Privacy
Information pursuant to articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) – last updated: 15 October 2026
1. Data controller
la Fata & il Drago di Gennari Niccolò, Viale Aurora 33, 30028 Bibione (VE), Italy, VAT no. IT03600950277, tax code GNNNCL78T12G479J.
E-mail: info@lafataeildrago.com – PEC: lafataeildrago@pec.it – Telephone: +39 340 3545414.
No Data Protection Officer (DPO) has been appointed, as one is not required for our business.
2. What data we process
- Contact and delivery data: first name, last name, e-mail, telephone, shipping and billing addresses; tax code or VAT number if you request an invoice or choose insured shipping.
- Account data: e-mail and password (stored encrypted), saved addresses, order history, wish list.
- Purchase data: products, amounts, chosen payment and delivery methods. Card or account details are entered directly on the Nexi or PayPal pages: we do not receive them.
- Fairy Card and coupon data: for coupons linked to the Fairy Card, the e-mail address and, for the Fairy Card Gold, the shipping address the coupon is linked to.
- Messages and reviews: what you write to us by e-mail, by telephone and WhatsApp (order Hot-Line) or through the Site, and the reviews you publish on products.
- Preferences and special dates (optional): if you choose to tell Tanja, our WhatsApp assistant, about them while chatting: your tastes (subjects, collections, style, price range for gifts) and dates to remember, yours or of people you buy gifts for (first name, relationship and day only). If you give us another person's details, make sure they agree: we never use anything else about them.
- Date of birth (day and month, optional): if you provide it, we only use it to send you a birthday greeting email. You can remove it from your account at any time.
- Browsing data: IP address, browser, pages visited, recorded by the server for security and, only with your consent, by the statistics tools described in the Cookie policy.
3. Why we process them, on what basis and for how long
| Purpose | Legal basis | Retention |
|---|---|---|
| Managing orders, payments, deliveries, returns, withdrawals and warranty | Performance of the contract (art. 6.1.b GDPR) | For the duration of the relationship and up to 26 months after delivery (legal warranty) |
| Accounting and tax obligations (receipts, invoices) | Legal obligation (art. 6.1.c GDPR) | 10 years (art. 2220 Italian Civil Code) |
| Managing your account on the Site | Performance of the contract (art. 6.1.b GDPR) | Until the account is deleted, which you can ask us to do at any time |
| Answering your requests and customer service | Performance of the contract or pre-contractual measures (art. 6.1.b GDPR) | Up to 3 years after the request is closed |
| Fairy Card and coupons | Performance of the promotion rules (art. 6.1.b GDPR) | For the validity period of the card or coupon |
| Newsletter and promotional communications by e-mail and WhatsApp | Consent, optional and revocable (art. 6.1.a GDPR) | Until consent is withdrawn (“Unsubscribe” link in every e-mail, or by writing STOP on WhatsApp) |
| Personalised suggestions and reminders of special dates on WhatsApp (we write to you about two weeks before, with a gift idea) | Consent, optional and revocable (art. 6.1.a GDPR), given by answering Tanja's questions | Until withdrawn: writing STOP on WhatsApp also deletes your preferences and dates; you can also ask us to delete just part of them |
| E-mails about products similar to those you have already bought | Legitimate interest (art. 130(4) Italian Privacy Code) | Until you object, which you can do in every e-mail |
| Publishing product reviews | Consent, given by sending the review (art. 6.1.a GDPR) | As long as the review remains published or until you ask for its removal |
| Site security and fraud prevention (server logs, reCAPTCHA anti-spam check on forms) | Legitimate interest (art. 6.1.f GDPR) | Server logs: up to 6 months, unless needed to investigate abuse |
| Visit statistics | Consent via the cookie banner (art. 6.1.a GDPR) | As stated in the Cookie policy |
| Defending our rights in case of disputes | Legitimate interest (art. 6.1.f GDPR) | For the limitation period of the rights (up to 10 years) |
Providing the data needed for the order is mandatory: without them we cannot conclude and perform the contract. Other data are optional. Tanja's replies and personalised suggestions are prepared automatically, also with artificial intelligence tools, but we never take decisions that produce legal effects on you based solely on automated processing.
4. Who we share the data with
Data are not disclosed to the public. We share them only with the parties we need for the purposes above, acting as data processors (art. 28 GDPR) or as independent controllers:
- Couriers and postal services: SDA Express Courier and BRT (Bartolini) for Italy, GLS for other countries, Poste Italiane for book mail (Piego di Libri).
- Payments: Nexi Payments S.p.A. (cards), PayPal (Europe) S.à r.l. et Cie, S.C.A., Poste Italiane (PostePay top-up), our bank (bank transfers).
- Hosting and e-mail: Aruba S.p.A., which hosts the Site and our e-mail on servers in Italy.
- Newsletter sending: the e-mail marketing platform we use is installed on our own server and does not pass data to third parties.
- Anti-spam protection: Google Ireland Ltd (reCAPTCHA) on the registration and login forms.
- Statistics and social media, only with your consent: see the Cookie policy.
- Technical support: the professional who manages the Site and the server on our behalf and, for maintenance and support, may access customer data; appointed as data processor.
- Messaging and WhatsApp assistant: WhatsApp Ireland Ltd, if you contact us via WhatsApp or subscribe to our WhatsApp updates; to run Tanja: Supabase Inc. (storage of contacts and conversations), Cloudflare Inc. (processing of questions), Anthropic PBC (artificial intelligence to understand and write messages and for translations), Google Ireland Ltd (WhatsApp contact book).
- Advisers: our accountant and, if necessary, lawyers.
- Authorities, when required by law.
The up-to-date list of data processors is available on request.
5. Transfers outside the European Union
We process data in the European Union. Some providers (Google for reCAPTCHA and Analytics, Meta for the Facebook box and WhatsApp, PayPal, Supabase, Cloudflare and Anthropic for the WhatsApp assistant) may transfer data to the United States: this takes place under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or, failing that, under the standard contractual clauses approved by the Commission.
6. Your rights
You may ask us at any time for access to your data, rectification, erasure, restriction of processing and portability (arts. 15-20 GDPR); you may object to processing based on legitimate interest and, always and without giving reasons, to promotional communications (art. 21 GDPR); you may withdraw your consent at any time, without affecting processing already carried out.
To exercise these rights write to info@lafataeildrago.com or to the PEC address lafataeildrago@pec.it. We reply within one month (art. 12 GDPR).
If you believe that the processing infringes the GDPR you may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it, Piazza Venezia 11, 00187 Rome) or with the authority of the country where you live.
7. Minors
Purchases on the Site are reserved for adults. We do not knowingly collect data of minors; if we find that we have received any, we delete them.
8. Changes
We may update this policy, for example when the services we use change. The date of the last update is shown at the top; we will point out significant changes on the Site.