Privacy policy
Privacy policy
Last updated: 31 October 2026
This policy explains how Madama Gioia S.r.l. processes the personal data of people who visit madamagioia.com, buy on the site, sign up to the newsletter or contact us, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
1. Data controller
Madama Gioia S.r.l., Via Appia 306, 04026 Minturno (LT), Italy, VAT no. IT02860390596.
Email: gioia.madama@gmail.com · PEC: madamagioiasrls@pec.it · Phone: +39 340 145 7589.
We have not appointed a Data Protection Officer (DPO). For any privacy question you can write to the contact details above.
2. What data we process
- Contact and account data: first name, last name, email, phone, shipping and billing addresses.
- Order data: items purchased, amounts, returns, refunds, communications with customer service, delivery data.
- Payment data: payment is handled by the providers listed in section 5. We do not see or store the full card number or the security code.
- Browsing data: IP address, device, browser, pages viewed, products added to the cart, source of the visit, collected through cookies and similar technologies.
- Data you send us: messages through the contact form, withdrawal form, email, WhatsApp, appointment bookings, reviews.
If you buy on a marketplace, such as About You, we receive from that marketplace only the data needed to fulfil the order; for everything else the marketplace's own policy applies.
Providing the data needed for an order is required to complete it: without it we cannot fulfil the order. Providing data for marketing purposes is optional.
3. Why we process data and on what legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Managing orders, payments, shipping, returns and accounts | Performance of a contract (Art. 6.1.b GDPR) | For the duration of the relationship; the account until it is deleted |
| Tax and accounting obligations, legal guarantee | Legal obligation (Art. 6.1.c) | 10 years for accounting documents (Art. 2220 Italian Civil Code) |
| Answering requests and customer service | Steps requested by the data subject or legitimate interest (Art. 6.1.b and f) | 24 months from the last contact |
| Booking appointments in store | Steps requested by the data subject (Art. 6.1.b) | 12 months from the appointment |
| Newsletter, promotions, abandoned cart reminders | Consent (Art. 6.1.a) | Until consent is withdrawn; inactive data removed after 24 months |
| Statistics and personalised advertising through cookies | Consent (Art. 6.1.a; Art. 122 Italian Privacy Code) | As indicated in section 6 |
| Site security, fraud prevention, legal defence | Legitimate interest (Art. 6.1.f) | For the time needed; data relevant to a dispute until it ends |
We do not make decisions based solely on automated processing that produce legal effects on you. If you choose to pay in instalments, the creditworthiness check is carried out by the service provider, acting as an independent controller.
4. Consent and withdrawal
You can withdraw your consent at any time: with the unsubscribe link in every email or, for cookies, with the "Cookie preferences" link at the bottom of the site. Withdrawal does not affect the lawfulness of processing carried out before it.
5. Who we share data with
We do not sell personal data. We share it only with the parties needed for the purposes above, acting as processors or independent controllers:
- E-commerce platform and payments: Shopify; Shopify Payments for cards, Apple Pay, Google Pay and Shop Pay; Klarna; Satispay.
- Shipping: Poste Delivery Business (Poste Italiane group) and Sendcloud for label management.
- Email and messages: Klaviyo; WhatsApp (Meta) if you choose to write to us there.
- Advertising and measurement, only with your consent: Google (Google Ads), Meta (Facebook, Instagram), TikTok.
- Reviews and site features: Loox (reviews), Appointo (appointments), Instagram feed, YouTube (videos).
- Advisers and suppliers: accountant, technical and marketing consultants who manage the site on our behalf, within the limits of their assignment.
- Authorities: when required by law.
The up-to-date list of processors is available on request.
6. Cookies
We use technical cookies, needed for the site and the cart to work, which do not require consent. Statistics, preference and advertising cookies, ours and third-party, are activated only if you accept them in the banner. You can change your choice at any time from "Cookie preferences" at the bottom of the site. Refusing does not prevent you from buying.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _shopify_essential, cart_currency, localization | Shopify | Technical: session, cart, currency and language | Up to 1 year |
| _shop_app_essential | Shop | Technical: fast checkout access | 1 year |
| _shopify_analytics, shopify_client_id | Shopify | Statistics, with consent | 1 year |
| _shopify_marketing | Shopify | Marketing, with consent | 1 year |
| __kla_id | Klaviyo | Marketing, with consent | About 13 months |
| _fbp | Meta | Advertising, with consent | 3 months |
| _gcl_au | Advertising, with consent | 3 months | |
| _ttp, ttcsid | TikTok | Advertising, with consent | 3 months |
Videos are embedded in YouTube's privacy-enhanced mode: if you play them, YouTube may collect data under its own policy.
7. Transfers outside the European Economic Area
Some providers are based, or have infrastructure, outside the EEA, for example in the United States. In these cases the transfer is based on a European Commission adequacy decision, including the Data Privacy Framework for participating providers, or on standard contractual clauses. You can request a copy using the contact details in section 1.
8. Your rights
Under Articles 15–22 GDPR you have the right to: access your data, rectify it, erase it, restrict its processing, receive it in a portable format, object to processing based on legitimate interest and, in any case, to direct marketing, and withdraw your consent. Write to the contact details in section 1: we reply within one month.
You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority of your country of residence.
9. Minors
The site is intended for adults. We do not knowingly collect data from children under 14 for online services. Children's products are bought by an adult, who should not enter any data about the child beyond what is needed for delivery.
10. Security
We adopt appropriate technical and organisational measures to protect data, including encrypted connections and access limited to authorised staff. No system, however, is absolutely secure.
11. Changes
We may update this policy. The version in force is always on this page, with the date of the update. If the changes are significant, we will let you know.