Last updated: 26/10/2026 – Version 6.3
This privacy policy has been drawn up pursuant to Article 13 of European Regulation No. 2016/679 on the protection of natural persons with regard to the processing of personal data and the free movement of such data (“General Data Protection Regulation”, “Regulation” or “GDPR”).
Through this policy, Iginio Massari S.r.l. intends to inform each user (“User” or “Data Subject”) about the processing of personal data collected through the website www.iginiomassari.cyou (“Website”), including data collected through the forms dedicated to company and reseller registration for the e-Shop’s B2B features.
The e-Shop’s B2B features and their registration forms are currently available exclusively in Italian and are intended solely for companies operating in Italy. Consequently, the sections of this Privacy Policy relating to the e-Shop’s B2B features apply exclusively to users who access or use such a service on behalf of said companies.
The Data Controller, pursuant to Article 4(7) of the GDPR, is:
Iginio Massari S.r.l.
Registered office: Via Orzinuovi 117, 25125 Brescia
Contact email: privacy@iginiomassari.cyou
The Controller processes Users’ personal data for the purposes described below.
Personal data will be processed to enable registration or authentication on the Website, the creation of a personal account, and access to the services offered by the Controller.
✓ personal details, such as name and surname;
✓ contact details, such as email address;
✓ account credentials and information.
Performance of pre-contractual measures taken at the data subject’s request and performance of the contract, pursuant to Article 6(1)(b) of the GDPR.
Until the account is deleted, except for any further retention periods required by law or necessary for the establishment, exercise or defence of the Controller’s rights.
Personal data will be processed to receive, verify and manage the request to register for the e-Shop’s B2B features, verify that the requirements for access as a company or reseller are met, contact the designated contact person and, if the request is accepted, create and manage the account and the resulting B2B business relationship.
In particular, the Controller may verify the information provided by the company and request any additional documentation necessary to assess the access request.
For the collection and management of data relating to companies registered for the e-Shop’s B2B features and their respective contact persons, the Controller also uses the Uptonica platform, provided by Webgas S.r.l. Data relating to B2B service users is processed through this platform, as well as through the Shopify and Odoo systems, while not being transferred to the Klaviyo platform. The use of Uptonica to manage such data does not automatically entail its use for promotional purposes, for which the specific legal grounds provided for in this Policy remain applicable.
✓ identifying and professional details of the contact person, such as name, surname and company role;
✓ contact details, such as business email address, telephone number and certified email address;
✓ identifying, tax and billing details of the company, such as company name, registered office, billing address, VAT number or tax code, and SDI recipient code;
✓ any information contained in the company documentation provided;
✓ information relating to the registration request, verification of requirements, and account management with B2B features.
Performance of pre-contractual measures taken at the data subject’s request and performance of the contract, pursuant to Article 6(1)(b) of the GDPR, when the data subject is the contracting party.
The Controller’s legitimate interest, pursuant to Article 6(1)(f) of the GDPR, in verifying the request and managing the business relationship with the company represented, when the personal data relate to an employee, collaborator, administrator or contact person of the company.
For the duration of the contractual relationship and for as long as necessary to manage the order, delivery, payment and any related requests.
Data contained in administrative, accounting and tax documents will be retained for the period required by applicable law, normally ten years from its registration, except for any further periods required by law or necessary in the event of investigations, disputes or litigation.
Personal data will be processed to manage and respond to requests for information, technical assistance and support, as well as to assist the User before, during and after the provision of products or services.
For managing assistance requests, the Controller also uses an AI-powered chatbot integrated into the Uptonica platform and provided by Webgas S.r.l. The chatbot can automatically process Users’ requests and formulate responses using the information provided during the conversation and, where necessary, data relating to the account, orders, purchases and requested services. Conversations may be managed through automated processes and, when necessary, referred to the authorized personnel of the assistance service.
Responses are automatically generated by AI systems and may contain inaccurate or incomplete information.
Any cookies or similar technologies used by the Chatbot for technical operation or statistical analysis are described in the website's Cookie Policy. This section governs the processing of personal data contained in the conversations and requests sent via the Chatbot.
✓ personal information;
✓ contact details, such as email address and telephone number;
✓ account-related information;
✓ purchase and order history;
✓ content of the request and communications exchanged, including messages exchanged with the AI chatbot, automatically generated responses, and any technical information associated with the conversations, where collected;
✓ any documents or information transmitted by the User.
Performance of pre-contractual or contractual measures, pursuant to Art. 6, paragraph 1, letter b) of the GDPR.
When the request is not directly related to a contractual relationship, processing may be based on the Data Controller's legitimate interest in providing information and assistance to Users, pursuant to Art. 6, paragraph 1, letter f) of the GDPR.
For the period necessary to manage and respond to the request and, subsequently, for the time necessary to manage any related disputes or requests.
Once this period has elapsed, the conversations are automatically deleted. As confirmed by the provider, deletion extends to copies, backups, and logs containing the conversation data managed by the platform.
Further retention may only be provided for specific documented needs, such as compliance with legal obligations or the establishment, exercise, or defense of rights, limited to the data necessary and for the period justified by the relevant purpose.
Users may request the early deletion of their personal data in the cases provided for by Art. 17 of the GDPR.
Users may, in any case, exercise the rights provided for by Articles 15-22 of the GDPR, within the limits and under the conditions established by applicable law.
Subject to the Data Subject's consent, personal data will be processed for the periodic distribution of the Data Controller's newsletter, containing updates, information, news, editorial content, and communications related to Iginio Massari's activities.
✓ first and last name, where provided;
✓ email address;
✓ information related to registration, modification of preferences, and unsubscription.
Data Subject's consent, pursuant to Art. 6, paragraph 1, letter a) of the GDPR.
Until the withdrawal of consent or unsubscription and, in any case, for a period not exceeding 24 months from the Data Subject's last relevant interaction with the Data Controller, except for the period necessary to retain proof of consent and its eventual withdrawal.
Subject to the Data Subject's consent, personal data will be processed for the distribution of promotional and advertising communications by email related to the Data Controller's products, services, initiatives, news, and events.
The use of additional communication channels, such as SMS, telephone calls, paper mail, or push notifications, will only occur if such channels are expressly indicated in the consent request or on the basis of a separate applicable legal basis.
Consent is optional and can be withdrawn at any time, without prejudice to the lawfulness of the processing carried out prior to the withdrawal and without consequences for registration on the Website or the B2B functionality of the e-Shop, account creation, or the ability to make purchases.
The use of Meta Pixel, Conversions API, and other cookies or advertising tracking tools does not depend on consent to direct marketing collected through the forms on the Website.
Such processing is governed separately and depends on the preferences expressed by the User through the cookie management system and other tracking tools on the Website.
✓ first and last name;
✓ email address;
✓ information related to the consent provided and its respective modifications or withdrawals.
If the communication distribution service uses technologies to detect opens or interactions, any data related to email consultation will be processed only in compliance with applicable regulations and on the required legal basis.
Data Subject's consent, pursuant to Art. 6, paragraph 1, letter a) of the GDPR.
Until the withdrawal of consent and, in any case, for a period not exceeding 24 months from the Data Subject's last relevant interaction with the Data Controller, except for the period necessary to retain proof of consent and its eventual withdrawal.
When the Data Controller acquires the Data Subject's email address in the context of the sale of one of its products or services, it may use it to send communications related to its own products or services similar to those purchased, within the limits and conditions provided for by Art. 130, paragraph 4, of Legislative Decree 196/2003.
The Data Subject may freely object to such use at the time of data collection and subsequently at any time, also by using the unsubscription link present in each communication or by writing to privacy@iginiomassari.cyou.
✓ first and last name;
✓ email address;
✓ information related to previously purchased products or services, limited to what is necessary to verify their similarity.
Art. 130, paragraph 4, of Legislative Decree 196/2003.
Until the Data Subject objects and, in any case, for a maximum period of 24 months from the last purchase, unless a different period is necessary or applicable in relation to the nature of the commercial relationship.
Purchase-related data will continue to be retained for the additional periods required by contractual, administrative, accounting, and tax purposes, but will no longer be used to send soft spam communications beyond the indicated period.
Subject to the Data Subject's consent, the Data Controller may process data provided by the User and data acquired during the use of the services and the e-Shop to perform automated or manual analyses of the User's habits, preferences, and interests.
Profiling is used to personalize content, services, communications, and commercial offers, making them more consistent with the Data Subject's preferences and purchasing habits.
Data related to products viewed and interactions with the Website will only be used when collected in compliance with applicable regulations on cookies and other tracking tools.
✓ personal information;
✓ contact details;
✓ order and purchase history;
✓ products viewed;
✓ expressed preferences;
✓ interactions with the Website and the e-Shop, when collected in compliance with applicable regulations;
✓ information derived from the analysis of purchasing habits and preferences;
✓ information related to interactions with communications and commercial content, when lawfully collected.
Data subject’s consent, pursuant to Art. 6(1)(a) GDPR.
Until consent is withdrawn and, in any event, for no more than 12 months from the collection of the data or the last relevant interaction with the Data Subject, unless the data must be retained for other purposes based on a different legal basis.
Profiling does not involve decisions based solely on automated processing that produce legal effects on the Data Subject or similarly significantly affect them.
In particular, profiling does not automatically determine the acceptance or rejection of a registration request for the e-Shop B2B functionality, the application of individual contractual conditions, the granting of credit or exclusion from access to services.
Personal data will be processed if the Data Subject submits their application for an open job position or spontaneously sends their CV.
✓ personal details;
✓ contact details, such as email address and telephone number;
✓ educational background data;
✓ professional background data;
✓ skills and qualifications;
✓ information contained in the CV and submitted documentation.
The Data Subject is advised not to include irrelevant data or special categories of personal data in their CV unless strictly necessary for the purposes of the application.
Performance of pre-contractual measures taken at the request of the data subject, pursuant to Art. 6(1)(b) GDPR.
For a maximum period of 24 months from receipt of the application, unless an employment or collaboration relationship is established or the Data Subject requests the deletion of the data in advance.
Personal data will be processed to comply with obligations arising from laws, regulations, national or European Union legislation, including administrative, tax, accounting and invoicing obligations.
The data may also be processed to manage and respond to requests from administrative, tax, judicial or public security authorities or other authorized public bodies.
✓ personal details;
✓ contact details;
✓ company identification and tax data;
✓ registered office and billing address;
✓ VAT number or tax code;
✓ PEC address and SDI recipient code;
✓ data relating to orders, payments, deliveries and invoices;
✓ administrative, accounting and tax documentation;
✓ any additional data requested by the competent authorities.
Compliance with a legal obligation to which the Data Controller is subject, pursuant to Art. 6(1)(c) GDPR.
For the periods prescribed by applicable civil, tax, administrative and accounting laws, normally ten years from the registration of the document, without prejudice to any further periods required by law, the competent authorities, or the existence of ongoing proceedings, audits or disputes.
The Data Controller may process User data to enable browsing, consultation and proper Website operation, prevent misuse or fraudulent activity, protect system security and improve the user experience.
The use of cookies and tracking tools that are not strictly necessary is governed by the Cookie Policy and the preferences expressed by the User through the relevant consent management system.
✓ IP address and technical connection data;
✓ device and browser data;
✓ system and security logs;
✓ usage and interaction data with the Website;
✓ information relating to technical errors, anomalies and unauthorized access attempts.
Legitimate interest of the Data Controller, pursuant to Art. 6(1)(f) GDPR, consisting in ensuring the operation, security, protection and improvement of the Website and services.
When required by applicable law, processing based on cookies or other tracking tools will be carried out subject to the User’s prior consent.
For the period strictly necessary to pursue the stated purposes.
The data may be aggregated or anonymized for statistical and Website improvement purposes. Data that is effectively anonymized is no longer considered personal data.
The Data Controller may process personal data to manage complaints and disputes, prevent and investigate unlawful conduct, and exercise or protect its rights and interests in out-of-court, administrative or judicial proceedings.
✓ personal details;
✓ contact details;
✓ account, order and payment data;
✓ content of communications and complaints;
✓ documentation and information relevant to the dispute or claim.
Legitimate interest of the Data Controller, pursuant to Art. 6(1)(f) GDPR, consisting in the need to ascertain, exercise or defend a right or interest of the Data Controller.
For the period necessary to manage the complaint or dispute and, subsequently, for the time required for the investigation, exercise or defense of the right, in compliance with applicable limitation periods.
The provision of data necessary for the creation and management of the account, the management of the registration request for the e-Shop B2B functionality, the execution of orders, invoicing, product delivery, payment management and compliance with legal obligations is necessary.
In the “Companies” and “Resellers” forms, the data marked with an asterisk is necessary to verify and manage the registration request, assess compliance with the requirements, create the account with access to the B2B functionality and, subsequently, manage purchases, invoicing and related compliance.
Failure to provide such data will prevent the Data Controller from processing the registration request or providing the requested products and services.
The provision of data and consent for newsletter, marketing and profiling purposes is optional.
Failure to provide consent does not prevent:
· the submission of the registration request;
· the assessment of the request;
· the creation of the account;
· access to the B2B functionalities of the e-Shop;
· completion of purchases;
· performance of the contractual relationship.
Requests for consent relating to the newsletter and promotional communications by email can be collected through a single optional option. Consent to profiling, if any, is requested separately.
The relevant checkboxes are not pre-selected and are not mandatory for submitting the form or accessing the services.
At login, Users may be shown a specific optional option to consent to the sending of promotional communications, including the newsletter by email. If the User has already provided valid consent for the same purposes, failure to select the option at a subsequent login does not constitute a withdrawal of the previously expressed consent, which remains effective until its withdrawal or, if earlier, until the expiry of the applicable retention period indicated in this Privacy Notice. The User may withdraw consent at any time in accordance with the procedures set out in this Privacy Notice.
The Data Controller retains the documentation necessary to demonstrate the consent provided, including, where applicable, the date, the content of the consent request and the version of the form or privacy notice presented to the Data Subject.
Consent may be withdrawn at any time without affecting the lawfulness of the processing carried out before the withdrawal.
Activities based on legitimate interest do not require the Data Subject's consent. The Data Controller has carried out or will carry out, where necessary, a balancing test between its interests and the fundamental rights and freedoms of the Data Subjects.
The use of certain Site services may involve communicating personal data relating to third parties to the Data Controller, for example data relating to employees, collaborators, administrators, company contacts or recipients of a shipment.
The User who communicates such data guarantees:
· that they are authorized to transmit it;
· that the processing is based on a valid legal basis;
· that the data subjects have been provided with the information required by applicable law, where necessary;
· that the data communicated are relevant, accurate and limited to what is necessary.
The User assumes responsibility for communicating third-party personal data in violation of applicable law.
Personal data is processed using paper, computer and telematics tools, through manual and automated methods, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy and storage limitation.
As part of its user support activities, the Data Controller also uses tools based on artificial intelligence technologies through the Uptonica platform to process requests, automatically formulate responses and assist authorized personnel in managing conversations. These tools operate within the purposes and legal bases indicated in this Privacy Notice.
The Data Controller adopts technical and organisational measures appropriate to the risk, aimed at protecting personal data from:
· unauthorised access;
· unlawful disclosure;
· alteration;
· destruction;
· accidental loss;
· unlawful or improper use;
· system unavailability;
· processing not in accordance with the stated purposes.
Access to personal data is granted exclusively to those who need it to carry out their activities and within the limits of the authorizations received.
Personal data may be processed by the Data Controller's personnel specifically authorized pursuant to Articles 29 of the GDPR and 2-quaterdecies of Legislative Decree 196/2003.
With regard to the data collected through the forms in the “Companies” and “Resellers” sections and through the e-Shop, the data may be processed, within the limits of their respective competences, by personnel belonging to the following departments:
· sales;
· administration;
· accounting;
· tax;
· logistics;
· customer care and support;
· IT and technical;
· legal.
Personal data may also be communicated to or made accessible to the following categories of recipients:
Depending on the circumstances, these recipients may act as:
· data processors appointed pursuant to Art. 28 GDPR;
· independent data controllers;
· persons authorized to process data.
When a provider acts as a data processor, the Controller enters into a specific agreement pursuant to Art. 28 GDPR.
The updated list of data processors can be requested by writing to privacy@iginiomassari.cyou.
Personal data is processed at the Controller's registered office and through the systems and providers used to deliver the services.
Some providers may be established or process personal data outside the European Economic Area.
With specific reference to the Uptonica platform, provided by Webgas S.r.l., although the main infrastructure is located in Germany, the provision of services also involves the use of sub-processors established outside the European Economic Area, particularly in the United States, for artificial intelligence, research, technical support services and, depending on the activated features, automated assistance via chatbots and other integrations. In accordance with the data processing agreement entered into with the provider, transfers are governed by the Standard Contractual Clauses approved by the European Commission and the applicable supplementary measures.
In such cases, transfers will be carried out in compliance with Articles 44 et seq. of the GDPR and on the basis of one of the instruments provided for by applicable law, including:
· an adequacy decision adopted by the European Commission;
· the Standard Contractual Clauses approved by the European Commission;
· binding corporate rules, where applicable;
· derogations specifically provided for by the GDPR;
· any further guarantees or supplementary measures necessary to ensure an adequate level of protection.
Before carrying out a transfer, the Controller assesses, where required, the level of protection guaranteed in the destination country and the technical, organisational and contractual measures applied by the provider.
Further information on the countries concerned, the providers used, the guarantees applied and the procedures for obtaining a copy can be requested from the Controller by writing to privacy@iginiomassari.cyou.
The Data Subject may exercise at any time the rights provided for by Articles 15-22 GDPR, within the limits and subject to the conditions established by applicable law.
In particular, the Data Subject may:
Obtain confirmation as to whether or not personal data relating to them is being processed and, if so, access to the data and the information provided for by the GDPR.
Obtain the rectification of inaccurate personal data and the completion of incomplete data.
Obtain the erasure of personal data in the cases provided for by applicable law.
Obtain the restriction of processing in the cases provided for by the GDPR.
Receive, in a structured, commonly used and machine-readable format, the personal data provided to the Controller and transmit it to another controller, when processing is based on consent or a contract and is carried out by automated means.
Object at any time, for reasons related to their particular situation, to processing based on legitimate interests.
In the case of processing for direct marketing purposes, including profiling connected to marketing, the Data Subject may object at any time without having to provide a reason.
Withdraw previously given consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Not be subject, in the cases provided for by applicable law, to a decision based solely on automated processing that produces legal effects or similarly significantly affects them.
The Data Subject may modify or withdraw preferences relating to cookies and advertising tracking tools through the consent management system available on the Website.
They may also manage preferences relating to activities carried out by Meta through the tools made available within their Facebook or Instagram account.
The rights may be exercised free of charge by writing to the Data Controller at the following address:
privacy@iginiomassari.cyou
The request must contain the information necessary to identify the Data Subject and to understand the right they intend to exercise.
The Data Controller will respond to requests without undue delay and, as a rule, within one month of receipt.
The deadline may be extended by a further two months in cases of particular complexity or a high volume of requests. In such cases, the Data Controller will inform the Data Subject of the extension and the reasons for it within one month of receipt of the request.
If there are reasonable doubts about the identity of the requester, the Data Controller may request additional information necessary to confirm their identity.
In the event of manifestly unfounded or excessive requests, in particular due to their repetitive nature, the Data Controller may charge a reasonable fee or refuse to comply with the request, within the limits permitted by Art. 12 of the GDPR.
If the Data Subject believes that the processing of their personal data is taking place in violation of applicable law, they have the right to lodge a complaint with the competent Supervisory Authority pursuant to Art. 77 of the GDPR.
For Italy, the competent Authority is the:
Italian Data Protection Authority
The Data Subject’s right to seek recourse before the competent judicial authority remains unaffected.
The Data Controller reserves the right to change or update this Privacy Notice, including as a result of:
· changes in laws or regulations;
· guidance from the competent authorities;
· technological developments;
· the introduction of new services;
· changes to business processes or the suppliers used.
The updated version will be published on the Website, indicating the date of the latest update.
If the changes significantly affect the processing carried out or the rights of Data Subjects, the Data Controller may provide specific notice through the Website, the User’s account, or other available contact channels
Consegna a casa
