|
Update: |
10/10/2026 |
PERSONAL DATA PROCESSING POLICY
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Data Controller
The Data Controller for the personal data processed through the website www.novadiorami.it is:
NOVA DIORAMI by Matteo Leoni
Via Ada Negri, 3
26866 MARUDO (LO) – Italy
Email: nova_diorami2026iscali.it
The Controller processes personal data in compliance with Regulation (EU) 2016/679 ("GDPR") and applicable Italian personal data protection laws.
TYPES OF DATA PROCESSED
The following categories of personal data may be processed during the use of www.nova diorami.it:
Browsing data
Technical information generated during browsing, such as IP address, date and time of the request, browser and device type, requested pages, and other technical information necessary for the operation and security of the website.
Data provided by the user
First name, last name, email address, telephone number, billing and shipping address, and other data provided by the user through contact forms, registration, orders, or support requests.
Customer account data
Information necessary for creating and managing the personal account on Modelland.it and viewing order history and related services.
Purchase data
Purchased products, amounts, information related to orders, billing, shipping, returns, and any support requests.
Payment data
Information necessary for payment processing may be transmitted to the payment service providers chosen by the user. NOVA DIORAMI does not necessarily acquire all complete payment instrument data, such as full card details, when this data is processed directly by the payment service provider.
Marketing communications data
Email address and information related to consent when the user voluntarily chooses to subscribe to the newsletter or receive promotional communications.
PURPOSES AND LEGAL BASES OF PROCESSING
Personal data may be processed for the following purposes:
Website management and security
To ensure the technical operation of the website, system security, prevention of misuse, and resolution of technical issues.
Legal basis: legitimate interest of the Controller in the security and proper operation of its systems, Art. 6(1)(f) GDPR, as well as the performance of services requested by the user where applicable.
Customer account registration and management
To create and manage the account requested by the user.
Legal basis: performance of a contract or pre-contractual measures requested by the data subject, Art. 6(1)(b) GDPR.
Order management
To receive and manage orders, payments, shipping, returns, warranty requests, and support related to purchases.
Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
Administrative, tax, and accounting obligations
For issuing and retaining tax documents and for other obligations required by applicable law.
Legal basis: compliance with legal obligations, Art. 6(1)(c) GDPR.
Information requests and support
To respond to communications voluntarily sent by the user.
Legal basis: performance of pre-contractual measures requested by the data subject or the Controller’s legitimate interest in handling the requests received, depending on the nature of the communication.
Newsletters and promotional communications
To send newsletters, commercial information, promotions and news from Modelland.it, exclusively where provided for on the basis of the data subject’s consent or another applicable legal basis.
Legal basis: the data subject’s consent, Art. 6(1)(a) GDPR, except where the law permits such communications on the basis of a different legal ground.
Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.
NATURE OF THE PROVISION OF DATA
Providing the data required to manage an account, order, payment and shipment is necessary to use the relevant services.
Failure to provide essential data may make it impossible to create an account, complete a purchase, make a delivery or provide the requested service.
Providing data for marketing purposes is optional, and failure to give consent does not prevent you from making purchases or using other website features.
PROCESSING METHODS AND SECURITY
Personal data are processed using electronic tools and, where necessary, manually.
The Controller adopts technical and organisational measures appropriate to the risk to protect personal data against loss, destruction, unauthorised access, disclosure or unlawful processing.
Access to data is limited to those who need it to perform their respective duties.
RETENTION PERIOD
Personal data are retained for as long as necessary to fulfil the purposes for which they were collected and, thereafter, for the periods required by applicable law or necessary to protect the Controller’s rights.
In particular:
- data relating to purchases, billing and tax records: for the periods prescribed by applicable tax and accounting regulations, normally up to 10 years;
- data relating to information requests: for as long as necessary to handle the request and any subsequent relationship with the data subject;
- customer account data: for the period during which the account is used and thereafter for as long as necessary to comply with legal obligations or protect any rights;
- data used for newsletters and marketing: until consent is withdrawn or the right to object is exercised, without prejudice to any additional periods necessary to document consent and its withdrawal;
- technical data and logs: for the period necessary to ensure system security, operation and maintenance, in accordance with the relevant technical and security requirements.
At the end of the applicable periods, the data are deleted or anonymised, unless further retention is necessary to comply with legal obligations or protect a right.
RECIPIENTS OF THE DATA
Personal data may be disclosed, to the extent necessary for their respective activities, to parties such as:
- couriers, carriers and logistics operators;
- payment service providers;
- IT service, hosting, maintenance and technical support providers;
- providers of services required to manage the e-commerce business;
- tax, accounting and legal advisers and other professionals;
- public authorities and other parties where disclosure is required by law.
Depending on the service and processing carried out, such parties may act as processors pursuant to Art. 28 GDPR or as independent controllers.
The current list of data processors may be requested from the Controller by writing to nova_diorami2026iscali.it.
Personal data are not sold to third parties.
TRANSFERS OF DATA TO THIRD COUNTRIES
If, in connection with the services used by the Controller, personal data are transferred outside the European Economic Area, the transfer will be carried out in accordance with Articles 44 et seq. of the GDPR, on the basis of one of the mechanisms provided for by applicable law, such as an adequacy decision by the European Commission or, where necessary, Standard Contractual Clauses and additional safeguards required by law.
Further information about any transfers may be requested from the Controller.
DATA SUBJECT RIGHTS
In the cases provided for by the GDPR, the data subject may exercise the rights set out in Articles 15–22, including the right to:
- obtain confirmation as to whether or not personal data concerning them exist and access those data;
- request that they be rectified or completed;
- request its erasure in the cases provided;
- request the restriction of processing;
- object to processing in the cases provided;
- obtain data portability where applicable;
- withdraw consent previously given at any time, without affecting the lawfulness of the processing carried out before the withdrawal.
Requests can be sent to nova_diorami2026iscali.it.
The data subject also has the right to lodge a complaint with the competent supervisory authority. In Italy, the competent authority is the Garante per la protezione dei dati personali.
COOKIES AND OTHER TRACKING TOOLS
NOVA DIORAMI uses technical cookies necessary for the operation of the e-commerce site.
As of the date of the last update of this policy, no analytics or profiling cookies requiring prior consent are being used, based on the current configuration of the site.
If tracking tools that are not strictly necessary are introduced in the future, measures provided for by applicable legislation will be adopted, including, where required, obtaining prior consent.
THIRD-PARTY LINKS AND SERVICES
NOVA DIORAMI may contain links to websites or services operated by third parties.
When the user chooses to access such websites, the processing of data carried out by the third party is governed by its own privacy policy. The Data Controller does not control the processing carried out independently by the operators of external websites.
AMENDMENTS TO THE POLICY
The Data Controller may update this policy to adapt it to regulatory, organizational, or technical changes, or to changes in the services offered.
The updated version will be published on this page, indicating the date of the last update.
CONTACTS
For requests relating to the processing of personal data or the exercise of the rights provided for by the GDPR:
NOVA DIORAMI by Matteo Leoni
Via Ada Negri, 3
2686 MARUDO (LO) – Italy
Email: nova_diorami2026iscali.it