Privacy policy

This privacy policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter "GDPR") and Legislative Decree no. 196 of 30 June 2003 (Personal Data Protection Code, as amended by Legislative Decree 101/2018), to users who consult and use the Tuscany Market Hub marketplace, accessible at tuscanymarkethub.it (hereinafter, the "Marketplace" or the "Platform").

The Marketplace is a digital infrastructure that connects artisan and agri-food producers from the Tuscan territory with end customers. This policy exclusively concerns the processing carried out by the Platform owner in relation to the management activities of the Marketplace; for processing carried out by individual vendor producers as independent data controllers, please refer to their respective privacy policies.

1. Data Controller

The Data Controller for personal data is:

Federazione Italiana Ambulanti (FIA) — implementing body for the Tuscany Market Hub project. Regional application code: 369.20250414.998000091.

For any request related to the processing of personal data and for exercising data subject rights, updated contact details are published on the Contacts page.

2. Types of Personal Data Collected

The Marketplace collects and processes the following types of personal data:

2.1 Browsing Data

During the normal operation of the Marketplace, computer systems acquire certain data whose transmission is implicit in the use of Internet communication protocols: IP addresses, device and browser identifiers (user agent), pages visited, time of request, parameters related to the operating system and the user's computer environment. This data is processed solely to ensure the correct functioning of the Marketplace and to detect any anomalies.

2.2 Data Provided for Account Creation

Users who choose to register on the Marketplace provide: first name, last name, email address, password (stored in encrypted form), and optionally phone number and address. This data allows for personalized management of the shopping experience, order history, and management of saved delivery data.

2.3 Data Provided During Purchase (Account or Guest Checkout)

To complete an order — whether through a registered account or guest checkout — the following are collected: identification data (first name, last name), contact data (email, phone), delivery address, billing address, tax data where required (tax code, VAT number for professional subjects), details of ordered products, and chosen delivery method (home delivery via affiliated courier or pickup at one of the active markets in the project circuit).

2.4 Payment Data

Data relating to payment instruments (card number, expiration date, security code) are never processed or stored by the controller. Payment operations occur in a secure environment managed by the payment service provider integrated into the Marketplace, certified according to industry security standards (PCI-DSS). The controller receives from the payment service provider only confirmation of the successful transaction and the transaction reference.

2.5 Data Collected via Contact Form

By filling out the contact form that may be present on the Marketplace, the user voluntarily provides: first name, last name, email address, subject, and content of the request. This data is used exclusively to respond to the user's request.

2.6 Data Collected via Newsletter Subscription

Users who wish to receive the project newsletter provide their email address. Subscription occurs via a double opt-in procedure. The contact list is technically unitary at the MANUARTI/Tuscany Market Hub project level, and each subscriber is associated, during registration, with an identifier ("tag") that tracks the source of subscription, in order to allow the sending of relevant communications.

2.7 Cookies and Similar Technologies

The Marketplace uses technical cookies and, with the user's consent, analytics and third-party cookies. For full details, please refer entirely to the Cookie Policy of the Marketplace.

3. Purpose of Processing and Legal Basis

Personal data collected through the Marketplace are processed for the following purposes:

3.1 Provision of the Marketplace and Account Management

Purpose: to allow browsing, registration, authentication, management of the user account and saved delivery data.

Legal basis: performance of the contract for the use of the Marketplace to which the data subject is a party (Art. 6, para. 1, letter b, GDPR) and the legitimate interest of the controller in the IT security of the Platform (Art. 6, para. 1, letter f, GDPR).

3.2 Order and Delivery Management

Purpose: to process the order, transmit it to the relevant vendor producer, manage home delivery via affiliated courier or organize pickup at the selected market, communicate the order status to the user, and manage any complaints, returns, and refunds.

Legal basis: performance of the purchase contract to which the data subject is a party (Art. 6, para. 1, letter b, GDPR).

3.3 Accounting and Tax Compliance

Purpose: issuance of tax documentation, accounting management, compliance with obligations under tax and fiscal legislation.

Legal basis: legal obligation (Art. 6, para. 1, letter c, GDPR).

3.4 Payment Management

Purpose: processing payment transactions and fraud prevention.

Legal basis: contract performance (Art. 6, para. 1, letter b, GDPR) and legal obligation (Art. 6, para. 1, letter c, GDPR).

3.5 Responding to Requests via Contact Form

Purpose: to fulfill information requests sent by users.

Legal basis: performance of pre-contractual measures taken at the request of the data subject (Art. 6, para. 1, letter b, GDPR) or consent (Art. 6, para. 1, letter a, GDPR).

3.6 Sending Project Newsletter

Purpose: to inform subscribers about the project's activities, events, initiatives, new product availability, and editorial content.

Legal basis: free, specific, informed, and unambiguous consent of the data subject, expressed through the double opt-in procedure (Art. 6, para. 1, letter a, GDPR). Consent can be withdrawn at any time through the unsubscribe link present in every message sent.

3.7 Compliance with Legal Obligations and Litigation Management

Purpose: to comply with legal obligations, regulations, or authority provisions; to assert or defend a right in court.

Legal basis: legal obligation (Art. 6, para. 1, letter c, GDPR) and legitimate interest of the controller (Art. 6, para. 1, letter f, GDPR).

4. Processing Methods

Personal data are processed using IT and telematic tools, with logic strictly related to the indicated purposes and in such a way as to guarantee their security and confidentiality. The controller adopts adequate technical and organizational measures, pursuant to Art. 32 GDPR, to protect data from unauthorized access, loss, destruction, or disclosure.

The controller does not carry out automated profiling activities that produce legal effects on the data subject or significantly affect them, in accordance with Art. 22 GDPR. Any analysis of Marketplace usage and user preferences is conducted in an aggregated form and for statistical purposes.

5. Retention Period

Personal data are retained for the time strictly necessary to achieve the purposes for which they were collected, and in particular:

  • Browsing data: kept for a period not exceeding 12 months, unless it is necessary to investigate cybercrimes.
  • User account data: kept for the entire duration of the contractual relationship and until the account is deleted by the user; subsequently, kept for a maximum period of 12 months in backup systems, except for legal retention obligations.
  • Data relating to orders, invoicing, and transactions: kept for 10 years from the date of the operation, in accordance with the retention obligations provided by civil and tax legislation (Art. 2220 c.c.).
  • Data collected via contact form: kept for the time necessary to fulfill the request and, subsequently, for a maximum of 24 months.
  • Newsletter data: kept until the data subject withdraws consent (unsubscribe) and subsequently deleted or anonymized, except for retention obligations for the purpose of proving the consent given.
  • Data for litigation management: kept for the time provided by applicable law or necessary for the exercise of the right in court.

6. Categories of Recipients

Personal data collected through the Marketplace may be communicated to the following categories of subjects:

  • authorized internal personnel of the controller, formally designated and instructed for processing;
  • vendor producers of the Marketplace, as independent data controllers for purposes related to order fulfillment. Order-related data (customer identification data, delivery address, details of the purchased product) are communicated exclusively to the individual vendor producer whose products are included in the order, for the purpose of preparation and delivery or market pickup. The producer processes such data in accordance with their own privacy policy and in compliance with applicable law;
  • e-commerce platform service provider (Shopify Inc.), as an external data processor pursuant to Art. 28 GDPR, for the technical management of the Marketplace;
  • payment service provider (Shopify Payments and the manager of the payment circuit used), as an independent controller for payment operations, in accordance with its own privacy policy;
  • affiliated courier for home delivery (Mail Boxes Etc. and their appointed carriers), as an external processor or independent controller depending on the relationship, for shipping and tracking purposes;
  • market operators where the market pickup service is active, limited to data strictly necessary for customer identification at the time of pickup;
  • Unione Artigiani Italiani — Firenze and Livorno offices (UAI Firenze, UAI Livorno), for operational coordination purposes of the project in their respective territories, limited to aggregated or specific data in cases where this is functional to project management;
  • technical service providers (hosting, maintenance, cybersecurity, newsletter sending), appointed as data processors pursuant to Art. 28 GDPR;
  • public authorities, where required by law or authority provisions;
  • appointed consultants and professionals, bound by confidentiality obligations.

The updated list of data processors is available upon written request to be submitted to the contact details published on the Contacts page.

Data are not subject to dissemination.

7. Transfer of Data Outside the European Union

Some of the technical service providers used by the Marketplace (in particular the e-commerce platform provider) are based or carry out processing in third countries outside the European Economic Area. In such cases, the transfer occurs exclusively to countries that ensure an adequate level of protection according to a decision of the European Commission, or on the basis of appropriate safeguards pursuant to Articles 46 et seq. GDPR (in particular standard contractual clauses adopted by the European Commission, and potentially supplementary contractual, technical, and organizational measures).

A copy of the adopted safeguards is available upon written request to be submitted to the contact details published on the Contacts page.

8. Data Subject Rights

In relation to the processing of their personal data, the data subject has the right to:

  • obtain confirmation as to whether or not personal data concerning them are being processed and access to such data and to the information referred to in Art. 15 GDPR;
  • obtain the rectification of inaccurate data or the integration of incomplete data (Art. 16 GDPR);
  • obtain the erasure of personal data ("right to be forgotten"), in the cases provided for by Art. 17 GDPR. Please note that some data — particularly those related to invoicing, orders, and tax compliance — cannot be erased before the deadline established by legal retention obligations;
  • obtain the restriction of processing in the cases provided for by Art. 18 GDPR;
  • receive the personal data concerning them, which they have provided, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where technically feasible (right to data portability, Art. 20 GDPR);
  • object to the processing of their personal data, at any time, when the processing is based on the legitimate interest of the controller, unless there are compelling legitimate grounds for the processing (Art. 21 GDPR);
  • withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7, para. 3, GDPR);
  • lodge a complaint with the competent supervisory authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), if they believe that the processing of their personal data violates applicable legislation (Art. 77 GDPR).

9. How to Exercise Rights

Data subjects can exercise the rights listed above by sending a written request to the contact details published on the Contacts page. The request must be accompanied by suitable elements to verify the identity of the data subject. A response to the request will be provided without undue delay and, in any case, within one month of receipt, which may be extended by two further months in cases of particular complexity, with notification to the data subject.

For requests to delete a user account, a dedicated function is also available within the personal area of the Marketplace.

The exercise of rights is free of charge. However, in the case of manifestly unfounded or excessive requests, particularly due to their repetitive character, the controller may charge a reasonable fee or refuse to satisfy the request.

10. Complaint to the Supervisory Authority

Without prejudice to any other administrative or judicial remedy, data subjects who believe that the processing of their personal data violates the GDPR have the right to lodge a complaint with the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome; www.garanteprivacy.it; protocollo@gpdp.it), or with the supervisory authority of the Member State where they habitually reside, work, or where the alleged infringement occurred.

11. Contacts

For any request related to the processing of personal data and for exercising rights, you can contact the data controller at the contact details published on the Contacts page.

12. Changes to this Policy

This policy may be updated, also as a result of regulatory changes, decisions by the supervisory authority, or evolutions in the processing carried out. The current version is always published on the Marketplace on the Privacy policy page, with an indication of the last update date. Users are invited to consult the page periodically.