Privacy policy

Privacy Notice pursuant to Regulation (EU) 2016/679 (GDPR)

Last updated: October 24, 2026

This Privacy Notice describes how we process the personal data collected through the website botteghino.eu (hereinafter also "the Site"). Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and the Italian Privacy Code (Legislative Decree 196/2003) as amended by Legislative Decree 101/2018.

1. Data Controller

The Data Controller for your personal data is:

IL BOTTEGHINO DI ZIINO DANIELE (sole proprietorship, owner Daniele Ziino)
Registered office: Via Vittorio Emanuele 33/35, 98055 Lipari (ME), Italy
VAT no.: 02734750835 | VAT EU: IT02734750835
REA no.: MESSINA 189833
Email: info@botteghino.eu
PEC: ilbotteghino79@pec.it
Phone: 090 9817020

For any request regarding the processing of personal data, you can contact us at the details above. The Controller has not appointed a Data Protection Officer (DPO) because the conditions that make this mandatory under Art. 37 GDPR do not apply.

2. Categories of personal data collected

Depending on how you interact with the Site, we may collect the following categories of personal data:

Identification and contact data: first name, last name, mailing address, email, phone number;
Payment data: credit/debit card data, transactions, payment confirmations. Complete payment data does not pass through our servers. It is handled directly by the payment processor (Shopify Payments / Stripe / PayPal / Google Pay / Shop Pay), in compliance with the PCI-DSS standard.
Account data: username, password (encrypted), preferences and order history;
Browsing data: IP address, device identifiers, browser type, operating system, pages visited, length of visit, products viewed and added to the cart;
Communication data: content of messages sent to customer support or through contact forms.

3. Purposes of processing and legal bases

Data is processed for the following purposes, each with its legal basis under Art. 6 GDPR:

A. Performance of the contract (Art. 6.1.b GDPR) - no consent required

Order management, fulfillment, shipping, invoicing
Handling of returns, exchanges and refunds
Transactional communications (order confirmation, shipping notifications)
Customer support

B. Legal obligations (Art. 6.1.c GDPR) - no consent required

Tax, accounting and fiscal compliance
Retention of accounting records (10 years, Art. 2220 of the Italian Civil Code)
Responding to requests from public authorities

C. Marketing and newsletter (Art. 6.1.a GDPR + Art. 130 of the Italian Privacy Code) - requires your explicit consent, collected separately

Sending promotional emails
Personalized offers based on past purchases
Newsletter

Consent to marketing is optional, can be withdrawn at any time and is independent of any purchase. You can unsubscribe by clicking the "Unsubscribe" link in every promotional email.

D. Legitimate interest (Art. 6.1.f GDPR) - no consent required, but you have the right to object

Fraud prevention and protection of our systems
Handling of complaints and disputes

E. Cookies and tracking technologies (Art. 122 of the Italian Privacy Code + 2021 Cookie Guidelines of the Italian data protection authority) - see the Cookie Policy for details. Only technical cookies do not require consent; all others require your prior consent through the banner.

Statistical analysis of how the Site is used (Google Analytics 4) is loaded only after you give consent through the banner (Art. 6.1.a GDPR). You can withdraw your consent at any time under "Cookie preferences".

4. How we process data

Data is processed with electronic tools, using technical and organizational measures suited to ensure a level of security appropriate to the risk, pursuant to Art. 32 GDPR. Credentials are stored in encrypted form. Access to data is limited to authorized personnel.

5. Retention period

Data is kept only for as long as strictly necessary for the purposes for which it was collected, and in particular:

Order and accounting data: 10 years from completion of the transaction (Art. 2220 of the Italian Civil Code)
Customer account data: until the data subject requests deletion, subject to legal retention obligations
Marketing data: until consent is withdrawn, and in any case no longer than 24 months after the last active interaction (email open, click, purchase)
Browsing and statistics data (Google Analytics 4): 14 months for user-level data
Communications with customer support: up to 2 years after the request is closed
Withdrawal requests sent with the website form: 24 months from the request in the log of the confirmation service, then deleted automatically; data linked to the order and the refund follows the retention of order data

6. Recipients of the data

Your data may be shared with third parties acting as data processors (Art. 28 GDPR) for the purposes above. The main ones are:

Shopify Inc. (Canada/Ireland) - e-commerce platform, hosting, checkout
Shopify Payments / Stripe - card payment processing
Shipping carriers (Poste, BRT, DHL, GLS or others) - delivery of products
Google LLC (USA/Ireland) - statistical analysis with Google Analytics 4 and Google Tag Manager (only after consent), Search Console, Merchant Center
Email marketing providers (if enabled) - sending the newsletter
Moccogni Consulting (Switzerland) - service that records withdrawal requests sent with the website form and emails the customer an acknowledgment of receipt, on a server of Hetzner Online GmbH in Helsinki (Finland, EU)
Aruba S.p.A. (Italy) - email service for the address info@botteghino.eu
Advisors: accountant, and lawyers if needed

These parties process data solely to provide the services we request, under contracts that bind them to comply with applicable law. The up-to-date list of processors is available on request at the Controller's email address.

If you choose one of these payment methods, the provider receives the data needed for the payment and processes it as an independent controller, under its own privacy notice:

PayPal - payment with PayPal (payment buttons on the product page and at checkout)
Google (Google Pay) - payment with Google Pay at checkout
Shopify (Shop app and Shop Pay) - payment with Shop Pay at checkout

7. Transfers outside the EU

Some of our processors (in particular Shopify and Google) are based or use servers outside the European Economic Area, in particular in the United States and Canada. These transfers take place in compliance with Arts. 44-49 GDPR, on the basis of:

Adequacy decisions of the European Commission (e.g. the EU-US Data Privacy Framework for the USA, decision of July 10, 2023)
Standard Contractual Clauses (SCC) approved by the European Commission
Supplementary technical and organizational measures (encryption, pseudonymization)

Moccogni Consulting is based in Switzerland, a country for which the European Commission has adopted an adequacy decision (Decision 2000/518/EC).

8. Rights of the data subject

As a data subject, under Arts. 15-22 GDPR you have the right to:

Access (Art. 15): obtain confirmation that processing exists and a copy of your data
Rectification (Art. 16): correction of inaccurate or incomplete data
Erasure / "right to be forgotten" (Art. 17): removal of your data, subject to legal retention obligations
Restriction (Art. 18): temporary blocking of processing in certain cases
Portability (Art. 20): receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller
Objection (Art. 21): object to processing for direct marketing purposes or on legitimate grounds
Withdrawal of consent (Art. 7): for processing based on consent, without affecting the lawfulness of processing based on consent before its withdrawal
Not to be subject to automated decisions (Art. 22), including profiling, that produce legal or similarly significant effects

To exercise these rights, write to info@botteghino.eu or send a PEC to ilbotteghino79@pec.it. We will reply within 30 days of your request (extendable to 60 in complex cases, with notice to the requester).

9. Complaint to the Garante

If you believe that the processing of your personal data violates the GDPR or applicable law, you have the right to lodge a complaint with the Italian supervisory authority:

Garante per la protezione dei dati personali (Italian data protection authority)
Piazza Venezia 11, 00187 Rome
Web: www.garanteprivacy.it
Email: protocollo@gpdp.it | PEC: protocollo@pec.gpdp.it

10. Security

We adopt appropriate technical and organizational measures to protect personal data from unauthorized processing, loss, destruction or unlawful access, pursuant to Art. 32 GDPR. Data is transmitted on the Site over the HTTPS protocol with TLS encryption. However, no system can guarantee absolute security: we encourage users to use strong passwords and not to share them.

11. Minors

The Site is not aimed at children under 16 and we do not knowingly collect personal data from minors. If a parent or guardian learns that their child has given us personal data without the required consent, they can contact us at the Controller's details to request its removal.

12. Changes to this notice

This Privacy Notice may be updated at any time to reflect legal, technical or organizational changes. The current version is always available on this page. Material changes will be communicated through a notice on the Site or, where the conditions apply, by email.

13. Contact

For any question about this Privacy Notice or to exercise your rights:

Email: info@botteghino.eu
PEC: ilbotteghino79@pec.it
Phone: 090 9817020
Address: Via Vittorio Emanuele 33/35, 98055 Lipari (ME), Italy