Website' means the website https://shop.dececco.com
‘Data Controller’ means the natural person, the legal person, the public administration and any other body, association or organisation responsible, also jointly with other Data Controller(s), for deciding on the purposes and means of the processing of Personal Data and the instruments used, including security measures;
‘Processing’ means any operation or set of operations, carried out with or without the help of electronic means, concerning the collection, recording, organisation, keeping, interrogation, elaboration, modification, selection, retrieval, comparison, utilization, interconnection, blocking, communication, dissemination, erasure and destruction of data, whether the latter are contained or not in a database;
‘Disclosure’ means any disclosure likely to make Personal Data known to one or more specified parties other than the Data Subject, the Data Controller's representative in the territory of the State, the Data Processor and the Authorised Persons, in any form whatsoever, including by making available or consulting the Personal Data;
‘Consent’ means any manifestation of the Data Subject's free, specific, informed and unambiguous will, by means of a statement or unambiguous affirmative action, whereby the Data Subject indicates his/her assent to Personal Data relating to him/her being processed;
‘Profiling’ means any form of automated processing of Personal Data consisting of the use of such Personal Data to evaluate certain personal aspects relating to a natural or legal person, in particular to analyse or predict aspects of that person's professional performance, financial situation, health, personal preferences, interests, reliability, behaviour, location or movements, willingness to purchase, etc.;
‘Pseudonymisation’ means the Processing of Personal Data in such a way that it cannot be attributed to a Data Subject without the use of additional information, provided that such additional information is stored separately and subject to technical and organisational measures to ensure that the Personal Data is not attributed to the identified or identifiable Data Subject;
‘User’ means any natural person using the Website.

2. Data Controller and Data Protection Officer

2.1 The Data Controller is F.LLI DE CECCO DI FILIPPO FARA SAN MARTINO S.p.A. with registered office in Via F. De Cecco, Fara San Martino (CH), Italian Tax code - VAT number 00628450694, in the person of its Legal Representative Cav. Filippo Antonio De Cecco, (hereinafter referred to as 'OWNER’ or ‘Company')

2.2 Information and requests concerning privacy, including those relating to the exercise of the rights of the Data Subject indicated in Article 9 below, may be addressed to the Company by e-mail at the address privacy@dececco.it.

2.3 The Data Protection Officer (DPO) appointed by the Company is Giulio Maria Garofalo, who can be contacted at the e-mail address DPO@dececco.it.

3. Place of Data Processing

Personal Data is processed on servers located within the European Union. Currently, the servers are located in Italy. Some service providers used by the Data Controller, such as the email communication platform, may also process Personal Data outside the European Union. In this case, the Data Controller ensures that the transfer is carried out in compliance with applicable legal provisions, based on an adequacy decision by the European Commission (e.g., for the United States, the EU-US Data Privacy Framework, Article 45 of the GDPR) or with the appropriate safeguards provided for by Article 46 of the GDPR, such as the Standard Contractual Clauses approved by the European Commission.

4. Purpose of processing and type of Personal Data

4.1 Browsing Personal Data
The computer systems and software procedures used to run the Website acquire certain Personal Data during their normal operation, as they are implicitly transmitted by Internet communication protocols. This is information that is not collected in order to be associated with identified Data Subjects, but which by its very nature could, through processing and association with data held by third parties, allow Users to be identified. This category of Personal Data includes the IP addresses or domain names of the computers used by Users who connect to the Website of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the User's operating system and computer environment. These Personal Data are used for the sole purpose of obtaining anonymous statistical information on the use of the Website and to check its correct functioning, and are deleted immediately after processing. These Personal Data could be used to ascertain liability in case of computer crimes against the Website. In any case, these Personal Data are kept for the period of time strictly necessary and in any case in accordance with the relevant regulations in force.

4.2 Cookies
4.2.1 Full details on this type of Data are provided in the dedicated "cookie policy" section that can be consulted at the link https://shop.dececco.com/area-legale/cookie-policy and by means of specific information text displayed before the collection of cookies for which the User's consent is required.

4.3 Newsletter subscription
By filling in the dedicated form, the user can subscribe to the newsletter, thereby consenting to receiving communications of an informative and commercial nature by e-mail.
4.3.1 The Personal Data collected include the e-mail address and are processed for marketing and communication purposes. Users may unsubscribe at any time through the opt-out mechanism provided in each communication or through their personal area or by sending a request to privacy@dececco.it
4.3.2 Tracking of email communications via tracking pixels. Subject to specific consent, distinct and separate from that relating to newsletter subscription, email communications sent by the Data Controller may contain tracking pixels, which allow the following to be detected for each individual recipient:

• whether and when the email is opened and the number of times;
• links clicked within the communication;
• the type of device, operating system, and email program used, the IP address, and the approximate location (city level) derived from it.

This information is associated with the User's email address and processed for the following purposes: (a) measuring interest in individual communications and improving their content; (b) analyzing the User's preferences and interests (for example, the product categories of greatest interest) in order to send them personalized communications and offers. This activity constitutes a form of profiling, which does not involve decisions based solely on automated processing that produce legal effects or similarly significantly affect the User.
Legal basis: The processing is based on the User's consent (Article 6, paragraph 1, letter a) of the GDPR and Article 122 of the Code). Consent is optional: failure to provide it or its withdrawal does not prevent you from subscribing to the newsletter or taking advantage of related promotions, but it does result in communications being sent without individual tracking tools.
Withdrawal: Consent may be withdrawn at any time through your personal area, via the "Manage preferences" link found in every communication, or by writing to privacy@dececco.it.
Retention: Personal Data collected via tracking pixels is retained for 12 months from its collection, after which it is deleted or anonymized. Consent is valid for 24 months, after which renewal may be requested.
Recipients: The data is processed, on behalf of the Data Controller, by the email communication platform provider, appointed as Data Processor pursuant to Art. 28 GDPR. For any transfers outside the EU, please refer to paragraph 3.

4.4 Website Registration
By registering in the appropriate section of the Website ("Login"), the User authorises the Controller to process Personal Data such as, but not limited to, name, surname, telephone number and e-mail address, in order to complete and manage the Login process.
4.4.1 The Personal Data collected include first name, last name, e-mail address, password, date of birth*, shipping/billing address*, purchase history, purchase preferences (wishlist), which are collected and processed, until the user voluntarily unsubscribes, for the following purposes:

1. management of the User's Login to the Website to enable the User to benefit from services reserved for members (wishlist, purchase history, consent management, coupon management, etc.); the legal basis is the execution of the service requested by the User (art. 6, par. 1, letter b) GDPR);
2. subject to specific consent, the sending of communications of an informative and commercial nature (newsletter), as described in paragraph 4.3;
3. subject to the granting of specific consent, profiling activities that include sending communications of a commercial nature customised on the basis of the analysis of the user's preferences. If the User has also provided consent as per paragraph 4.3.2, the analysis may include interactions with email communications. The legal basis is consent (Article 6, paragraph 1, letter a) of the GDPR); the data used for profiling are retained for 12 months from collection.

* An asterisk indicates optional data.

4.5 Purchases
In order to use the e-commerce service and purchase products on our e-shop, the User must fill in the payment form and the shipping form.
Through these forms, the Controller collects and processes identifying, personal and contact data such as: first name, last name, billing address; shipping address for purchased products, city, postcode, e-mail address, telephone number, and any notes for delivery. Payment Data such as credit card number, expiry date, security code, first name and surname of the cardholder are NOT accessible to the Data Controller, but are managed through a party acting as a separate autonomous data controller, and information on the processing carried out by such party will be available in the payment area. The company is not responsible for that procedure and does not receive or in any other way manage data relating to the payment methods used by Data Subjects or Users.
4.5.1 the aforementioned personal data are processed for the following purposes:

1. Management of the contractual relationship, including customer registration, administrative management of the order, shipment and/or delivery of products; the legal basis for such processing is the performance of an existing contract with the Data Subject [Article 6(1)(b) GDPR].
2. Fulfilment of legal obligations related to the contract; the legal basis for such processing is the fulfilment of obligations under the law or EU legislation [Article 6(1)(c) GDPR].
3. Protection of rights in the event of disputes or complaints; the legal basis for such processing is the legitimate interest of the Controller to have its rights protected [Article 6(1)(f) GDPR].
4. Soft spam: sending commercial communications by e-mail referring to products similar to those purchased by the user. These communications are based on the legitimate interest of the User, who may, however, object at any time through the opt-out mechanism present in each communication, or by writing to the address privacy@dececco.it. These communications do not contain tracking pixels, unless the User has given the consent referred to in paragraph 4.3.2.
5. Profiling: subject to the User's specific consent, as described in paragraphs 4.3.2 and 4.4.1, point 3; the legal basis is consent [Article 6, paragraph 1, letter a, GDPR].
6. Statistical analysis based on anonymised data and sales performance; the legal basis for this processing is the legitimate interest of the Data Controller [Article 6(1)(f) GDPR].

4.5.2 Data processed for the purposes referred to in points 1 and 2 are retained for the duration of the contractual relationship and, subsequently, for 10 years, in compliance with the retention obligations established by law (Article 2220 of the Italian Civil Code); data processed for the purpose referred to in point 3 are retained for the time necessary to protect the Data Controller's rights, within the limits of the statute of limitations; and data processed for the purpose referred to in point 4 are retained until the User objects.

4.6 Requests for information and submission of reports
4.6.1 By filling in the contact forms on this website, sending paper or electronic mail messages to the addresses published on the website, or issuing comments or requests via social media pages, the Data Controller acquires the personal and contact data (first name, surname, e-mail address, telephone number) and any personal data entered by the User in the communications. These data are processed for the sole purpose and for the period necessary to provide feedback on users' requests, for a maximum of three years. The legal basis for the Processing is therefore the execution of a request by the data subject (art. 6, par. 1, letter b) GDPR).

4.7 Personal Data voluntarily provided by Users
4.7.1 The voluntary, optional and explicit forwarding of Personal Data by the User (e.g. when entering his/her Personal Data by filling in specific forms, sending e-mails to the addresses indicated on the Website, etc.) entails the subsequent acquisition of the sender's address and of the Personal Data provided by the same, for the Processing of which the Data Controller is justified by the need to prepare or execute a contract requested by the Data Subject, pursuant to Article 6.1.b) of the GDPR.

5. Methods and duration of Processing

The Personal Data collected are:

1. processed by means of automated electronic and computerised devices and telecommunications, or by manual processing in manners in line with to the purposes for which the Personal Data were collected;
2. processed lawfully, fairly and transparently as regards the Data Subject;
3. collected for specified, explicit and legitimate purposes, and subsequently processed in a manner consistent with those purposes;
4. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
5. exact and, if necessary, updated;
6. stored in a way that allows the identification of the interested party for a period of time not exceeding the achievement of the purposes for which they are processed, according to the times indicated for each purpose in paragraph 4;
7. processed in such a way as to ensure adequate security - including protection, through appropriate technical and organisational measures - against unauthorised or unlawful processing and accidental loss, destruction or damage.

The Processing of Personal Data is based on the principles of fairness, lawfulness and transparency.

6. Optional provision of data

Except for Personal Data related to browsing, the provision of Personal Data by the Data Subject is optional, but refusal may prevent the timely and correct handling of the contact request, prevent the User's Login to the Website and also the conclusion or execution of purchase orders. Providing consent for sending the newsletter, for profiling, and for tracking via tracking pixels is optional: failure to provide it will not affect the purchase of products or the use of the Website.

7. Possible recipients of Personal Data

7.1 Personal Data shall not be disclosed to third parties, unless this is indispensable and, in that case, the Disclosure shall only concern the Personal Data strictly necessary to achieve the purposes of the Processing indicated in the Privacy Policy.

1. Personal Data may be disclosed to third parties who, on the Company's behalf, provide services necessary for the operation of the Website, the receipt and processing of orders and after-sales services, all of whom shall be appropriately authorised or appointed as data processors pursuant to Article 28 of the GDPR;
2. administrative or judicial authorities for the fulfilment of legal obligations.

7.2 For payment services, the company uses a provider who acts as an autonomous separate data controller, and information on the processing carried out by such party will be available in the payment area. The company is not responsible for that procedure and does not receive or in any other way manage data relating to the payment methods used by Data Subjects or Users.

8. Information Security

8.1 All information collected on the website is stored and maintained in secure facilities that restrict access to authorised personnel only. The website is regularly monitored for security breaches and to ensure that the information collected is safe from unauthorised viewing. The Data Controller complies with the security measures prescribed by applicable laws and regulations and all appropriate measures in accordance with the current state-of-the-art criteria, in order to ensure and guarantee the confidentiality of the User's Personal Data and to minimise, as far as possible, the dangers of unauthorised access, removal, loss and/or damage to the User's Personal Data.

8.2 In accordance with Article 32 of the GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing of Personal Data, as well as the risks (with different degrees of probability and severity) to the rights and freedoms of natural persons posed by the Processing of Personal Data, the Controller shall implement appropriate technical and organisational measures, both when determining the means of Processing and during the Processing itself. These measures shall include Pseudonymisation and encryption of Personal Data and shall be designed to ensure effective compliance with Data Protection principles such as minimisation. They integrate the Processing of Personal Data with the necessary safeguards to comply with the requirements of the GDPR and to protect the rights of Data Subjects.

9. Rights of the Data Subject

9.1 The Data Subject may, at any time, exercise the rights set out in Chapter III of the GDPR. In particular, the Data Subject has the following rights:
access to Personal Data concerning him/her in order to obtain information on the methods and purposes of Processing;
rectification of the Personal Data provided, if inaccurate;
erasure of the Personal Data provided, which shall occur upon revocation by the Data Subject of their Consent to the Processing or upon objection to it (in addition to the obligation to erase Personal Data in cases of unlawful Processing or when there is a legal obligation to delete them);
limitation of the Processing of Personal Data, when one of the conditions set out in Article 18 of the GDPR applies;
object, at any time, to the processing of Personal Data, unless there is a legitimate interest of the Controller to proceed with the Processing that overrides the right to object;
portability, which consists in the right of the Data Subject to request to receive Personal Data, or to have them transmitted to another Data Controller designated for that purpose, in a structured, commonly used and machine-readable format.
9.2 Furthermore, pursuant to Article 7(3) GDPR, the Data Subject may exercise the right to withdraw Consent at any time. Withdrawal of Consent shall not affect the lawfulness of the Processing of Personal Data for the period during which the Consent was effective. If Consent is revoked, however, the Controller may continue with the processing of data whose legal basis is different from Consent.

9.3 These rights may be exercised by sending us a specific request by email to the address privacy@dececco.it.

9.4 The Data Subject also has the right to lodge a complaint before the supervisory Authority, which for Italy is the Italian Data Protection Authority. It can be contacted at www.garanteprivacy.it

Date of last update: 26-10-2026