Privacy Policy – Information on the processing of personal data
Last updated: 22/09/2026
This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the «GDPR») and to Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the «Privacy Code») to everyone who interacts with the website www.stampa6x3.com and with the seipertre app (together, the «Website»).
1. Data Controller
Registered office: Via Volta 54 – 73042 Casarano (LE) – Italia
Operating site: Zona Industriale, Lotto A – 73042 Casarano (LE) – Italia
Share capital: EUR 2,500.00 fully paid up
Companies Register of Lecce, tax code and registration no. 04843110752 – VAT no. 04843110752
REA no. LE - 322500
Certified e-mail (PEC): enjoysrls.le@pec.it
E-mail: info@stampa6x3.com – Phone: +39 0833 1976591
The Controller has not appointed a Data Protection Officer, as the conditions set out in Article 37 GDPR do not apply. Any request concerning the processing of personal data may be sent to the addresses above.
2. Categories of data processed
2.1 Data provided by the user
- Registration and billing data: first name, last name, company name, e-mail address, landline and/or mobile number, address, city, province, postcode, tax code, VAT number, certified e-mail address and SDI recipient code, password (stored in hashed form).
- Order and shipping data: purchased products, amounts, delivery and billing addresses, shipment tracking data, correspondence relating to the order.
- Uploaded files: the artwork files (PDF, JPG, PNG, TIFF, GIF) submitted for printing, together with any content they contain.
- Payment data: the outcome of the transaction and its identifier. Payment card details are never transmitted to or stored by the Controller: they are processed directly by the payment service provider (PayPal). For bank transfers, the payment receipt uploaded by the user.
- Contact data: the data contained in messages sent through the contact form, by e-mail, by phone or via WhatsApp.
2.2 Browsing data
The IT systems and software procedures used to operate the Website acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols: IP addresses, URIs of the requested resources, time of the request, method used, size of the file obtained, response status code, browser type and operating system. These data are used for anonymous statistical purposes, to ensure the correct operation of the Website and to establish liability in the event of computer crimes against the Website.
2.3 Cookies and tracking tools
The Website uses technical cookies and, subject to consent, third-party analytics and marketing cookies. Details are set out in the Cookie Policy, which forms an integral part of this notice.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Creation and management of the user account | Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) | For the lifetime of the account and for 12 months after a deletion request or the last login, unless otherwise required by law |
| Order management, production, shipping, support and returns | Performance of a contract (Art. 6(1)(b) GDPR) | 10 years from the end of the contract (ordinary limitation period and civil/tax obligations) |
| Storage of artwork files submitted for printing | Performance of a contract (Art. 6(1)(b) GDPR); legitimate interest in handling complaints and reprints (Art. 6(1)(f) GDPR) | 24 months from delivery of the order, unless earlier deletion is requested |
| Tax, accounting and e-invoicing obligations | Legal obligation (Art. 6(1)(c) GDPR) | 10 years under Art. 2220 of the Italian Civil Code and tax law |
| Responding to information and support requests | Pre-contractual measures or legitimate interest in replying to requests (Art. 6(1)(b) and 6(1)(f) GDPR) | 24 months from the last contact |
| Website security, fraud and abuse prevention (including reCAPTCHA) | Legitimate interest of the Controller in the security of its systems (Art. 6(1)(f) GDPR) | Technical logs: 12 months |
| Sending commercial communications and newsletters | Freely given, specific and revocable consent (Art. 6(1)(a) GDPR) | Until consent is withdrawn and, in any case, reviewed after 24 months of inactivity |
| Communications about products similar to those purchased (soft spam) | Art. 130(4) of the Italian Privacy Code; legitimate interest (Art. 6(1)(f) GDPR), with the right to object in every message | 24 months from the last purchase, unless an objection is raised |
| Website usage statistics (Google Analytics) and advertising (Google Ads) | Consent (Art. 6(1)(a) GDPR), given through the cookie banner | As set out in the Cookie Policy; data on the Google platform: max. 14 months |
| Establishment, exercise or defence of legal claims | Legitimate interest (Art. 6(1)(f) GDPR); Art. 9(2)(f) GDPR where applicable | For the duration of the dispute and until the expiry of the appeal deadlines |
Providing the data marked as mandatory in the forms on the Website is necessary for registration, for performing the order and for statutory obligations: refusal makes it impossible to provide the service. Providing data for marketing purposes is optional and any refusal has no effect whatsoever on the purchase.
4. How data are processed
Data are processed using electronic and, where necessary, paper-based tools, applying technical and organisational measures appropriate under Article 32 GDPR: TLS/HTTPS encrypted connections, access control through individual credentials, password storage using hashing functions, regular backups, segregation of environments and access limited to authorised staff instructed under Article 29 GDPR.
The Controller does not carry out automated decision-making or profiling producing legal effects on the data subject within the meaning of Article 22 GDPR. Any personalisation of advertising takes place solely on the basis of consent and within the limits described in the Cookie Policy.
5. Recipients of the data
For the purposes set out above, data may be disclosed to the following parties, acting as processors under Article 28 GDPR or as independent controllers:
| Party | Activity | Role and location |
|---|---|---|
| Aruba S.p.A. | Website hosting, servers, backups and infrastructure services | Processor – data centres in the European Union (Italy) |
| Google Ireland Limited | E-mail (Google Workspace / Gmail), Google Tag Manager, Google Analytics 4, Google Ads, reCAPTCHA | Processor for e-mail services; independent/joint controller for advertising services – Ireland, with possible transfers to the USA |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Online payment processing | Independent controller – Luxembourg |
| Appointed couriers and carriers | Delivery of orders and shipment tracking | Independent controllers or processors, depending on the relationship – European Union |
| Tax, accounting and legal advisers | Administrative and tax compliance and defence of legal claims | Processors or independent controllers – Italy |
| IT and maintenance service providers | Development, technical support and maintenance of the Website | Processors – European Union |
Data may also be disclosed to judicial or administrative authorities where required by law or necessary to establish, exercise or defend a legal claim. Data are not disseminated and are never sold to third parties. An up-to-date list of processors is available on written request to info@stampa6x3.com.
6. Transfers outside the EU
Data are processed mainly within the European Economic Area. Some services provided by Google may involve transfers of data to the United States. Such transfers take place on the basis of the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, to which Google LLC adheres, and/or on the basis of the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), supplemented by additional measures. A copy of the safeguards in place may be requested from the Controller.
7. Rights of the data subject
Under Articles 15 to 22 GDPR, the data subject has the right to:
- obtain access to their personal data and the information listed in Article 15 GDPR;
- obtain the rectification of inaccurate data or the completion of incomplete data (Art. 16);
- obtain the erasure of data in the cases provided for by Article 17 («right to be forgotten»);
- obtain the restriction of processing in the cases provided for by Article 18;
- receive the data provided in a structured, commonly used and machine-readable format and transmit them to another controller (Art. 20, data portability);
- object at any time to processing based on legitimate interest and, without the need to give reasons, to processing for direct marketing purposes (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).
Requests should be sent to info@stampa6x3.com or by certified e-mail to enjoysrls.le@pec.it. The Controller replies without undue delay and in any case within one month of receipt, extendable by two months where the request is particularly complex (Art. 12 GDPR). Exercising these rights is free of charge.
Data subjects who believe their rights have been infringed also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it) or with the supervisory authority of their Member State of habitual residence, as well as to bring proceedings before the competent court.
8. Marketing consent and withdrawal
Consent to receive commercial communications is optional, separate from any other consent and may be withdrawn at any time: simply use the unsubscribe link at the bottom of each message, change your preferences in your account area or write to info@stampa6x3.com.
9. Minors
The services offered through the Website are intended for adults and mainly for professionals and businesses. The Controller does not knowingly collect data relating to children under 14 (Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code). Should such data be detected, they will be deleted without delay; any reports may be sent to the contact addresses above.
10. Content of files submitted for printing
Users are responsible for the content of the files they upload and warrant that they hold all necessary rights, authorisations or releases, including in respect of images of any individuals depicted. The Controller processes such files solely to perform the order, does not carry out automated analysis of them for other purposes and does not use them for promotional purposes without the user's written authorisation.
11. Changes to this notice
The Controller may update this notice to reflect changes in legislation or in the services offered. The version in force is always published at this address together with the date of the last update; substantial changes will be brought to the attention of registered users with adequate notice.