name, email, phone number, the content of your request and anything you choose to send us, such as photos to reproduce on a creation (for example a portrait of a person or a pet), texts to be written, event dates. They may reach us through the website form, the app, email, phone, WhatsApp or social media messages.

answering you, preparing a quote, booking an appointment and making the creation you ask for. Requests are recorded in the workshop's internal management system; if you leave your number, we send you the confirmation and updates on WhatsApp.

pre-contractual and contractual measures taken at your request (Art. 6(1)(b) GDPR).

if you send us a photo of someone else (a relative, a child), please do so only if you have the right or the permission to. We use it only to make your creation and never publish it without your explicit consent.

24 months from the last contact if the request does not become an order; otherwise as in point b.

first and last name, billing and shipping addresses, email, phone, tax code or VAT number and recipient code when needed for the invoice, order details, payment data (we never see or store card numbers: they are handled by the payment provider).

concluding and performing the contract, preparing and shipping the order, issuing receipts or e-invoices, handling returns, warranty and support.

performance of the contract (Art. 6(1)(b) GDPR); for invoices, receipts and accounting, legal obligation (Art. 6(1)(c) GDPR).

10 years, as required by tax and civil law.

card payments are handled by Stripe, PayPal payments by PayPal (Europe) S.à r.l. et Cie, S.C.A., in-store payments by the bank's POS terminal. These providers process payment data as independent controllers under their own notices and may use automated fraud checks.

name, email, phone, password (stored only in encrypted form), addresses, preferences, wishlist, history of requests and orders, technical login data (date and time, device).

providing your account and the app: seeing your orders and requests, writing to us, receiving updates, using the loyalty card.

performance of the service you accept when signing up (Art. 6(1)(b) GDPR); for login security (blocking suspicious attempts, email verification), legitimate interest (Art. 6(1)(f) GDPR).

as long as the account is active. You can ask to delete it at any time, from the app or by writing to us: we only keep what the law requires (point b).

the first time you open the app it asks you, on a single screen, what to turn on: notifications, usage statistics and error reporting and, if you already have an account, news and offers. You can accept everything, keep only what is necessary or choose item by item, and change your mind at any time from Settings → Privacy and consents.

if you enable them, your phone gives us a technical code (token) through Google Firebase Cloud Messaging, used only to send you the app's notifications (status of requests and orders, messages, new creations and, only if you chose so, news and offers). You can turn them off at any time in the app or phone settings.

the app accesses the camera or the gallery only when you ask it to, to send us a photo; photos stay on your phone until you decide to send them.

if you accept them, the app uses Google Firebase Analytics (Google Ireland Limited) to tell us which screens and creations are viewed most, how many requests start from the app, the phone model, the app version and the country, linked to a random code of the installation. This does not collect your name, email or phone number, advertising identifiers are switched off and the data is not used for advertising; people working in the workshop are never counted. Data is kept for 14 months.

if the app crashes or hits an error, Google Firebase Crashlytics (Google Ireland Limited) sends us a report with the point in the code where it happened, the phone model and operating system, the app version, free memory, screen orientation and a random code of the installation, so that we can fix it. The report does not contain your name, email, photos or messages. Reports are kept for 90 days.

statistics and error reporting are turned on and off together, from Settings → Privacy and consents. If you withdraw consent, collection stops at once, the installation code is reset and reports not yet sent are deleted. Today these tools are in the Android version of the app; on iPhone we collect no statistics or errors.

performance of the requested service (Art. 6(1)(b) GDPR); for usage statistics, error reporting and promotional notifications, your consent (Art. 6(1)(a) GDPR and Art. 122 Italian Privacy Code).

your contact details, the card code, points earned and used, the purchases that generated them (website, app, sferedinatale.com and workshop), any credit or gift card and its expiry; if you add the card to your phone, the pass data in Apple Wallet or Google Wallet.

running the loyalty programme according to the terms of sale (crediting points, discounts, reminders before points or credit expire).

performance of the programme rules you accept when activating the card (Art. 6(1)(b) GDPR). No profiling: points depend only on what you spend.

as long as you take part in the programme; movements linked to purchases follow point b.

name, email and, if you choose so, phone number for WhatsApp.

sending you news about our creations, previews, ideas for special occasions and offers by email, in the app or on WhatsApp, as you chose.

free, optional consent you can withdraw at any time (Art. 6(1)(a) GDPR and Art. 130 Privacy Code). Email sign-up is confirmed with a click (double opt-in) and every message has an unsubscribe link. We keep a record of when and how you gave or withdrew consent, to be able to prove it.

until you withdraw your consent.

IP address, browser and device type, pages visited, date and time, technical cookies. They are needed to run the website and the cart and to protect them from abuse (legitimate interest, Art. 6(1)(f) GDPR). Technical logs are kept for up to 12 months.

Google Analytics 4 by Google Ireland Limited tells us, in aggregate form, which pages and products are of interest and where visitors come from (for example from one of our social posts). It does not store IP addresses. Data is kept for 14 months.

the Meta Pixel (Meta Platforms Ireland Limited) measures visits and purchases coming from our ads and lets us show our creations on Facebook and Instagram to people who visited the website.

every time you make a choice in the cookie banner, in the «Your choices» panel of the cookie policy or in the app, we record the categories you accepted or refused, the version of the notice, the page, date and time, the type of browser or phone, the shortened IP address (without its last part, so it does not identify you) and a random code of the device. If you have an account, the choices made in the app (acknowledging the notice, news and offers, usage statistics) are linked to your account.

being able to prove what you chose, as the law requires (Art. 7(1) GDPR), and respecting it.

legal obligation (Art. 6(1)(c) GDPR) and legitimate interest in demonstrating compliance (Art. 6(1)(f) GDPR).

5 years from the choice for device choices; for consents linked to an account, for as long as the consent lasts and 10 years after withdrawal.