EN IT

PRIVACY POLICY

Last updated: 14 luglio 2026

This Privacy Policy describes how the personal data of users who visit and use the website www.tototai.it (hereinafter, the “Website”) is collected, used, stored and protected. The Website is operated by Tototai S.r.l., acting as the Data Controller, in accordance with Regulation (EU) 2016/679 (the “GDPR”), Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018, and applicable legislation.

1. Data Controller

Tototai S.r.l.

• Registered Office: Piazza della Libertà 1, 33100 Udine (UD), Italy
• Operational Office: Via San Marco 11/C, 35129 Padua (PD), Italy
• VAT No.: IT03214430302
• Email: info@tototaisrl.com
• Website: www.tototai.it

For any requests concerning the processing of personal data, you may contact the Data Controller using the email address provided above.

2. Categories of Personal Data Processed

The following categories of personal data may be collected when you browse or use the Website.

Identification Data

• first and last name;
• shipping and billing address;
• company name (where applicable);
• tax code and VAT number (where required).

Contact details

• email address;
• telephone number.

Order information

• prodotti acquistati;
• cronologia degli ordini;
• importi pagati;
• stato delle spedizioni;
• eventuali richieste di assistenza.

Payment information

The Website does not store complete payment card details.

Payments are processed through third-party providers such as:

• PayPal;
• Revolut Business.

Le informazioni relative agli strumenti di pagamento vengono trattate esclusivamente dai rispettivi provider secondo le loro informative privacy.

Dati tecnici

Durante la navigazione vengono raccolti automaticamente:

• IP address;
• browser used;
• operating system;
• date and time of the visit;
• pages viewed;
• device information;
• log data.

Cookies

The Website uses technical, statistical and, subject to consent, marketing cookies, as described in the Cookie Policy.

3. Purposes of Data Processing

Personal data is processed for the following purposes.

Contract performance
For the purpose of:

• creating and managing user accounts;
• managing orders;
• processing payments;
• shipping products;
• providing customer support;
• handling returns and refunds;
• fulfilling contractual obligations.

Legal basis: performance of a contract or pre-contractual measures.

Legal compliance

To comply with obligations under tax, accounting, civil and administrative law.

Legal basis: legal obligation.

Handling User Requests

To respond to communications submitted through:

• contact form;
• email;
• telephone.

Legal basis: performance of pre-contractual measures or legitimate interest.

Statistical Analysis

To analyse website traffic and improve its performance using Google Analytics 4, in accordance with the user’s expressed preferences.

Legal basis: consent, where required.

Marketing

Subject to the user’s consent, personal data may be used for:

• sending newsletters;
• commercial offers;
• promotions;
• advertising campaigns;
• informational communications.

Consent may be withdrawn at any time.

Security

To prevent fraud, unauthorised access and unlawful use, and to ensure the security of the Website.

Legal basis: the Data Controller’s legitimate interest.

4. Methods of Processing

Personal data is processed using electronic tools and, where necessary, paper-based means, with appropriate technical and organisational measures in place to ensure its security, confidentiality and integrity.

5. Mandatory Nature of Data Provision

Providing the data required to place an order is mandatory.

Failure to provide such data may prevent the following:

• account registration;
• purchase of products;
• shipment of orders;
• provision of customer support.

Providing data for marketing purposes is optional.

6. Recipients of Personal Data

Personal data may be disclosed exclusively to parties involved in the provision of services, such as:

• couriers and shipping companies;
• tax and accounting consultants;
• banks and financial institutions;
• PayPal;
• Revolut Business;
• IT service providers;
• hosting service providers;
• Google Ireland Ltd.;
• competent authorities, where required by law.

These parties process personal data as independent data controllers or data processors, as applicable.

7. Transfer of Data Outside the EEA

Some service providers may process personal data outside the European Economic Area (EEA).
In such cases, data processing is carried out in compliance with the GDPR, using the safeguards required by applicable law, such as European Commission adequacy decisions or Standard Contractual Clauses (SCCs), where necessary.
8. Data Retention
Personal data is retained for the period strictly necessary to fulfil the purposes described above and, thereafter, for the period required by applicable law.
In particular:

• Order information: up to 10 years for tax and accounting purposes;
• Customer support requests: for the time necessary to handle the request and, where appropriate, to protect the Data Controller’s rights;
• Data processed for marketing purposes: until consent is withdrawn or for the period established by applicable law;
• Browsing data: as specified in the Cookie Policy.

9. Data Subject Rights

Users may exercise their rights under Articles 15–22 of the GDPR at any time, including the right to:

• obtain confirmation as to whether their personal data is being processed;
• access their personal data;
• request the rectification of inaccurate data;
• request the erasure of data where provided for by law;
• obtain the restriction of processing;
• object to processing in the cases provided for by law;
• receive their data in a structured format and request data portability, where applicable;
• withdraw consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal.

Requests may be sent to the following email address:

info@tototaisrl.com

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

10. Data Security

Tototai S.r.l. adopts appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, disclosure or unlawful use.

11. Minors

The Website is not intended for individuals under the age of 18.

Should the Data Controller become aware that personal data relating to minors has been collected in violation of applicable law, such data will be deleted without undue delay.

12. Changes to This Privacy Policy

This Privacy Policy may be updated at any time to reflect legislative, regulatory or organisational changes.

The updated version will be published on the Website, indicating the date of the latest update.

13. Contact Information

For any information regarding this Privacy Policy, please contact:

Tototai S.r.l.

Piazza della Libertà 1
33100 Udine (UD)

Operational Headquarters: Via San Marco 11/C
35129 Padova (PD)

Email: info@tototaisrl.com

Website: www.tototai.it