Home · Privacy policy
Privacy policy
Last updated 26 October 2026 · plain language first, the legal references after each point.
1. Who holds your data
[legal name to be set in config.json] — [registered address to be set] — VAT [VAT number to be set] — contact info@prontopezzo.com. We are the data controller under Regulation (EU) 2016/679 (GDPR). We are a small workshop: we only keep what an order actually needs.
2. What we collect, and why
| What | When | Why (legal basis) |
|---|---|---|
| Your e-mail address | At checkout, only when you place an order | To send your quote, your order confirmation and the invoice — contract performance, GDPR art.6(1)(b) |
| Your model file (CAD, STL, DXF…) | Automatically, with the order | To manufacture what you bought and to let you reorder without re-uploading — contract performance, art.6(1)(b) |
| Your name and delivery address (recipient, street, postcode, city) | At checkout, everyone who places an order | To deliver the parcel and to issue the invoice, which Italian law requires to carry it — contract performance art.6(1)(b) + legal obligation art.6(1)(c) |
| Your VAT number | At checkout, business customers | To apply the intra-EU VAT exemption — legal obligation art.6(1)(c) + VAT Directive 2006/112 art.138(1) |
| Your password (only if you choose one) | When you set it in “My area” | To protect your account — art.6(1)(b) |
| Technical logs (IP, time, page) | Server logs, ~30 days | Security and abuse prevention — legitimate interest, art.6(1)(f) |
Quoting never asks for any of this: you can price a part with no account and no e-mail.
3. Your model files
Files stay on our server in the European Union, tied to your account, and are used for nothing except your own orders (manufacturing, re-quoting, warranty). We do not publish them, do not sell them and do not share them with other customers. When your account is deleted, the files go with it.
4. Who else touches the data
- Payment provider (when live): Stripe processes card details — we only ever see a payment reference, never the card number. Stripe acts as our processor under GDPR art.28.
- E-mail provider (when configured): carries your order confirmation; our order files pass through it, nothing else.
- EU VAT service (VIES): we send only the VAT number you typed, to verify it. No personal data beyond the number.
- Carriers: name, address, phone — only after you order, only to deliver.
We do not run Google Analytics, advertising pixels or fingerprinting scripts.
5. How long we keep it
- Orders and invoices: 10 years — Italian accounting law requires it (art.2220 of the Civil Code; VAT Directive 2006/112 art.244).
- Quotes not turned into orders: 12 months, then deleted.
- Model files: for the life of your account, then deleted (unless they are part of an invoice, which keeps them in the accounting archive).
- Server logs: ~30 days.
6. Your rights
Ask us at info@prontopezzo.com to:
- access the data we hold about you,
- correct anything wrong,
- delete everything (except what the law makes us keep, i.e. invoices),
- hand you a portable copy of your data,
- stop using it for anything based on consent.
We answer within 30 days (GDPR art.12(3)). If we ever get it wrong you can complain to the Italian supervisory authority, Garante per la protezione dei dati personali (info@prontopezzo.com is the fastest route to us first).
7. Cookies
Two technical cookies only, both strictly necessary for the site to work: a session cookie (keeps you signed in; removed when you sign out) and nothing else — no tracking, no advertising, no third-party analytics. Under Directive 2002/58/EC and the ePrivacy rules, strictly necessary cookies are exempt from consent.
8. Changes
If the way we handle data changes materially we will say so on this page with a new date, and e-mail active customers.
Company details in square brackets
are the placeholders the shop owner fills in
(state/site_data/config.json) before going public.