Privacy Policy

PRIVACY POLICY – pursuant to Regulation (EU) 2016/679 (GDPR)
Prandi & C. SRL – Società Benefit
Rev. December 2025

1. Data Controller
The Data Controller is Prandi & C. SRL – Società Benefit, with registered office in Via Provinciale 123, 23819 Primaluna (LC), Italy, Tax Code and VAT IT01723900138.
For any request or to exercise your rights, you may contact the Controller at: info@a-prandi.it

2. Types of Data Processed
The Website collects, either independently or through third parties, the following categories of personal data:
  • Identification and contact data: name, surname, address, e-mail, telephone number.
  • Fiscal and billing data: tax code, VAT number, company name.
  • Technical data: cookies, IP addresses, browsing data and website usage data.
  • Order-related data: shipping address and payment data (processed directly by external payment providers such as PayPal).
Data may be provided directly by the user (e.g., through an order form) or collected automatically during use of the Website (e.g., technical data).

3. Purposes and Legal Basis of Processing
Personal data are processed for the following purposes:
3.1 Performance of a contract or pre-contractual measures
  • Order and request management
  • Product shipment
  • Billing
  • Customer assistance
Legal basis: Art. 6(1)(b) GDPR.

3.2 Compliance with legal obligations
  • Retention of invoices and accounting documents
  • Mandatory communications to competent authorities
Legal basis: Art. 6(1)(c) GDPR.

3.3 Sending promotional communications (Newsletter and Soft Opt-in)
1. Newsletter subscription
Users may voluntarily subscribe to our newsletter. In this case, the e-mail address is used to send informational and promotional communications.
Legal basis: Consent (Art. 6(1)(a) GDPR).

2. Promotional emails to existing customers (Soft Opt-in)
If a user purchases a product through the website, the Controller may use the e-mail address to send promotional communications relating to products or services similar to those previously purchased, without requiring explicit consent.
This is permitted under Art. 130(4) of the Italian Privacy Code, provided that:
  • the e-mail was collected during the sale of a product or service;
  • the communications concern similar products or services;
  • the user can easily object at any time.
Each communication includes an immediate unsubscribe link.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

3.4 Website security and prevention of abuse
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

4. Methods of Processing
Data are processed using electronic and telematic tools, following organizational procedures strictly related to the purposes indicated and in compliance with GDPR security measures.

5. Services Used and Data Recipients
5.1 Newsletter Service – MailerLite
The Data Controller uses MailerLite for managing newsletter subscriptions and sending marketing communications.
MailerLite processes data such as: e-mail addresses and newsletter usage data (opens, clicks).
Processing location: European Union.
For more information, please refer to MailerLite’s Privacy Policy. See https://www.mailerlite.com/privacy-policy

5.2 Payment Services – PayPal
Payment data are processed directly by the selected payment provider (e.g. PayPal Inc.) and do not pass through the Controller’s servers.
Processing location: Please refer to the payment provider’s privacy policy.

5.3 Other Data Recipients
Data may be communicated to:
  • couriers and shipping companies;
  • tax and accounting consultants;
  • technical service providers (hosting, IT, website management);
  • subjects appointed as Data Processors.
The updated list of Data Processors is available upon request.

6. Data Location and Transfers Outside the EU
All data are processed within the European Union.
Data are not transferred outside the European Economic Area unless third-party services are used that ensure adequate safeguards pursuant to Articles 45–46 GDPR.

7. Data Retention Period
Personal data are retained as follows:
  • 10 years for fiscal and accounting purposes;
  • until consent is withdrawn, for newsletter communications;
  • until the user objects, for soft opt-in communications;
  • for the time strictly necessary to provide the requested service or manage user requests.
After the retention period, data are deleted or anonymized.

8. User Rights
Users may exercise the following rights at any time:
  • right of access;
  • rectification or update;
  • erasure (“right to be forgotten”);
  • restriction of processing;
  • objection (including to direct marketing);
  • data portability;
  • withdrawal of consent;
  • lodging a complaint with the Data Protection Authority (Garante per la Protezione dei Dati Personali).
9. Exercising Rights
Requests may be submitted to:
info@a-prandi.it
The Controller will respond within 30 days, free of charge and within GDPR limits.

10. Cookie Policy
The Website uses technical, analytical, and profiling cookies, both first-party and third-party.
For full details, please refer to the dedicated Cookie Policy.
This Privacy Policy applies to all pages of www.a-prandi.it and the online shop.