Privacy Policy
Last updated: 2 September 2026
This policy explains how Pelle Ricco collects, uses and protects personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
1. Data Controller
Pelle Ricco is not yet incorporated. Until it is, the data controller is a natural person:
Zoro Sadei Via Giovanni Boccaccio 43, 20123 Milano (MI), Italy Email: privacy@pellericco.eu
This section will be updated with company details once the business is incorporated, and you will be notified of the change if we hold your email address.
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR.
2. What we collect
Data you give us directly
- Account data: name, email address, password (stored hashed, never in readable form)
- Private enquiry data: name, contact details, and anything you include in an enquiry, appointment request or commission brief
- Measurement data, where you discuss a made-to-measure piece
- Correspondence: emails, messages and notes from appointments
- Marketing preferences, where you subscribe
Data collected automatically
- Technical data: IP address, browser type and version, device type, operating system
- Usage data: pages viewed, time on page, referring source, interactions with the site
- Cookie data, as described in our Cookie Policy
Data we do not collect We do not sell goods through this site and do not take payments. We do not collect payment card details.
We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with data, contact us and we will delete it.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Contract (Art. 6(1)(b)) |
| Responding to private enquiries and appointment requests | Pre-contractual steps at your request (Art. 6(1)(b)) |
| Discussing a made-to-measure commission, including measurements | Pre-contractual steps (Art. 6(1)(b)) |
| Answering questions about species, provenance and CITES documentation | Pre-contractual steps (Art. 6(1)(b)) |
| Fraud prevention and site security | Legitimate interests (Art. 6(1)(f)) |
| Marketing emails | Consent (Art. 6(1)(a)) |
| Defending legal claims | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have assessed that our interest in operating a secure and functioning site does not override your rights. You may object at any time (see section 7).
Consent, where relied upon, may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
4. Who we share it with
We share personal data only where necessary, and only with:
- Hosting and database provider — Supabase, Inc. — EU (Ireland), eu-west-1, to store account and enquiry data
- Email service provider — Resend, to send transactional and, where consented, marketing emails
- Professional advisers — where necessary
- Public authorities — where required by law
Each provider acting as a processor is bound by a data processing agreement under Article 28 GDPR. We do not sell personal data, and we do not share it for third-party advertising.
5. International transfers
Where a provider processes data outside the European Economic Area, the transfer is protected by an adequacy decision of the European Commission, by Standard Contractual Clauses approved by the Commission, or by another mechanism permitted under Chapter V GDPR. You may request a copy of the safeguards in place.
6. How long we keep it
| Data | Retention period |
|---|---|
| Account data | Until you delete your account, then 30 days |
| Private enquiries | 24 months from last contact |
| Measurements discussed for a commission | 24 months from last contact |
| Marketing consent records | Until withdrawal, then 24 months as proof of consent |
| Server and security logs | 12 months |
After these periods data is deleted or irreversibly anonymised. Once the business begins trading, statutory accounting retention periods will apply to transaction records and this table will be updated.
7. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- Access — obtain a copy of the data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure — have data deleted, where no legal obligation requires us to keep it
- Restriction — limit how we process your data
- Portability — receive data you provided in a structured, machine-readable format
- Object — object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent — at any time, without affecting prior processing
We do not carry out automated decision-making or profiling that produces legal effects.
To exercise any right, email privacy@pellericco.eu. We will respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. We may ask you to verify your identity first.
8. Complaints
If you believe your data has been handled unlawfully you may lodge a complaint with the Italian supervisory authority:
Garante per la protezione dei dati personali Piazza Venezia 11, 00187 Roma garante@gpdp.it — www.garanteprivacy.it
You may also complain to the supervisory authority in your country of residence, or bring proceedings before the courts.
9. Security
We use TLS encryption in transit, hashed password storage, access controls limiting access to what a role requires, and regular review of our providers' security posture. No system is perfectly secure, but we will notify you and the Garante of any breach likely to result in a risk to your rights, in accordance with Articles 33 and 34 GDPR.
10. Changes
We may update this policy. The date at the top shows when it was last changed. Material changes affecting your rights will be notified by email where we hold your address.