1. INTRODUCTION
For Chiara De Donatis (hereinafter referred to as DEDO NATIS), your privacy and the security of your personal data are particularly important, which is why we collect and process them with the utmost care and attention, while adopting specific technical and structural measures to ensure the complete security of the processing.
In compliance with Article 13 of Regulation (EU) 2016/679 (“Regulation”), Legislative Decree 196/2003 (“Privacy Code”), as recently amended by Legislative Decree 101/2018 (“Regulation”), we inform you that your personal data is processed in a manner that guarantees security and confidentiality, using paper, computer, and/or electronic means, as detailed in this policy.
2. DEFINITIONS
Personal data: means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Special categories of personal data: this refers to personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data concerning a person's health or sex life or sexual orientation.
Data controller: means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processor: means the natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.
3. DATA CONTROLLER
Your personal data is processed by DEDO NATIS as Data Controller pursuant to and for the purposes of the Regulations. You can contact DEDO NATIS for any questions regarding the processing of your data at the following addresses:
• Company name: Chiara De Donatis, sole proprietorship
• Address/Registered office: Via Giovanni Battista Canobi 27, 00151 Rome (RM)
• Telephone number: +39 338 9843153
• Email address: privacy@dedo-natis.com
4. TYPE OF DATA, PURPOSE OF PROCESSING AND LEGAL BASIS
The personal data processed by DEDO NATIS is solely that provided by users, such as: IP address, personal identification data (such as name, surname, email address) provided while browsing and making purchases on our e-commerce and institutional websites or in our temporary boutiques. Your special categories of data are not processed.
Once collected, your personal data is processed for the following purposes:
A - For marketing activities (newsletters, sending promotional and advertising material relating to news, initiatives, and offers concerning DEDO NATIS products or services and/or for market research or opinion polls). The processing carried out for these purposes requires specific consent from the data subject.
B - For profiling activities, i.e., the processing by DEDO NATIS of your profile, after analyzing your habits and consumption choices, in order to improve the commercial offer and the services or products offered to you. The processing carried out for this purpose requires specific consent from the data subject.
C - For sending commercial and promotional communications following the purchase of one of our products (so-called soft spam or in the context of the potential sale of the same through the functionality connected to the so-called “recovery cart”). Following the purchase of one of our products, or in the context of a potential sale, we will send communications containing our commercial offers on products and services similar to those purchased to the email address you provided during the purchase process. The legal basis for the processing is the legitimate interest of the Data Controller. In fact, pursuant to Article 130 of the Privacy Code, the processing carried out for this purpose does not require specific consent from the data subject who, however, when each communication is sent, is informed of the possibility of objecting to the processing at any time by exercising the so-called opt-out to stop such communications.
D - For administrative and accounting purposes and for the management of any orders placed through the online channel on our e-commerce websites and/or at temporary boutiques and/or to provide a warranty on the products or services purchased. The legal basis for the processing is the execution of the contract between the Parties and legal obligations.
E - To enable proper navigation on the DEDO NATIS website, as well as the proper use of its various functions and pages, including those related to e-commerce.
5. MANDATORY NATURE OF DATA PROVISION
The provision of your data is:
• Optional for purposes A) and B) referred to in the previous point. In the absence of specific consent for these purposes, no processing of your data will be carried out;
• For purpose C), the data used has already been collected by the Data Controller for the various purposes indicated above. Therefore, the provision of data by you is not expressly requested as the Data Controller already has it;
• Mandatory for purpose D). Failure to provide data will make it impossible to comply with legal obligations and execute the contract; • Optional for purpose E). Failure to provide data will make it impossible to fully enjoy the functionality of the site and the browsing experience.
6. METHOD OF PROCESSING, DATA RECIPIENTS, AND DATA PROCESSORS
The processing may be carried out through the collection, recording, storage, and processing of data using both paper and electronic means. The data will be collected, processed, communicated, and stored for the time strictly necessary to achieve the purposes described. In the case of profiling, the data may be processed using computerized and automated logic to create your profile. Based on the information collected, DEDO NATIS may send you commercial information, discounts, and promotions in line with your needs. The data collected will be stored and kept at DEDO NATIS. The data may be communicated to subsidiaries, parent companies, affiliates, or companies otherwise connected to DEDO NATIS. The communication of data will be carried out within the limits strictly necessary for the execution of the obligations, tasks, and purposes described. Under no circumstances will the data be disclosed. Your personal data is processed by the systems and personnel of DEDO NATIS, specifically authorized pursuant to Article 4, paragraph 10 of the EU Regulation, and designated pursuant to Article 2 quaterdecies of Legislative Decree 196/2003, which processes data according to precise instructions from the Data Controller. The Data Controller may also use third parties to perform certain activities that may involve the processing of your personal data, appointing them as Data Processors pursuant to Article 28 of the GDPR and providing them with specific instructions. These third parties may belong to the following categories: financial operators; internet providers; companies specializing in IT services; consulting firms. Finally, your data may be transmitted to the police and judicial and administrative authorities, in accordance with the law, for the investigation and prosecution of crimes, the prevention and protection against threats to public safety, as well as to allow DEDO NATIS to exercise or protect its own rights or those of third parties before the competent authorities, as well as for other reasons related to the protection of the rights and freedoms of others, in accordance with the provisions of Article 2-sexies of Legislative Decree 101/2018.
7. DATA TRANSFERS OUTSIDE THE EU
Some of the third parties referred to in paragraph 6 above may be based in countries outside the European Union, but which offer an adequate level of data protection, as established by specific decisions of the European Commission when a so-called “adequacy decision” has been made.
The transfer of your personal data to third parties residing or located in countries that do not belong to the European Union and that do not ensure adequate levels of protection will only be carried out with your consent or after the conclusion of specific agreements between DEDO NATIS and said parties, containing safeguard clauses and appropriate guarantees for the protection of your personal data (so-called “standard contractual clauses”), also approved by the European Commission, or if the transfer is necessary for the conclusion and execution of a contract between you and DEDO NATIS or for the management of your requests.
8. DATA RETENTION PERIOD
We inform you that your data will be retained for a limited period of time, for the purposes indicated in point 4 above, and in any case: • until you withdraw your consent and in any case no later than 24 months after your last expression of interest in DEDO NATIS products in relation to marketing purposes (see point 4, letter A); • up to one year from collection in relation to profiling purposes (see point 4, letter B); • in accordance with and under the terms of Article 130 and provided that you do not expressly state that you do not wish to receive further communications (opt-out); • up to 30 days for users who have abandoned their shopping cart before completing their order; • for 10 years from collection for administrative and accounting purposes, only in relation to data necessary for administrative, accounting, and tax purposes (see point 4, letter D). At the end of these periods, your data will be permanently deleted by DEDO NATIS.
9. YOUR RIGHTS We inform you that you have the right to exercise the following rights in relation to the personal data covered by this policy, as provided for and guaranteed by the Regulation: • Right of access and rectification (Articles 15 and 16 of the Regulation): you have the right to access your personal data and request that it be corrected, modified, or supplemented. If you wish, we will provide you with a copy of your data in our possession. • Right to erasure of data (Article 17 of the Regulation): in the cases provided for by current legislation, you may request the erasure of your personal data. Once we have received and analyzed your request, we will cease processing and erase your personal data, if found to be legitimate.
• Right to restriction of processing (Art. 18 of the Regulation): you have the right to request the restriction of the processing of your personal data in the event of unlawful processing or dispute of the accuracy of the personal data by the data subject. • Right to data portability (Art. 20 of the Regulation): you have the right to request that the Data Controller provide you with your personal data in order to transmit it to another Data Controller, in the cases provided for in the aforementioned article. • Right to lodge a complaint (Art. 77 of the Regulation and Art. 141 of Legislative Decree 101/2018): you have the right to lodge a complaint with the competent Data Protection Authority if you believe that your rights have been or are being violated in relation to the processing of your personal data. • Right to withdraw consent (Art. 13 of the Regulation): for the processing of personal data based solely on your consent, you have the right to withdraw your consent at any time by contacting the Data Controller.
You may exercise your rights at any time with regard to the specific processing of your personal data by DEDO NATIS by sending a specific request to exercise your rights to the addresses indicated in point 3.
Further information about the rights of the data subject can be obtained by asking the Data Controller for a full extract of the above articles. Without prejudice to the above, we remind you that the above rights may also be exercised by anyone who has an interest of their own, or acts on your behalf, as your representative, or for family reasons worthy of protection, pursuant to Article 2-terdecies of Legislative Decree 101/2018.
10. SECURITY MEASURES
DEDO NATIS adopts appropriate security measures to safeguard the confidentiality, integrity, completeness, and availability of the data subject's personal data. Technical, logistical, and organizational measures are put in place to prevent damage, loss (including accidental loss), alteration, misuse, and unauthorized use of the data processed.
We regularly test, verify, and evaluate the effectiveness of security measures in order to ensure continuous improvement in the security of processing.
11. CHANGES TO THIS POLICY
The constant evolution of our services may lead to changes in the characteristics of the processing of your personal data described above. This privacy policy may be amended and supplemented over time, as necessary due to new regulations on the protection of personal data, or the evolution/modification of our services.
We therefore invite you to periodically check the contents of our policy: where possible, we will try to inform you promptly of any changes made and their consequences. In any case, should the purposes of the processing change, we will renew the request for specific consent.
Last update: December 1, 2025