Privacy Policy

Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

23 October 2026

1. Data controller

The data controller is TereDo s.r.l.s., with registered office at Via Martiri di Belfiore, 14/A, 62012 Civitanova Marche (MC), Italy, VAT no./Tax code 01948920432 (hereinafter “TereDo” or the “Controller”). Contact details: telephone +39 320 6337390; e-mail info@teredoitaly.com. To exercise your data protection rights or request information about the processing, you can write to the e-mail address above.

2. Scope and categories of data

This notice concerns the TereDo e-commerce website (the “Site”) and the activities connected with browsing its pages, requesting information, creating an account, where available, and purchasing products. The following may be processed: identification and contact data (first name, surname, e-mail, telephone); billing and delivery addresses; any tax data that may be required; information on orders, products purchased, returns and customer support; account credentials, managed with protection systems; technical browsing data such as IP address, logs, device and browser; preferences and consents given.

Payment data are normally processed by the payment providers. The Controller may receive information on the outcome of the transaction and its identifiers, without needing to store full payment card numbers, unless a different, verified configuration applies.

3. Purposes, legal bases and provision of data

a) Browsing, security and operation of the Site: handling web requests, protection against unauthorised access, maintenance and troubleshooting. Legal basis: the Controller’s legitimate interest in the security and proper management of the service (Art. 6(1)(f) GDPR) or, where relevant, the performance of services requested by the user (point (b)).

b) Purchases and contract management: cart, checkout, order confirmation and fulfilment, payment, delivery, returns, refunds and after-sales support. Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b)).

c) Administrative, tax and accounting obligations: issuing and keeping documents, complying with legal obligations and requests from the authorities. Legal basis: legal obligation (Art. 6(1)(c)).

d) Replies to spontaneous requests: processing the data provided through contact or support channels in order to reply to the user’s requests. Legal basis: pre-contractual measures (point (b)) or legitimate interest in handling relevant communications (point (f)), as the case may be.

e) Registration and management of the personal area, where available: account creation, login and viewing of order history. Legal basis: performance of the service requested (point (b)).

f) Sending newsletters and promotional communications, if activated: legal basis is specific, free and revocable consent (Art. 6(1)(a)), except for commercial communications to existing customers permitted by Article 130(4) of the Italian Privacy Code, with the option to object in every communication.

g) Statistics, advertising and profiling through non-essential trackers, where activated: consent in the cases provided for by the applicable rules; details and choices are available in the Cookie Policy and in the consent management panel.

Providing the data required for purchases and legal obligations is necessary: without them, it may not be possible to complete or manage the order. Providing data for marketing and optional tracking is entirely voluntary, and refusing does not affect your purchase.

4. Processing methods and security measures

Processing is carried out using electronic tools and, where necessary, organisational tools, in accordance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation. The Controller adopts technical and organisational measures appropriate to the risk, including access control, system updates and protection of communications, according to the actual configuration of the services.

5. Payments, shipping, returns and customer support

To fulfil orders, the data strictly necessary may be disclosed to payment service providers, banks, logistics providers and couriers, as well as to parties supporting customer service and refund management. The privacy role of each party (processor or independent controller) depends on the actual services and contracts. The Controller does not ask for consent for disclosures that are essential to the performance of the contract.

6. Recipients and data processors

Within the limits of the purposes stated, the data may be accessible to authorised staff and to providers of hosting, IT maintenance, the e-commerce platform, e-mail services, payments, logistics, accounting and professional advice. Where they act on behalf of TereDo, these parties are appointed as data processors pursuant to Art. 28 GDPR, where required. The data are not disseminated indiscriminately. An up-to-date list of processors can be requested from the Controller.

7. Data retention

Data are kept for as long as necessary for the purposes for which they were collected and, where required, thereafter in order to comply with legal obligations or to protect rights. Accounting and tax records are kept for the applicable periods, ordinarily ten years for accounting records. Order data may be kept for the period needed to manage the relationship and any disputes, subject to regulatory requirements. Contact requests, inactive accounts, technical logs and marketing data are kept for periods proportionate to their respective purposes, to be defined and applied in practice. Consent can be withdrawn at any time, without retroactive effect.

8. Transfers to countries outside the EEA

Some technology providers may involve transfers of data to countries outside the European Economic Area. Where this happens, the Controller ensures that a valid basis under Chapter V of the GDPR is used, for example an applicable adequacy decision or standard contractual clauses accompanied, where necessary, by supplementary measures. Information on actual transfers and the related safeguards can be requested from the Controller.

9. Cookies and tracking tools

The Site uses cookies and similar technologies for technical functions and, only where present and under the conditions laid down by law, for statistical analysis, external content and marketing. Detailed information on the cookies actually used, their providers and durations, and how to give, refuse or withdraw consent is provided in the separate Cookie Policy, accessible from the Site footer and from the preferences panel.

10. Rights of the data subject

In the cases provided for by Articles 15–22 GDPR, data subjects may request access to their data, rectification, erasure, restriction of processing, portability and object to processing, as well as withdraw consent at any time. Where data are processed for direct marketing, data subjects may object at any time without giving reasons. They may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or take action before the competent judicial authority. Requests can be sent to the Controller’s contact details; a reply is normally provided within one month, subject to the extensions permitted by the GDPR.

11. Minors

The Site is intended for the sale of products and is not specifically designed to collect data from minors. Any consent-based online services aimed at minors are subject to the applicable rules, including those on the age of digital consent. If the Controller becomes aware of non-compliant processing, it will take the necessary measures.

12. Automated processing and updates

Unless specifically stated otherwise, TereDo does not take decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of Art. 22 GDPR. This notice may be updated following regulatory, organisational or technical changes; the current version is made available on the Site with the date of the latest update.