Privacy policy

Last updated: 28 August 2026

1. Data controller

The data controller is Nuova Galleria Mariana S.r.l., Via di Porta Angelica 65/67, 00193 Rome (RM), Italy, VAT number 07024511003. Email: info@galleriamariana.com. Telephone: +39 06 6861849.

This policy describes the processing of personal data carried out through www.galleriamariana.com, the online store, contact forms, the newsletter and connected services.

2. Data processed

Identification and contact data: first and last name, email, telephone, billing and shipping address.
Order data: products, amounts, returns, refunds, communications and delivery status.
Payment data: transaction confirmation and identifiers. Full card details are collected directly by payment providers and are not made available to the Controller.
Account and support data: credentials managed by the platform, preferences and the content of requests.
Technical and usage data: IP address, device, browser, security logs, pages viewed and interactions, collected through cookies or similar technologies within the limits described below.
Marketing and review data: consents, preferences, interaction with communications and the content of reviews that may be published.

3. Purposes and legal bases

Orders, payments, deliveries, accounts, returns and support: performance of a contract or pre-contractual measures requested by the data subject (Article 6(1)(b) GDPR).
Invoicing, accounting, tax obligations, requests from authorities and product safety: compliance with legal obligations (Article 6(1)(c) GDPR).
Fraud prevention, website security, establishment or defence of legal claims and strictly necessary service improvement: legitimate interests of the Controller (Article 6(1)(f) GDPR), balanced against the rights and freedoms of data subjects.
Newsletter, email or SMS offers, promotional profiling and advertising personalisation: freely given, specific, informed and revocable consent (Article 6(1)(a) GDPR). Refusal does not prevent purchases or support requests.
Analytics cookies that cannot be treated as technical cookies and advertising cookies: consent, where required by applicable law.

Fields marked as mandatory in forms are used solely to handle the request or contract. Marketing consent must be separate and optional.

4. Processing methods and automated decisions

Data is processed electronically using organisational measures appropriate to the risk. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on the data subject, unless specific information and statutory safeguards are provided.

5. Recipients and providers

Where necessary, data may be disclosed to:

Shopify, which hosts and operates the e-commerce platform;
payment and anti-fraud providers selected at checkout;
carriers, postal operators and logistics partners;
communications and marketing providers, including Omnisend, only for data subjects who have consented where necessary;
analytics, reviews and consent-management providers, including Google Analytics, Judge.me and Pandectes, according to the configuration actually active and the preferences expressed;
accounting, tax, legal and technical advisers bound by confidentiality;
public authorities where required by law.

Providers processing data on behalf of the Controller are appointed as processors under Article 28 GDPR, where applicable.

6. Transfers outside the European Economic Area

Some providers, including Shopify and international technology services, may process data outside the European Economic Area. In such cases, transfers are based on an adequacy decision, the European Commission’s standard contractual clauses or another mechanism permitted by Articles 45–49 GDPR, with supplementary measures where necessary. Information on the safeguards may be requested from the Controller.

7. Retention

documents relating to orders, payments, invoices and accounting obligations: for the period required by law, normally 10 years;
account data: for the duration of the account and afterwards for as long as necessary to manage obligations or disputes;
contact and support requests: for the time needed to respond and, after closure, for the period needed to document the handling of the request or defend rights;
marketing data: until consent is withdrawn or while the data subject remains active, with periodic relevance checks and deletion or anonymisation when no longer needed;
technical data and cookies: for the periods stated in the cookie settings or required for security.

8. Cookies

Strictly necessary technical cookies are used for security, cart, checkout and requested functionality and do not require consent. Analytics cookies not equivalent to technical cookies, profiling cookies and advertising cookies are installed or activated only after an affirmative user choice, where required.

On the first visit, you may accept or reject non-essential cookies through the banner. Closing the banner leaves them disabled. Preferences can be changed through the consent control available on the website. Withdrawal does not affect the lawfulness of processing carried out before it.

9. Marketing

Promotional communications are sent only to recipients who have given valid consent or in the other limited cases permitted by law. Consent cannot be preselected or required in order to send a contact form or complete a purchase. It may be withdrawn at any time through the link in emails or by writing to info@galleriamariana.com.

10. Data subject rights

Where provided, the data subject may request access, rectification, erasure, restriction, data portability and object to processing; consent may also be withdrawn at any time. Requests may be sent to info@galleriamariana.com. To protect the data subject, we may request information necessary to verify identity.

The data subject may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the competent supervisory authority in the Member State where they live or work.

11. Minors

The services are not intended knowingly to collect minors’ data for promotional purposes. Alcoholic products may be purchased only by adults, and data necessary to verify age is processed to comply with legal obligations and prevent prohibited sales.

12. Changes

This policy may be updated because of legal, organisational or technical changes. The date of the latest revision appears at the beginning; appropriate notice will be given in the event of material changes.