01Data controller
The data controller is MEGADV di Tedesco Andrea, with registered office in Via F. Nicotera 100, 88046 Lamezia Terme (CZ), Italy — VAT no. 03341280794. You can contact us at info@printshapes.it or, by certified email, at andreatedd@pec.it.
No Data Protection Officer (DPO) has been appointed as it is not mandatory for this activity.
02What data we collect
We collect only the data needed to provide our service:
- Identification and contact data: first and last name, email, phone, shipping and billing address — when you register, place an order or request a quote.
- Order data: products purchased, amounts, tax documents.
- Account credentials: email and password (stored only as a secure hash, never in clear text).
- Support messages: the content of requests sent via form, email or chat.
- Return requests: the products to return, the reason, and any message and photos you upload, used only to assess and handle the return or the guarantee.
- Technical data: IP address and essential session data, used for security and to make the site work.
- Shipping addresses: if you use the account area, you can save an address book with one or more delivery addresses.
- Strong authentication credentials (passkey): if you enable passkey sign-in, we store only a public key. No biometric data ever leaves your device.
- Technical data from the quote form: when you send a quote request we record your IP address together with the request, solely to prevent abuse and automated submissions.
We do not collect payment card data: payments are handled directly by PayPal. We do not knowingly collect data from minors under 16.
03Purposes and legal bases
We process your data for the following purposes:
- Managing orders, payments, shipping and after-sales — legal basis: performance of the contract (art. 6(1)(b) GDPR).
- Shipment status updates — to update your order status automatically (in transit, out for delivery, delivered) we send only the tracking number and the name of the courier to the 17TRACK service, which checks them against the courier’s data; we do not send your name, address, email or phone number. When the parcel is delivered we email you, and the 14 days for returns start from that date. Legal basis: performance of the contract (art. 6(1)(b) GDPR).
- Account creation and management — performance of the contract / your request.
- Tax and accounting obligations — legal obligation (art. 6(1)(c) GDPR).
- Replying to support and quote requests — legal basis: pre-contractual measures / legitimate interest.
- Site security and fraud prevention — legitimate interest (art. 6(1)(f) GDPR).
- AI chatbot support — when you use the chatbot, the text of your message is sent to an artificial-intelligence provider (OpenAI) to generate the reply. Legal basis: legitimate interest in providing pre-sales support (art. 6(1)(f) GDPR). Please do not enter personal or payment data in the chat. To improve our answers we keep conversations for 90 days in pseudonymised form: without IP address and without any link to your account, with emails, phone numbers, order codes, IBANs and card numbers automatically masked before saving (legal basis: legitimate interest in improving our support, art. 6(1)(f) GDPR). After 90 days the text is deleted and only anonymous statistics by topic (e.g. shipping) remain, which are not personal data. You can delete your conversation at any time with Delete this chat in the assistant window, or object to the processing by writing to info@printshapes.it (art. 21 GDPR). If you choose to write to our team from the chat, your request and the conversation reach us by email so we can reply.
- Quote-form security — we process the IP address associated with quote requests to prevent abuse and automated submissions. Legal basis: legitimate interest (art. 6(1)(f) GDPR).
Providing the data marked as required is necessary to complete a purchase or to reply to a request; without it we cannot provide the service.
04Third parties and recipients
Your data may be processed, on our behalf or as independent controllers, by selected providers strictly to operate the service:
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.) — payment processing. EU (Luxembourg).
- Aruba S.p.A. — web hosting, email and database, with servers in the European Union.
- OpenAI — only when you use the support chatbot; the text of your message is sent to generate the reply. Outside the EU (United States). Avoid entering personal data in the chat.
- 17TRACK (Vastar Singapore Technology Pte. Ltd.) — shipment status: it receives only the tracking number and the courier, never name, address, email or phone. Outside the EU (servers in China and the United States).
- Shipping couriers — delivery of the order and, if you use our return label, collection of the return (name and address). EU.
- Accountant / public authorities — where required by law.
We never sell your personal data. Providers act under appropriate agreements (e.g. data processing agreements pursuant to art. 28 GDPR where applicable).
05Cookies
This site uses only technical and functional cookies, necessary for it to work and for security. We do not use analytics, profiling or marketing cookies, nor third-party advertising trackers. For this reason no consent banner is required.
The cookies and technologies used are:
- Session cookies (PHP): keep your browsing session and authentication (HttpOnly, SameSite=Lax, Secure over HTTPS).
- "Remember me" cookie (RWREMEMBER): if chosen at sign-in, keeps you authenticated for up to 30 days; it is deleted on logout, password change or reset.
- Security / CSRF tokens: protect against fraudulent requests.
- Cart localStorage (rw_cart): stores only the selected quantity, solely on your device, with no transmission to the server.
As these are strictly necessary cookies and technologies, your consent is not required (art. 122 of the Italian Privacy Code and the Italian DPA’s guidelines on cookies). You can still delete or block them in your browser settings, with a possible loss of some site features.
06Retention period
- Order and tax data: 10 years, as required by civil and tax law (art. 2220 of the Italian Civil Code). This obligation prevails over any erasure request.
- Account data: for as long as the account is active. It is deleted at your request or after a prolonged period of inactivity (36 months). In case of deletion, only the data needed for tax obligations is kept for the legal term indicated above; the remaining data is erased.
- Support and quote requests: for the time needed to handle the request and a reasonable period thereafter.
- Conversations with the AI assistant: 90 days in pseudonymised form (personal details masked), then deleted automatically; only anonymous statistics by topic are kept.
- Return requests and attached photos: until the request is closed and for the following 24 months (the length of the legal guarantee), then deleted. Accounting data of any refund follow the 10 years set for tax data.
- Technical and security logs: for the limited time needed for security purposes.
07Transfers outside the EU
Some providers (e.g. OpenAI and 17TRACK) may process data on servers located outside the European Economic Area, in particular in the United States and, for 17TRACK, in China. In such cases the transfer is based on appropriate safeguards under the GDPR, such as the European Commission’s Standard Contractual Clauses.
08Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy (art. 15);
- rectify inaccurate data (art. 16);
- erase your data, where applicable (art. 17);
- restrict processing (art. 18);
- data portability (art. 20);
- object to processing based on legitimate interest (art. 21).
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
09How to exercise your rights
To exercise your rights, write to info@printshapes.it or to the certified email andreatedd@pec.it. We will reply within the time limits set by the GDPR (normally within one month). We may ask you to confirm your identity before acting on the request.
10Security
We adopt appropriate technical and organisational measures to protect your data: encrypted (HTTPS) connections, passwords stored as secure hashes, protection against fraud and abuse, and access limited to what is necessary.
11Changes to this policy
We may update this Privacy Policy. The version in force is the one published on this page; the date of the last update is shown at the top.
12Contacts
For any question about this policy or your personal data: info@printshapes.it (general) or andreatedd@pec.it (certified email). Registered office: Via F. Nicotera 100, 88046 Lamezia Terme (CZ), Italy.