Last updated:
This notice explains how we process the personal data of people who visit www.pilates-shop.it or contact us through its forms, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (the “Privacy Code”), as amended by Legislative Decree 101/2018.
This website is a catalogue: it does not sell products online, handles no orders or payments and has no user accounts. We only collect the data needed to answer your requests and to run the site securely.
1. Data controller
IDS S.R.L., VAT no. 05215390872, registered office at Via Pietro Mascagni, 27/B, 95037 San Giovanni La Punta (CT), Italy.
Email: info@pilates-shop.it – Phone: +39 095 49 27 54
2. What data we process and why
a) Information and quote requests
When you fill in the “Request information” or “Request a quote” form, or when you email or call us, we process the data you give us: your name, email address, optionally your phone number and company, the product you are interested in and the text of your message.
- Purpose: to answer your request, send you information and quotes and, if you decide to go ahead, prepare the supply.
- Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
- Required data: name and email address, without which we cannot reply. Phone number and company are optional.
- Retention: for as long as needed to handle your request, and no longer than 24 months after our last contact. If the request leads to a contract, the data is kept for the duration of the relationship and for the following 10 years required by Italian civil and tax law (Article 2220 of the Civil Code).
The form stores your request in the website’s database, hosted by Hostinger in the European Union, and forwards it by email to our company mailbox. In the database the request is kept for no more than 24 months from receipt and is then deleted automatically. The date, time and version of this notice are recorded with each request, so that we can show it was provided to you; your IP address is not recorded.
b) Browsing data
Like any web service, the systems that run this site automatically receive some technical data sent by your browser: IP address, date and time of the request, page requested, outcome of the request, browser type and operating system.
- Purpose: running the site, keeping it secure and preventing abuse (such as automated spam sent through the forms).
- Legal basis: our legitimate interest in protecting the site and our systems (Article 6(1)(f) GDPR).
- Retention: technical logs are kept by our hosting provider for a limited period and then deleted. The IP address used by the forms’ anti-spam protection is held only in the server’s temporary memory and is never written to disk or to a database.
This data is not used to identify or profile you.
c) Cookies
This website uses no profiling cookies and no analytics or tracking tools.
Full details are in our Cookie policy.
3. How we process data
Data is processed electronically by authorised and trained staff, with technical and organisational measures appropriate to protect it against unauthorised access, loss or disclosure (including encrypted HTTPS connections and restricted access to our systems and to the website’s database). We make no decisions based solely on automated processing, including profiling (Article 22 GDPR), and we do not use your data to send you marketing communications.
4. Who receives the data
Your data is never sold or published. It may be processed, only for the purposes above, by:
- IDS S.R.L. staff authorised to process it (sales and administration);
- providers acting on our behalf as data processors (Article 28 GDPR): Hostinger International Ltd. (Cyprus, EU) for hosting the website and the database where requests are kept; Resend, Inc. (United States) for sending the emails generated by the forms; our business email provider;
- advisers, professionals and public authorities, where required to comply with legal obligations.
The up-to-date list of data processors is available on request.
5. Transfers outside the European Union
Some providers (Resend) may process data in the United States. Such transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, for providers certified under it, or on the Standard Contractual Clauses adopted by the European Commission (Article 46 GDPR).
6. Your rights
You can ask at any time to access your data, have it corrected or erased, restrict its processing, receive it in a portable format, and object to processing based on legitimate interest (Articles 15–21 GDPR). Where you have given consent, you can withdraw it whenever you like, without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3) GDPR).
To exercise your rights, email info@pilates-shop.it: we reply without undue delay and in any case within one month (Article 12 GDPR).
If you believe your data is processed unlawfully, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.
7. Changes to this notice
We may update this notice, for example when the site or the law changes. The current version is always published on this page, with the date of the last update shown at the top.