Privacy Policy

1.1 Data Controller: ItalParcel di Samuel Borghesi, sole proprietorship, VAT no. IT 02818050227, registered office at Strada per Mechel 32, 38023 Cles (TN), Italy.

1.2 Contact: contact@italparcel.com — WhatsApp +39 329 313 0206 (no phone calls).

2.1 In connection with the Service, the Controller processes the following categories of personal data of the Customer and, where applicable, of the recipient indicated by the Customer:

(a) identification and contact data (name, address, e-mail, telephone); (b) tax data (tax code, VAT number, billing details); (c) operational data (destination address, shipping instructions, tracking references, pickup-point/locker credentials, communications via e-mail, WhatsApp and SMS); (d) parcel-content data (description, declared value, proofs of purchase, photos of contents, customs data); (e) payment data (data necessary to execute payments; card data are processed directly by payment service providers and are not stored by the Controller); (f) browsing data (IP address, browser user-agent string, and data of technical cookies, as described in Section 8); the IP address and user-agent are also included in the contact e-mail generated when the website form is submitted; (g) advertising and measurement data: data generated through the Google Ads tag for the measurement of advertising conversions, including advertising cookie identifiers (see Section 8) and, where the Customer submits the contact form, the e-mail address and, if provided, the telephone number, transmitted to Google in hashed (pseudonymised) form for the “enhanced conversions” functionality.

3.1 Personal data are processed for the following purposes:

(a) performance of the Service in all its phases (receipt, opening, repackaging, customs preparation, transmission to carriers/brokers, locker pickup, payment management, claims) — legal basis: Article 6(1)(b) GDPR;

(b) compliance with tax, accounting, customs and other legal obligations, and response to requests of competent authorities — legal basis: Article 6(1)(c) GDPR;

(c) cooperation with carriers, brokers, trade-mark owners and authorities in case of suspected unlawful, counterfeit, prohibited or dangerous goods (T&C Article 4.2); prevention of fraud and management of payment disputes and chargebacks (T&C Article 5.9); exercise or defence of legal claims; IT-systems security — legal basis: Article 6(1)(f) GDPR (legitimate interest);

(d) measurement of advertising effectiveness and of the conversions generated by Google Ads campaigns, by means of advertising cookies and similar technologies — legal basis: Article 6(1)(a) GDPR (consent), collected through the cookie banner; the Customer may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

3.2 The Customer may object to processing under point (c) above pursuant to Article 21 GDPR, on grounds relating to his or her particular situation.

4.1 Provision of data is necessary for the performance of the Service and for compliance with legal obligations. Failure to provide such data prevents activation or continuation of the Service and may result in application of T&C Article 4.5. Provision of advertising consent under Section 3.1(d) is optional and not necessary to use the Service.

5.1 Personal data may be communicated, for the purposes set out in Section 3, to: carriers, couriers and shipping brokers; pickup-point and locker operators; banks, payment service providers and payment processors; IT and communication service providers acting as data processors under Article 28 GDPR (including the website host, the e-mail delivery provider and the anti-bot/CAPTCHA provider); the Controller's accountants and legal counsel; competent authorities (customs, tax, law-enforcement, judicial, trade-mark owners) where required by law or permitted by the T&C.

5.2 When the Customer enters a delivery address in the website form, the address text typed is transmitted to the geocoding service Photon, operated by Komoot GmbH (Germany), for the sole purpose of providing address suggestions. Only the address text entered is sent; no other data is transmitted, and this processing does not involve any transfer outside the European Economic Area.

5.3 Where the Customer has given consent to advertising cookies (Section 8), the website uses Google Ads, provided by Google Ireland Limited (Ireland) and Google LLC (USA), for the measurement of advertising conversions. The data described in Section 2.1(g) are transmitted to Google for this purpose. Google acts as an independent data controller and/or data processor in accordance with its applicable terms. As regards transfers to the United States, Google LLC is certified under the EU-U.S. Data Privacy Framework.

6.1 The Service entails the transmission of data to carriers, brokers and operators located outside the European Economic Area whenever necessary to deliver the parcel to its destination. Such transfers are carried out under Article 49(1)(b) GDPR (performance of the contract).

6.2 For transfers to IT, communication and advertising service providers located outside the EU/EEA (including Google), the Controller relies on the safeguards provided for in Chapter V GDPR, including the Standard Contractual Clauses adopted by the European Commission (available on the European Commission's official website) and, where applicable, the provider's certification under the EU-U.S. Data Privacy Framework.

7.1 Data are retained for the time necessary for the purposes for which they are processed and, in any event:

(a) contractual, tax and accounting data: 10 years from the date of issue of each document (Articles 2214 and 2220 of the Italian Civil Code and applicable tax legislation); (b) operational data, parcel-content data, photos and communications: for the time necessary for the Service and until expiry of the applicable limitation periods; (c) browsing data, technical cookies and advertising cookies: as described in Section 8; advertising cookies set by Google Ads are retained for the durations indicated by Google (in general up to 90 days for the conversion-linker cookie), or until the Customer withdraws consent.

8.1 The italparcel.com website uses the following categories of cookies:

(a) Technical cookies (session, navigation and security/performance cookies), strictly necessary for the proper functioning and security of the website. These include third-party technical cookies set by Cloudflare (e.g. “__cf_bm”) in connection with the anti-bot/CAPTCHA protection of the contact form. Such cookies fall within the exemption set forth in Article 122(1) of the Italian Privacy Code and do not require the user's consent; (b) Advertising cookies, set by Google Ads (e.g. “_gcl_au” and cookies of the google.com / doubleclick.net domains), used to measure the conversions generated by the Controller's advertising campaigns. These cookies are not necessary for the functioning of the website. For users located in the European Economic Area, the United Kingdom and Switzerland, they are activated only after the user has given consent through the cookie banner displayed on first access to the website; outside those regions they are active by default (Google Consent Mode regional settings) and may be refused or deactivated at any time through the cookie banner / cookie settings.

8.2 The user may give, refuse or withdraw consent to non-necessary cookies at any time through the cookie banner / cookie settings of the website, and may also disable cookies through the browser settings; disabling necessary cookies may impair the functioning of the website.

8.3 The website does not use analytics cookies (such as Google Analytics), profiling cookies, or social-media tracking pixels.

9.1 Pursuant to Articles 15–22 GDPR, the data subject has the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. Where processing is based on consent, the data subject has the right to withdraw consent at any time pursuant to Article 7(3) GDPR. These rights may be exercised by writing to contact@italparcel.com.

9.2 The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali — www.gpdp.it), or with the supervisory authority of the EU Member State of habitual residence, work or alleged infringement.

10.1 This Privacy Policy is drafted in Italian and English. In case of discrepancy or conflict between the two versions, the Italian version shall prevail.