The Data Controller is Luigi Tarpani, owner of GiftCardia. For any information relating to the processing of personal data or for the exercise of the rights granted by applicable law, the data subject may contact the Data Controller using the following contact details:

Brand: GiftCardia
Legal Name: Luigi Tarpani
Registered Office: Via L. Settembrini 14/c - 06073 Corciano (PG) - Italy
Tax Code: TRPLGU74A11G478O
VAT Number: 03933610549
Email: info@giftcardia.it

In the course of its activities, the Data Controller may collect and process ordinary personal data, data belonging to special categories and data collected through IT and digital tools.

In particular, identification and contact data may be processed, including first name, last name, date and place of birth, tax code, residential or domicile address, telephone number and email address, as well as any other information necessary for the proper management of the relationship with the customer like informations about the subription and information about orderd and payament.

Data relating to the payment methods used, communications exchanged and information necessary for the administrative and accounting management of the relationship may also be processed.

Payments may be handled via third-party providers such as PayPal and Google Play; GiftCardia does not necessarily obtain the full payment instrument details but receives the transaction information required to manage the purchase and subscription.

When using the website, application or other digital platforms made available, data relating to access, use of digital services and browsing may be collected.

When using GiftCardia, business users may input certain customer data into the service, strictly to the extent necessary to manage the cards, their associated balances, and other features offered by the platform.

GiftCardia does not independently collect such data from the businesses' customers; instead, it stores and processes only the information entered by the users of the service. The data that may be entered is limited to first name, last name, phone number, email address, the balance associated with the card, and any notes added by the user.

With respect to such data, the business or entity using GiftCardia determines the purposes and means of processing and is responsible for the lawfulness of collecting and using its customers' data, as well as for fulfilling information obligations and obtaining any consents required by applicable law.

The Data Controller of GiftCardia processes such data exclusively to enable the operation and provision of the service, providing the user with the tools necessary to manage their customers and the associated cards; it does not use such information for its own commercial, promotional, or profiling purposes.

GiftCardia does not sell, transfer, or use for its own purposes the customer data entered into the service by users. Such data may be processed by technology providers used by GiftCardia exclusively to the extent necessary to provide the relevant services, as indicated in this policy.

Users who enter personal data concerning third parties into GiftCardia declare that they are authorized to process such data and undertake to use the service in compliance with applicable personal data protection laws.

The 'notes' field is intended exclusively for entering organizational information strictly necessary for customer management. It is prohibited to use this field to enter data belonging to special categories under Art. 9 of the GDPR, such as—by way of example—information regarding the data subject's health, racial or ethnic origin, religious or philosophical beliefs, political opinions, sex life, or sexual orientation.

Personal data is processed to provide the services, manage the administrative, tax and accounting aspects of the relationship and, more generally, to perform the obligations arising from the contractual relationship established with the customer.

The legal basis for the processing is the performance of the contract and of pre-contractual measures taken at the request of the data subject pursuant to Article 6(1)(b) of the GDPR.

Personal data is also processed to comply with obligations established by tax, accounting and civil law and by any other applicable legal provision or order issued by the competent Authority.

The legal basis for the processing is compliance with legal obligations pursuant to Article 6(1)(c) of the GDPR.

The legal basis for the processing is the explicit consent of the data subject pursuant to Article 9(2)(a) of the GDPR.

Personal data may also be processed for the establishment, exercise or defence of the Data Controller's rights in judicial or extrajudicial proceedings, on the basis of the Data Controller's legitimate interest pursuant to Article 6(1)(f) of the GDPR.

Subject to the data subject's free and optional consent, contact details may be used to send informational, promotional and commercial communications relating to the services, products, initiatives and events organized by GiftCardia by email, SMS, WhatsApp, telephone or other communication tools.

Subject to an additional and separate consent, photographs and videos depicting the data subject may be used and published on the website, on the related social media pages and in informational, advertising and promotional materials, exclusively for information and promotional purposes relating to the activities carried out.

If GiftCardia make an application, a restricted area, or other digital services available, personal data may also be processed to enable user registration and authentication, the management of personal accounts and associated activities, and the management of associated operations, operators, cards, customers, subscriptions, orders, and other functionalities provided by GiftCardia.

The provision of personal data necessary to establish and manage the contractual relationship is mandatory. Failure to provide the requested data may make it impossible for the Data Controller to provide the requested services.

Personal data is processed using paper-based, electronic and telematic tools, in accordance with the principles of fairness, lawfulness, transparency, relevance and data minimization.

The Data Controller adopts appropriate technical and organizational measures designed to ensure the security of personal data and prevent unauthorized access, loss, destruction, disclosure or unlawful use of the information processed.

Personal data may also be managed through management software, cloud platforms, mobile applications and IT systems used by the Data Controller to organize and provide its services.

Personal data may be processed by the Data Controller and by any duly authorized and instructed personnel, exclusively for purposes related to the provision and management of the GiftCardia service.

Data may also be disclosed or made accessible to third parties providing services necessary for the operation and management of GiftCardia, including IT, cloud, and hosting service providers, authentication services, payment service providers, and email services, as well as professionals and consultants for administrative, tax, accounting, and legal compliance purposes.

In particular, GiftCardia uses services provided by Google and Firebase for technology infrastructure, authentication, and data management; Google Play and PayPal for handling certain payments; Aruba for hosting services; and Brevo for sending email communications.

These parties process the data—depending on the specific case—either as data processors acting on behalf of the Data Controller or as independent data controllers, in accordance with applicable regulations and their respective terms and privacy policies.

Personal data may also be disclosed to public authorities, bodies, or other entities when such disclosure is required by law or requested by a competent authority.

Personal data will not be disseminated, except in cases expressly provided for by law.

Personal data will be retained for the time necessary to achieve the purposes for which it was collected and subsequently for the period required by applicable legislation.

Data relating to the contractual, administrative, tax and accounting relationship will be retained for ten years from the termination of the relationship.

Data processed for marketing purposes will be retained until consent is withdrawn and, in any event, for no longer than twenty-four months from the last significant interaction with the data subject.

Any images and videos used for promotional purposes will be retained until the consent given is withdrawn.

Data relating to the GiftCardia account and service usage will be retained for the duration of the relationship and, in the event of account termination or deletion, for a maximum period of six months, after which they will be deleted or anonymized, unless further retention is necessary to comply with legal obligations, protect the Data Controller's rights, or handle potential disputes.

Data entered by users in connection with the use of GiftCardia—including data regarding their customers, cards, and activities managed through the service— will be retained for the duration of the account and for a maximum period of five months following its termination or deletion, at which point they will be deleted or anonymized.

GiftCardia uses IT services and infrastructure provided by third parties to deliver its service.

The application's core data is managed via Google Firebase services, configured— where technically feasible—to ensure data localization within the European Union.

GiftCardia also utilizes services provided by Google (including via Google Play) and PayPal for payment processing, Aruba for hosting services, and Brevo for sending email communications.

Some of the providers used may belong to international groups or, in the course of delivering their respective services, may involve the processing or transfer of personal data to countries located outside the European Economic Area.

Any transfer of personal data to third countries will be carried out in compliance with Articles 44 et seq. of Regulation (EU) 2016/679 (GDPR), based on a European Commission adequacy decision or through the adoption of other safeguards provided for by applicable law, including—where necessary—Standard Contractual Clauses approved by the European Commission.

The data subject may exercise, at any time, the rights recognized by Articles 15 to 22 of the GDPR, including the right to access their personal data, rectify inaccurate data, erase data in the cases provided for by law, restrict processing, data portability, object to processing and withdraw any consent previously given.

The withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

To exercise the rights indicated above or obtain information about the processing of personal data, the data subject may contact the Data Controller using the contact details provided in this Privacy Notice.

If the data subject believes that the processing of their personal data violates applicable legislation, they have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la Protezione dei Dati Personali, pursuant to Article 77 of the GDPR, as well as to bring proceedings before the competent courts.