Privacy Policy – GDPR Integration
Privacy Policy – GDPR Integration
Last updated: July 20, 2026
This page integrates the Privacy Policy of Pens.it by Giardino Italiano (Giardino.it srl, via dei Guarneri 24, 20141 Milan MI) and provides additional information required by Regulation (EU) 2016/679 (GDPR) and the Italian Privacy Code (Legislative Decree 196/2003 as amended by Legislative Decree 101/2018). In case of conflict between this page and the main Privacy Policy, this integration shall prevail for GDPR aspects.
1. Legal Bases for Processing (Art. 6 GDPR)
For each processing purpose indicated in the main Privacy Policy, the legal basis is as follows:
| Purpose | Legal Basis (Art. 6 GDPR) |
|---|---|
| Order fulfillment, shipping, returns management, and payments | Performance of a contract – Art. 6(1)(b) |
| Customer account management | Performance of a contract – Art. 6(1)(b) |
| Customer support communications | Performance of a contract – Art. 6(1)(b) |
| Tax and accounting obligations (document retention) | Legal obligation – Art. 6(1)(c) |
| Fraud prevention and service security | Legitimate interest – Art. 6(1)(f) |
| Email marketing and newsletters | Consent – Art. 6(1)(a) |
| Remarketing (Google Ads, Meta Ads) | Consent – Art. 6(1)(a) |
| Browsing behavior analysis (analytical cookies) | Consent – Art. 6(1)(a) |
| Compliance with requests from judicial or administrative authorities | Legal obligation – Art. 6(1)(c) |
You can withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal. To withdraw consent, write to pens@giardino.it or use the cookie preferences on the website.
2. Third-Party Marketing Tools
Google Ads
We use Google Ads (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to display advertisements to users who have previously visited our site (remarketing) and to new potential customers with profiles similar to our buyers (similar audiences). No personally identifiable data (e.g., email or phone number) is shared with Google for advertising purposes.
For more information on how Google uses data: Google Privacy Policy. To manage Google ad preferences: Google Ad Settings.
Meta Ads (Facebook and Instagram)
We use Meta Pixel and the advertising features of Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland) to measure the effectiveness of campaigns on Facebook and Instagram and to display personalized ads to users who have visited our site or interacted with our content.
The Meta Pixel collects information about actions taken on the site (e.g., product viewing, adding to cart, purchase) and transmits it to Meta, after obtaining your consent via the cookie banner. For more information: Meta Privacy Policy. To manage ad preferences: Facebook Ad Preferences.
Email Marketing
For sending newsletters and promotional communications, we use 4Dem (4Dem Srl, Italy), an Italian email marketing platform. Your data (name and email) is transmitted to 4Dem exclusively for this purpose and only if you have given explicit consent to subscribe. You can unsubscribe at any time by clicking the "unsubscribe" link in each email, or by writing to pens@giardino.it.
3. Cookies and Tracking Technologies
Our site uses cookies and similar technologies. Based on their function, cookies are categorized as:
- Technical and session cookies – Necessary for the website to function (e.g., shopping cart, login session). They do not require consent.
- Analytical cookies – Collect aggregated data on website usage to improve its functionality. They require your consent.
- Profiling and marketing cookies – Used by Google and Meta to display relevant ads based on your browsing. They require your explicit consent before activation.
You can change or withdraw your preferences at any time through the cookie preference panel available on the site. Disabling marketing cookies will not prevent the display of ads, but the ads will not be personalized based on your activity.
4. Data Retention Periods
| Data Category | Retention Period | Reason |
|---|---|---|
| Order data (tax and accounting data) | 10 years from the order date | Legal obligation (Art. 2220 Italian Civil Code and Italian tax law) |
| Customer account data | Until account deletion, then 30 days for backup | Performance of a contract |
| Data for email marketing | Until consent withdrawal or unsubscribe | Consent |
| Data for remarketing (Google, Meta) | Maximum 540 days (platform limit) or until consent withdrawal | Consent |
| Analytical and marketing cookies | Maximum 13 months (Privacy Guarantor recommendation) | Consent |
| Security and fraud prevention logs | 12 months | Legitimate interest |
| Customer support communications | 3 years from the request closure | Legitimate interest / complaint management |
5. List of Data Processors (Sub-processors)
To provide our services, we share your data with the following data processors, with whom we have entered into appropriate data processing agreements:
| Provider | Role | Shared Data | Privacy Policy |
|---|---|---|---|
| Shopify Inc. (Canada/USA) | E-commerce platform | All store data | Shopify Privacy |
| Google LLC (USA) | Advertising (remarketing), Analytics | Browsing data (cookies) | Google Privacy |
| Meta Platforms Ireland Ltd (Ireland) | Advertising, Meta Pixel | Browsing data, site events | Meta Privacy |
| 4Dem Srl (Italy) | Sending newsletters and promotional communications | Name, email address | 4Dem Privacy |
Transfers to third countries (e.g., USA) occur based on Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR) or equivalent recognized mechanisms.
6. Competent Supervisory Authority
As a resident in Italy or the European Economic Area, you have the right to lodge a complaint with the competent supervisory authority. For residents in Italy:
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Rome
Tel: +39 06 69677.1
www.garanteprivacy.it
For residents in other EEA countries, the list of national authorities is available on the EDPB website.
7. How to Exercise Your Rights
To exercise the rights provided by Articles 15–22 GDPR (access, rectification, erasure, portability, objection, restriction of processing, withdrawal of consent), you can contact us in the following ways:
- Email: pens@giardino.it
- Phone: +39 02 539 7256
- Mail: Giardino.it srl, via dei Guarneri 24, 20141 Milan MI, Italy
We will respond within 30 days of receiving the request. In the case of complex or numerous requests, the deadline may be extended by an additional 60 days, with a reasoned communication within the first month. Verification of the requester's identity is necessary before fulfilling the request.
You will not suffer any prejudice for exercising your rights.
For any questions regarding this integration, please contact pens@giardino.it.
