PRIVACY POLICY

1. INTRODUCTION

Fabricarizoma ("we", "us", "our") operates the website https://fabricarizoma.com/ (the "Website"), an online gallery and shop for artworks. This Privacy Policy explains how we collect, use, share, and protect your personal data when you visit the Website, browse or purchase artworks, create an account, or otherwise interact with us, in accordance with Regulation (EU) 2016/679 (the "GDPR") and Italian implementing legislation (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, the "Privacy Code").

By using the Website, you acknowledge that you have read this Privacy Policy. Where we rely on your consent for specific processing activities (such as marketing communications), we will ask for that consent separately.

2. DATA CONTROLLER

3. CATEGORIES OF DATA WE COLLECT

3.1 Identification and contact data

Name, email address, telephone number, and billing/shipping address.

3.2 Account data

Login credentials, account preferences, and saved addresses, if you choose to create an account on the Website. Creating an account is optional — you can also complete a purchase as a guest without registering.

3.3 Order data

Artworks or products purchased, order value, order history, order notes, and any correspondence relating to your order (e.g. shipping queries, returns).

3.4 Shipping data

Delivery address and any details required by our courier to deliver an artwork to you, including, for international shipments, information required for customs purposes.

3.5 Payment data

We do not store full payment card details. Payments are processed by our payment provider, Stripe (Stripe Inc. / Stripe Payments Europe, Ltd.), which collects card and billing data directly under its own privacy policy. We receive only confirmation of payment status, transaction amount, and a payment reference.

3.6 Marketing preferences

Your subscription status and preferences if you sign up to receive newsletters or promotional communications about new works or exhibitions.

We collect this data when you: browse the Website; create an account; place an order; contact us by email; or subscribe to our communications.

4. PURPOSES AND LEGAL BASIS FOR PROCESSING

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal (see Section 10).

5. HOW WE COLLECT YOUR DATA

We collect data directly from you when you use the Website to browse or purchase artworks, create an account, complete a checkout, contact us, or subscribe to our newsletter.

6. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies only for strictly necessary purposes: maintaining your shopping cart and session as you browse the Website, and keeping you signed in if you have an account. We do not use analytics, advertising, or social media cookies, and no third party places cookies on the Website through us. Because these cookies are strictly necessary for the Website to function, they do not require your prior consent under applicable law, though we still disclose them here and in our separate Cookie Policy [fabricarizoma.com/cookie-policy], which lists each cookie, its purpose, and its duration.

7. THIRD-PARTY SERVICES AND RECIPIENTS OF YOUR DATA

We share personal data with the following categories of recipients, acting as our data processors or as independent controllers where noted:

• Payment processing: Stripe (Stripe Inc. / Stripe Payments Europe, Ltd.) — processes payment data. See Stripe's privacy policy at https://stripe.com/privacy.
• Couriers / shipping providers: Gest and GLS, for deliveries within Italy, and DHL Express, for deliveries within the EEA outside Italy — process shipping data (name, address, contact details) to deliver your order, including, for cross-border shipments, any information required for customs purposes.
• Email/marketing platform — processes contact data for newsletters, only if you have opted in.
• Tax advisor / accountant — processes invoicing data as required by law.
• Public authorities — where required by law (e.g. tax authorities, customs, law enforcement).

We enter into data processing agreements with third-party processors as required by Article 28 GDPR. These providers may not use your data for their own purposes beyond what we have instructed, except where they act as independent controllers under their own privacy policies (e.g. a payment provider for fraud and compliance purposes).

8. INTERNATIONAL DATA TRANSFERS

Our couriers (Gest and GLS within Italy, and DHL Express for deliveries elsewhere in the EEA) process your data within the EEA, so these deliveries do not involve a transfer of personal data outside the EEA. Some of our other third-party providers — in particular our payment processor, Stripe — may transfer data to, or process data in, countries outside the EEA, including the United States. Where this occurs, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses, an adequacy decision, or another mechanism recognised under Chapter V GDPR. You may request further information about these safeguards by contacting us at fabricarizoma@gmail.com.

9. DATA RETENTION

We retain personal data only for as long as necessary for the purposes described in this Policy, and in any case no longer than required by applicable law. Indicative retention periods:

• Order and shipping data: up to 24 months after your order is completed, for customer service, returns, and fraud-prevention purposes.
• Invoices and fiscal/accounting records: 10 years, as required under Article 2220 of the Italian Civil Code and applicable tax legislation.
• Account data: for as long as your account remains active, and deleted upon request or after a period of inactivity of 2 years since the last login.
• Marketing data: until you withdraw consent or unsubscribe, after which we suppress your details to honour the opt-out.
• Cookie data: as set out in our Cookie Policy [https://fabricarizoma.com/cookie-policy].

At the end of the applicable retention period, we securely delete or anonymise your data.

10. YOUR RIGHTS UNDER GDPR

As a data subject, you have the right to:

• Access your personal data and obtain a copy of it (Art. 15)
• Rectification of inaccurate or incomplete data (Art. 16)
• Erasure of your data ("right to be forgotten"), subject to legal retention obligations (Art. 17)
• Restriction of processing in certain circumstances (Art. 18)
• Data portability, where processing is based on consent or contract and carried out by automated means (Art. 20)
• Object to processing based on legitimate interests, including profiling, and to direct marketing at any time (Art. 21)
• Withdraw consent at any time, without affecting prior lawful processing (Art. 7(3))
• Lodge a complaint with a supervisory authority

To exercise these rights, contact us at fabricarizoma@gmail.com. We will respond within one month of receiving your request, as required by Article 12(3) GDPR, extendable by a further two months for complex requests.

Right to complain: If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the Italian supervisory authority:

Garante per la protezione dei dati personali
Piazza Venezia, 11 — 00187 Roma
Website: https://www.garanteprivacy.it
Email: garante@gpdp.it / PEC: protocollo@pec.gpdp.it

This is without prejudice to any other administrative or judicial remedy available to you.

11. AUTOMATED DECISION-MAKING

We do not use your personal data for automated decision-making, including profiling, that produces legal or similarly significant effects on you.

12. CHILDREN'S DATA

The Website is not directed at children, and we do not knowingly collect personal data from minors without appropriate consent from a parent or legal guardian. If you believe a minor has provided us with personal data without such consent, please contact us so we can take appropriate action.

13. SECURITY

We implement appropriate technical and organisational measures, proportionate to the risk, to protect your personal data against unauthorised or unlawful access, alteration, disclosure, loss, or destruction, including access controls, encryption of data in transit, and confidentiality obligations. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Garante and, where required, affected individuals, in accordance with Articles 33 and 34 GDPR.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when it was last revised. Material changes will be communicated via a notice on the Website or by email where appropriate.

15. GOVERNING LAW

This Privacy Policy is governed by Italian law and the GDPR. Any disputes not resolved directly with us may be brought before the competent Italian courts or, in relation to data protection specifically, submitted to the Garante per la protezione dei dati personali.

16. CONTACT