Who processes the data and which data
The data controller is MAGLASS S.r.l., owner of the Bottega Veneziana brand, via Venier 1, 30020 Marcon (VE), Italy, VAT no. IT04434140275. For any privacy request, write to clienti@bottega-veneziana.com.
Which data we collect
- Contact data: name, surname, email, telephone, country.
- Order and shipping data: shipping and billing address, items purchased, amounts, discount code used.
- Tax data: tax code (codice fiscale) for Italian private individuals; company name, VAT number, registered office, SDI code or PEC address for companies. The VAT number is checked in the European VIES register.
- Payment data: method used, outcome and transaction references. We neither receive nor store card data: it is handled directly by Stripe, PayPal and Klarna.
- Request data: what the customer writes to us in the contact and quotation forms, including whether they are a private individual or a professional and their role.
- Browsing data: IP address, browser, pages visited. Data collected through statistics and marketing cookies only with the visitor's consent.
We do not ask for special categories of data such as health, religion or political opinions. The site is not aimed at people under 18.
Why we use the data and for how long
Every use has a legal basis provided by the GDPR (Regulation EU 2016/679, art. 6). The mandatory checkout data is needed to conclude the order: without it, we cannot accept the order.
| Purpose | Legal basis | For how long |
|---|---|---|
| Managing the order: payment, production, shipping, assistance, returns | Performance of the contract | For the duration of the order and of the warranty (2 years from delivery) |
| Invoices and accounting records | Legal obligation | 10 years, as required by tax law |
| VAT number check on VIES | Legal obligation (correct VAT regime) | Together with the invoice data |
| Answering requests and quotations | Pre-contractual measures requested by the data subject | 24 months from the last contact, if it does not become an order |
| Contacting again those who asked for a quotation on the same project | Legitimate interest | Until objection, at most 24 months |
| Newsletter and news from the furnace | Consent, revocable at any time | Until consent is withdrawn |
| Visit statistics and advertising (cookies) | Consent given in the cookie banner | According to the duration stated in the cookie policy |
| Anonymous browsing statistics (technical cookie bv_nav) | Legitimate interest in the proper functioning of the site | Session; aggregate data 90 days |
| Anonymous recording of visits to improve the site (pages, clicks and scrolling; form fields masked) | Legitimate interest in improving the site; you can object at any time | 60 days, on our own servers only |
| Visitors arriving from a Meta ad: we send Meta the click code of the ad and the browser type (no email, telephone or IP address) when they arrive, show interest or send a request | Legitimate interest in knowing which ads work; you can object at any time | Meta uses this data only to measure campaigns |
| Measuring the effectiveness of advertising campaigns: the data of the request form (email and telephone, hashed) is sent to Meta | Consent given with the optional box in the form or in the cookie banner; for United States residents, unless they opt out (see below) | The choice is recorded with the request (24 months); Meta uses the data only to measure campaigns |
| Payment fraud prevention and site security | Legitimate interest | As long as necessary, at most 12 months for technical logs |
| Defence in case of disputes | Legitimate interest | Until the end of the dispute |
Who we share the data with
We do not sell data to anyone. We share it only with those we need to carry out the purposes above, acting as our data processor or as an independent controller.
| Who | Why | Where |
|---|---|---|
| Wise | Transfers in foreign currency (USD, GBP, AUD) | EU, UK, USA, Australia |
| PayPal | PayPal payments | EU and USA |
| Klarna | Payments in 3 instalments | EU |
| Bank (BCC Pordenonese e Monsile) | Bank transfers | Italy |
| Couriers | Delivery of the items | Country of destination |
| Amazon Web Services | Servers hosting the site and the management system | United Kingdom (London) |
| Brevo and Google (Gmail) | Order emails and newsletter | EU and USA |
| Accountant and consultants | Accounting and tax obligations | Italy |
| Google, Meta | Statistics and advertising, with consent (in the United States unless the visitor opts out) | EU and USA |
| Authorities | When required by law | Italy |
The data may also be seen by MAGLASS staff who handle orders, administration and assistance.
Transfers outside the European Union. The servers of the site and of the management system are located in the United Kingdom, a country for which the European Commission has recognised an adequate level of protection. Some providers also process data in the United States. The transfer takes place with the safeguards provided by the GDPR: participation in the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission. For shipments outside the EU, the data needed for delivery and customs clearance is communicated to the courier and to the customs authorities of the destination country.
Cookies, rights and complaints
Cookies. The site uses technical cookies, necessary for the cart and checkout to work, which require no consent. Statistics and marketing cookies (Google Analytics and the Meta pixel) start only if the visitor accepts them in the banner, and consent can be changed at any time from the "Cookie preferences" link at the bottom of every page. Details are in the cookie policy. To improve the site we also record browsing anonymously (pages viewed, clicks and scrolling; form fields are masked and not recorded). Recordings stay on our own servers only, are not shared with third parties, are used to understand whether pages are clear and are kept for 60 days; you can object by writing to clienti@bottega-veneziana.com.
Anonymous browsing statistics. To check that the site’s link structure works, we also use a first-party technical cookie, bv_nav, valid for a single visit only (it is renewed after 30 minutes of inactivity). It contains a random code used to count, in aggregate form, the steps from one page to another, the part of the page used to move on (menu, text, cards) and the actions taken on the page (opening an enquiry, filling in and sending a form, adding to the cart). It collects no name, email or IP address. The code is deleted within 12 hours of the end of the visit, and aggregate data are kept for no longer than 90 days. They are never combined with other data or used for profiling or advertising, so the cookie is treated as a technical cookie and does not require consent.
For visitors from the United States, the section «United States residents» applies.
The rights of those who entrust us with their data. At any time you can ask clienti@bottega-veneziana.com to:
- know which data we hold and obtain a copy;
- correct or complete it;
- delete it, except for data the law requires us to keep, such as invoices;
- restrict its use or object to uses based on legitimate interest;
- receive it in a format readable by another service (portability);
- withdraw consent to newsletters and cookies, without affecting previous uses.
We reply within 30 days.
Complaints. Anyone who believes their data is being processed incorrectly can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority of their own EU country.
Changes. If we change this notice, we publish the new version here with the update date.
United States residents
Opt-out model. For visitors connecting from the United States, the site applies the model provided by state privacy laws, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA): the Meta pixel and Google Analytics are active without prior consent, and browsing data and the data of requests sent may be shared with Meta to measure and improve advertising. Under these laws this sharing may be considered a «sale» or «sharing» of personal information, even though we receive no money in exchange.
Do Not Sell or Share My Personal Information. You can opt out at any time with the «Do Not Sell or Share My Personal Information» link in the notice shown on the first visit and at the bottom of every page: from then on, the Meta pixel and Google Analytics no longer run in that browser and requests sent are not passed on to Meta. We also honour the browser's Global Privacy Control (GPC) signal as an opt-out request.
Other rights. United States residents can ask to know which personal information we hold, to correct it or to delete it by writing to clienti@bottega-veneziana.com. We do not discriminate against anyone who exercises these rights. We reply within 45 days.