Italian Tailoring for MenThis notice describes how Tailor Diffusion s.r.l. processes the personal data of those who visit this website, place an order, consult their orders or request assistance, pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR).
- Controller: Tailor Diffusion s.r.l., S.S. 275 km 21.400 - Lucugnano di Tricase (LE) 73039 - Italy, email: info@ottavionuccio.com. The Controller has not designated a Data Protection Officer, as it is not required to do so.
- Orders: to conclude and deliver an order, we collect first name and surname, email address, shipping address and, if different, billing address, the chosen language, the garments ordered, the payment method and any notes; the telephone number is needed by the courier for delivery and is optional, except for those paying with Scalapay, which requires it. For made to measure garments, we also collect the body measurements that the customer enters on the measurements page. Legal basis: the performance of the sales contract and of pre-contractual measures requested by the customer (Article 6(1)(b) GDPR). The provision of these data is necessary: without them, the order cannot be accepted. The retention of accounting and tax documents relating to orders (Article 6(1)(c)) is a legal obligation (Art. 2220 of the codice civile, Art. 22 of D.P.R. 600/1973).
- Payments: card details never pass through our website: the customer enters them on the secure page of the payment service provider, which informs us only of the outcome and the transaction identifier. For card payments, the provider is Fabrick S.p.A., Piazza Gaudenzio Sella 1, 13900 Biella, to which we transmit name, email address and amount; for PayPal, it is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Lussemburgo, to which we transmit the amount and the order number; for payment in instalments with Scalapay, it is Scalapay S.r.l., Via Nervesa 21, 20139 Milano, to which we transmit name, email address, telephone number, shipping and billing addresses, the garments ordered, the amounts and the order number. Each processes the data as an independent controller, in accordance with its own privacy notice. For bank transfers, the payment data are those that the customer's bank communicates to ours.
- Access to orders and measurements: to verify the email address when an order is placed and to consult one's orders or enter measurements, we send a six-digit one-time code to the address provided. The code is stored in encrypted form, is valid for 15 minutes and is deleted upon the next request. For 24 hours after verification, a new order placed from the same browser with the same address does not require another code. Legal basis: the performance of the contract (Article 6(1)(b)) and the Controller's legitimate interest in protecting order data from unauthorised access (Article 6(1)(f)).
- Requests for assistance: through the contact form, we collect name, email address or telephone number, the message and the page from which it was sent, solely in order to respond to the request. Legal basis: the performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b)).
- Chat: the chat button at the bottom right opens a conversation with our staff via the Smartsupp service, provided by Smartsupp.com s.r.o. (Brno, Czech Republic). The service loads only when the customer presses the button: until then, the website does not communicate any data to Smartsupp. From that moment, Smartsupp receives the IP address, the type of browser and operating system, the pages of the website visited during the conversation, the messages exchanged and the name, email address or telephone number that the customer chooses to provide, and sets its own technical cookies in the browser, which are necessary to retrieve the conversation. The website also records in the browser tab's storage (
sessionStorage) that the chat has been opened, in order to load it on subsequent pages as well; this record is deleted when the tab is closed. These data are used solely to respond to the request. Legal basis: the performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b)). - Email: we send only the emails necessary for an order or a request: the order confirmation and payment instructions, the access code, the reply to a request for assistance. We do not send newsletters or promotional communications and we do not disclose data to others for such purposes.
- Browsing data: the server hosting the website automatically records every request received in log files: IP address, date and time, page requested, outcome of the request, referring page and type of browser and operating system. These data are processed to ensure the security and proper functioning of the website and to compile aggregate statistics on its use, on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR). The logs are retained for 1 year, after which they are deleted; the copy used for statistics retains only the truncated IP address (without its final part). The application's system log records events relating to orders, payments and emails sent, identifying them by the order number alone, without names or addresses, and is retained for the same period.
- Cookies: the website uses only technical cookies, necessary for its functioning, for which consent is not required (Art. 122 of D.Lgs. 196/2003; Garante Guidelines of 10 June 2021): the basket (
ongala_cartandongala_cart_hint, 30 days), moving between the order pages (ongala_checkout_flash, 5 minutes;ongala_otp_pending, 15 minutes) and, after the email has been verified, access to one's orders and measurements and ordering without a new code (ongala_session, 24 hours). The basket contains only product codes and quantities. We do not use profiling cookies or analytics tools. The only third-party content is the chat, which loads only when the customer opens it (see «Chat»). - Retention period: order data, including measurements, are retained for 10 years from the end of the year in which the order was placed, as required by accounting and tax legislation, and for the establishment, exercise or defence of legal claims. The summary of an order that is never confirmed is deleted after 30 days, or earlier if the customer places the order again. Requests for assistance, including chat conversations, are retained for the time strictly necessary to handle them and, in any case, for no longer than 1 year from receipt, after which they are deleted, unless a subsequent contractual relationship is established. Access codes, cookies and logs are retained for the periods indicated above. Backup copies of the database, made at every update of the website, are kept on the same server, with the same protection measures.
- Recipients of the data: the data are not disseminated. They are disclosed, to the extent necessary for each purpose, to the following parties: the provider of the website hosting and email service (OVH), appointed as Processor; the provider of the chat service (Smartsupp.com s.r.o.), appointed as Processor; the payment service providers indicated above; the couriers responsible for delivery (UPS, SDA, TNT TRACO), which receive the recipient's name, address and telephone number; the Controller's accounting and tax advisers and the authorities to which the law requires them to be disclosed. The Controller's staff who process the data are authorised and instructed to do so.
- Transfers outside the European Union: the data are stored on servers in the European Union. If the customer requests delivery to a country outside the Union, the recipient's address and contact details are transmitted to the courier in that country, as they are necessary for the performance of the contract (Article 49(1)(b) GDPR). The payment service providers may transfer data in accordance with their respective privacy notices.
- Automated decision-making: the Controller does not carry out profiling or decisions based solely on automated processing (Article 22 GDPR).
- Rights of the data subject: the data subject has the right to request from the Controller access to their data, rectification, erasure or restriction of processing, portability of the data provided for the performance of the contract, as well as the right to object to processing based on legitimate interest (Articles 15 to 22 GDPR). No processing is based on consent. Requests should be sent to info@ottavionuccio.com. The data subject also has the right to lodge a complaint with the Autorità Garante per la protezione dei dati personali (Article 77 GDPR) or with the supervisory authority of their own Member State.