HomePrivacy Policy

Privacy Policy

Last updated: 2026-08-05

Issued pursuant to Articles 13–14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.

Data Controller

The Controller's contact details and fiscal information (registered name, VAT, REA, registered office, PEC) are published in the site footer and sourced from the "Legal" tab of the store settings. For any communication regarding the processing of personal data please write to the email address listed on the contact page.

No Data Protection Officer (DPO) has been appointed, as the requirements of Art. 37 GDPR do not apply.

Categories of data processed

  • Identification and contact data: first name, surname, email, phone number;
  • Delivery and billing data: shipping and billing address, VAT / Tax ID / SDI code for business customers;
  • Payment data: processed directly by Stripe Payments Europe Ltd. (PCI-DSS Level 1); GSS Forniture does not store card numbers;
  • Navigation and technical data: IP address, user agent, access logs, session identifiers;
  • Communications: content of messages sent via the contact form or email.

Purposes and legal bases

  • Order fulfilment, shipping, invoicing — Art. 6.1.b GDPR (performance of contract);
  • Tax and accounting obligations (10-year retention) — Art. 6.1.c GDPR (legal obligation);
  • Customer support and return handling — Art. 6.1.b GDPR (performance of contract);
  • Fraud prevention and site security — Art. 6.1.f GDPR (legitimate interest);
  • Newsletter and marketing communications — Art. 6.1.a GDPR (revocable consent);
  • Profiling and analytics cookies — Art. 6.1.a GDPR (explicit consent via banner).

Data processors

Data may be shared with the following entities, appointed as processors under Art. 28 GDPR:

  • Stripe Payments Europe Ltd. (Ireland) — payment processing;
  • Resend Inc. — transactional email delivery;
  • Cloudflare Inc. — CDN, DDoS protection and object storage (R2);
  • Hetzner Online GmbH (Germany) — application hosting;
  • Shipping carriers (BRT, GLS, DHL, UPS, Poste Italiane);
  • The Controller's tax/accounting consultants;
  • Judicial, tax and public-security authorities where required by law.

Transfers outside the EU

Some providers (Stripe, Cloudflare, Resend) may process data outside the EEA. In such cases, transfers take place under Standard Contractual Clauses approved by the European Commission or other mechanisms permitted by Art. 46 GDPR.

Retention periods

  • Order and invoicing data: 10 years (Art. 2220 of the Italian Civil Code);
  • Customer account data: until deletion is requested;
  • Technical logs: maximum 12 months;
  • Marketing email lists: until consent is withdrawn.

User rights

The user may at any time exercise the rights granted by Articles 15–22 GDPR:

  • Access to personal data;
  • Rectification or erasure;
  • Restriction or objection;
  • Portability;
  • Withdrawal of consent (without prejudice to the lawfulness of past processing);
  • Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

To exercise these rights, write to the email address published on the contact page. We respond within 30 days.

Cookies

The site uses technical cookies (strictly necessary, no consent required) and, subject to explicit consent via the banner, analytics and profiling cookies. The user can update preferences at any time via the "Manage cookies" link in the footer.

Changes

This privacy notice may be updated. The current version is always available on gssforniture.com with the date of last revision (shown at the top of the page).