Privacy Policy

Privacy notice provided pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) to users of the website www.michelamezzetti.com and to customers of the online shop. Last updated: 25/10/2026.

1. Data controller

The data controller is MEZZETTI MICHELA, a sole proprietorship owning the «Michela Mezzetti» brand, Via San Giovanni 31, 53037 San Gimignano (SI), Italy, VAT no. IT01258300522, REA SI-133280. For any matter concerning personal data: hello@michelamezzetti.com, +39 392 789 6648, or by post to the registered address.

2. Data protection officer

The Controller has not appointed a Data Protection Officer, as the conditions set out in Article 37 of the GDPR do not apply.

3. What data we process, why and for how long

We process the data you provide through the website — cart and checkout, customer account, contact forms, newsletter sign-up, reviews — and the data generated by your browsing.

Order fulfilment (conclusion of the contract, payment, shipping, returns, withdrawal and refunds): first name, surname, shipping and billing addresses, e-mail, telephone, country, order details and payment outcome. Legal basis: performance of the contract (Art. 6(1)(b)). Retention: 10 years for the part included in accounting records; otherwise until the expiry of the statutory warranty period (26 months from delivery) and of any claims.

Tax and accounting obligations: billing and payment data, tax code or VAT number if you request an invoice. Legal basis: legal obligation (Art. 6(1)(c); Art. 2220 of the Italian Civil Code). Retention: 10 years.

Payment fraud prevention: transaction data, IP address and device identifiers collected at checkout by the payment provider’s anti-fraud service. Legal basis: legitimate interest in preventing fraud and abuse (Art. 6(1)(f)). Retention: for the time needed for verification and to handle disputes.

Instalment payments: identification and contact details, order amount and the data required for the credit assessment carried out by the service provider, acting as an independent controller. Legal basis: performance of the contract at your request (Art. 6(1)(b)). Retention: for the duration of the order; for the provider, as set out in its own privacy notice.

Customer account, order history and wishlist: credentials, identification details, saved addresses, purchase history, saved products. Legal basis: performance of the contract (Art. 6(1)(b)). Retention: until the account is deleted or after 24 months of inactivity, after which only accounting data are kept.

Support, information requests and complaints (e-mail, telephone, contact form): contact details, order number and content of the request. Legal basis: performance of the contract if the request concerns an order, otherwise legitimate interest in replying (Art. 6(1)(f)). Retention: 12 months from the closure of the request; if the request concerns an order, up to 26 months from delivery (limitation period for the statutory warranty, Art. 133 of Italian Legislative Decree 206/2005).

Retailer enquiries and business contacts: contact details of the contact person, business name and contact details. Legal basis: pre-contractual measures at the data subject’s request (Art. 6(1)(b)) and legitimate interest in developing the sales network (Art. 6(1)(f)). Retention: for the duration of the negotiation and of the business relationship; 24 months from the last contact if no agreement is reached.

Newsletter: e-mail address and, if you provide them, country and preferences. Legal basis: consent given by ticking the sign-up box or by clicking the sign-up button (Art. 6(1)(a)), which you may withdraw at any time. Retention: until you withdraw consent or unsubscribe. Welcome gift: if you sign up, we send you a welcome e-mail; any gift codes you have already received remain valid. To manage gifts we keep your e-mail address, language and the order in which a gift was used, if any; legal basis: performance of the offer you requested (Art. 6(1)(b)); retention: until you unsubscribe. Checkout reminders: if you enter your e-mail address at checkout but do not complete the order, we may send you up to two reminder e-mails about the items left in your cart. Legal basis: legitimate interest (Art. 6(1)(f)); you can opt out at any time via the link in each e-mail.

Personal link in newsletters: our newsletters, and signing up through the website pop-up, can link your browser to a personal code. When you open the link we record the click and the landing page; the code stays in your browser’s storage for up to 12 months and, if you add products to your cart, allows us to associate your e-mail address with it in order to send you a cart reminder. Only if you have accepted marketing cookies do we also record your later visits to the website (the landing page, the product pages you view and where the visit comes from) and link them to your e-mail address. Legal basis: legitimate interest in measuring the effectiveness of the newsletter and in managing the cart (Art. 6(1)(f)) and, for later visits, consent given through the banner (Art. 6(1)(a); Art. 122 of Italian Legislative Decree 196/2003). Retention: about 30 days in the internal archive; if you unsubscribe, the code stops working and is deleted from your browser at your next visit.

E-mail communications about products similar to those you purchased: the e-mail address provided at the time of purchase. Legal basis: Article 130(4) of Italian Legislative Decree 196/2003, with the right to object free of charge at the time of collection and in every message. Retention: 24 months from the last purchase.

Reviews: name or nickname, rating, text and order data used to verify the purchase. Legal basis: consent to publication (Art. 6(1)(a)); legitimate interest in verifying the purchase (Art. 6(1)(f)). Retention: until you request removal or the product is withdrawn from the catalogue.

Website usage statistics and advertising campaign measurement: browsing data and identifiers collected through cookies or similar technologies (Google Analytics 4, Google Tag Manager and Google Ads), only after your consent. Legal basis: consent given through the banner (Art. 6(1)(a); Art. 122 of Italian Legislative Decree 196/2003). Retention: for the periods indicated in the Cookie Policy.

Purchase journey on the website: to understand which products attract interest and at which step purchases are abandoned, we record in an internal website archive, for each cart, checkout and order, the products, the amount, the language, the country and, if you entered it at checkout, your e-mail address. For each visit we also record where it comes from, reduced to the name of the referring website (for example Instagram or Google, never the full address) or “direct”, together with any campaign parameters in the link. Only if you accept analytics cookies, the most recent external source of your visit (for example Instagram) is remembered by your browser for 7 days and also recorded on your cart, checkout and order, so that we know where purchases come from; if you later come back to the website directly, the earlier source still applies. Only if you accept analytics cookies is your visit assigned a random code, valid until you close the browser tab, which links the pages you view to your cart; without this consent the pages you view are not linked to your cart. Legal basis: legitimate interest in running and improving the online shop (Art. 6(1)(f)) and, for the visit code, consent given through the banner (Art. 6(1)(a); Art. 122 of Italian Legislative Decree 196/2003). Retention: records are automatically deleted after about 30 days.

Establishment, exercise or defence of legal claims: the data required for the specific dispute. Legal basis: legitimate interest (Art. 6(1)(f)). Retention: for the duration of the dispute and of the time limits for appeal.

We do not process special categories of data and we do not take decisions based solely on automated processing that produce legal effects concerning you. Anti-fraud and creditworthiness checks are carried out by the payment providers: a refusal does not prevent you from completing your purchase with another payment method or from contacting us.

4. Whether providing data is mandatory

The data marked as mandatory at checkout are necessary to conclude and perform the contract: without them it is not possible to purchase. Data for the newsletter, reviews and wishlist are optional and failure to provide them has no consequence on your purchase; for the newsletter only your e-mail address is required.

5. Who we share data with

Within the limits of the purposes indicated, data may be disclosed to: Wix.com Ltd. (Tel Aviv, Israel) and its group companies, which provide the platform, hosting, online shop, forms, reviews and customer account, as data processor; the card payment provider Wix Payments, as an independent controller for transaction data; Apple (Apple Pay), Google Ireland Ltd. (Google Pay) and Klarna Bank AB (publ) (instalment payments), as independent controllers, when you choose that payment method; Google Ireland Ltd. (Dublin), which hosts our e-mail and provides the Google Analytics, Google Tag Manager and Google Ads services, as data processor for e-mail and under its own terms for advertising services; the couriers DHL and FedEx for delivery; Wix.com Ltd. also for sending the newsletter (Wix Email Marketing); the agency that maintains the website, as data processor; professionals and consultants for accounting, tax and legal obligations; authorities and public bodies where disclosure is required by law. We do not store full payment card data and we do not share customer data with the brand’s retailers. Data are not disseminated, except for reviews published under the name or nickname you have chosen. An up-to-date list of data processors is available from the Controller on request.

6. Transfer of data outside the European Union

The Wix platform is based in Israel, a country for which the European Commission has adopted an adequacy decision (Decision 2011/61/EU), and also uses infrastructure in the United States; Google services and payment services may involve processing in the United States. In such cases the transfer takes place on the basis of an adequacy decision — including, for certified providers, the EU-U.S. Data Privacy Framework — or of the standard contractual clauses approved by the European Commission (Art. 46(2)(c)), supplemented by the measures indicated by the providers. You may ask us for a copy of the safeguards adopted.

7. How we protect data

Data are processed by electronic means and, for accounting purposes, also on paper, by persons authorised and instructed by the Controller, with technical and organisational measures appropriate to the risk: protected access and multi-factor authentication for the management dashboard and e-mail, encrypted connection (HTTPS), payments handled in the providers’ PCI DSS-certified environments, access limited to those who need it.

8. Your rights

You may at any time exercise the rights provided for in Articles 15 to 22 of the GDPR: access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest and, in any case, objection to commercial communications. You may withdraw your consent to the newsletter, reviews and cookies as easily as you gave it — via the link in every e-mail, the cookie preferences panel or by writing to us — without affecting the lawfulness of processing already carried out. Write to hello@michelamezzetti.com or to the registered address: we reply within one month, which may be extended by two months in complex cases; exercising your rights is free of charge except in the cases provided for in Article 12(5). If you believe that the processing infringes the GDPR you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy — www.garanteprivacy.it) or with the supervisory authority of the country where you live or work, without prejudice to your right to bring court proceedings.

9. Cookies

The use of cookies and similar technologies, how consent is given through the banner and how it can be withdrawn through the preferences panel are described in the Cookie Policy below, which forms an integral part of this notice.

10. Updates

This notice may be updated following changes in the law, in the services offered or in the providers used. The version in force is the one published on this page with its last-updated date; material changes are communicated to registered users and newsletter subscribers.

 

COOKIE POLICY

Information on the use of cookies and similar technologies provided by MEZZETTI MICHELA — Michela Mezzetti, Via San Giovanni 31, 53037 San Gimignano (SI), Italy, VAT no. IT01258300522, hello@michelamezzetti.com, pursuant to Article 122 of Italian Legislative Decree 196/2003 and Articles 6, 7 and 13 of Regulation (EU) 2016/679. Last updated: 25/10/2026.

1. What cookies are

Cookies are small text files that the website sends to your device, where they are stored and sent back on your next visit. The following also applies to technologies with a similar function — tracking pixels, identifiers stored in the browser’s local storage, third-party scripts.

2. Legal basis

Technical cookies, which are necessary to provide the service you request or for the security of the website and of payments, are set without consent. Analytics and marketing cookies are set only after your consent, given through the banner and revocable at any time.

3. Which cookies this website uses

Technical and functional cookies — always active. They are needed for the website to work and for the services you request: session and security management, cart and checkout, customer account, language, storage of the choices made on the banner, payment fraud protection. They are set by the Wix platform on our behalf and, at the time of payment, by the payment providers.

Analytics cookies — only with your consent. They allow us to understand, in aggregate form, how the website is used, in order to improve it. For this purpose we use Google Analytics 4 by Google Ireland Limited (cookies _ga and _ga_*, duration up to 2 years), activated only after consent.

Marketing cookies — only with your consent. They allow us to measure the effectiveness of our advertising campaigns and to show you ads relevant to your interests on Google’s networks. For this purpose we use Google Tag Manager and Google Ads by Google Ireland Limited (cookie _gcl_au, duration 90 days), activated only after consent.

Browser storage used by the website. In addition to cookies, the website uses your browser’s storage for: the visit code (mm_sess, until you close the tab), created only if you accept analytics cookies, which links the pages you view to your cart; the origin of the visit (mm_prov, until you close the tab), saved only if you accept analytics cookies; the most recent external source of the visit (mm_prov_ext, up to 7 days), saved only if you accept analytics cookies and deleted if you refuse them, which links that source to your cart and order; the personal newsletter or pop-up link code (mm_nl, up to 12 months), which connects that link to your cart and, only with consent to marketing cookies, to your later visits.

The detailed and always up-to-date list of individual cookies — name, purpose, duration and the party setting them — is available in the preferences panel, which can be opened at any time via the «Cookie settings» link in the footer of every page.

4. Consent, refusal and withdrawal

On your first visit a banner appears allowing you to accept all non-technical cookies, reject them all or choose by category. Until you make a choice no cookies other than technical ones are set; closing the banner or continuing to browse does not amount to consent, and rejecting is as easy as accepting. Your choice is stored for at least six months. You may change or withdraw it at any time by reopening the preferences panel; withdrawal applies for the future.

5. Third parties

Third-party cookies are set by parties other than the Controller, which process data under their own privacy policies and may transfer them outside the European Union on the basis of adequacy decisions or standard contractual clauses: Google (https://policies.google.com/privacy?hl=en; personalised advertising options: https://adssettings.google.com), Wix (https://www.wix.com/about/privacy), payment providers (privacy notices indicated at checkout).

6. Managing cookies from your browser

Regardless of the choices made on the website, every browser allows you to block or delete cookies; blocking technical cookies may prevent the cart, checkout and customer account from working. Instructions: Chrome https://support.google.com/chrome/answer/95647?hl=en · Firefox https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop · Safari https://support.apple.com/en-gb/guide/safari/sfri11471/mac · Edge https://support.microsoft.com/en-us/microsoft-edge

7. Your rights

You may exercise the rights provided for in Articles 15 to 22 of the GDPR by writing to hello@michelamezzetti.com and lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it). The processing of data for purposes other than cookies is described in the Privacy notice above.

8. Updates

This policy may be amended following changes to the website or to third-party services. The version in force is the one published on this page, with its last-updated date.