Privacy Policy

Data controller

The data controller is Magazzini Rossi, with registered office at Via Volta 45, Flero (BS), Italy, VAT 02883940989, REA no. 486500.

To exercise your rights, or for any request concerning personal data, you can write to misee-clienti@mrhoreca.it.

What data we process

We only collect the data needed for the purposes set out below. Specifically:

• Registration and account data: company name, VAT number, contact details and sign-in credentials, needed to create and manage your profile.
• Order data: products purchased, delivery and billing addresses, amounts, shipment status and any returns.
• Payment data: the outcome of the transaction and the references identifying it. Card numbers are neither collected nor stored by us.
• Technical browsing data: IP address, browser and device type, pages visited and access times, recorded in server logs for security and diagnostic purposes.

Why we process it, and on what legal basis

Each processing activity has a defined purpose and a legal basis:

• Creating and managing your account, processing orders, handling deliveries, returns and support — legal basis: performance of a contract or pre-contractual measures (art. 6.1.b GDPR).
• Issuing and retaining tax and accounting records — legal basis: compliance with a legal obligation (art. 6.1.c GDPR).
• Keeping the site secure, preventing abuse and fraud, maintaining technical logs — legal basis: our legitimate interest in protecting our infrastructure and our users (art. 6.1.f GDPR).
• Responding to requests you send through our contact channels — legal basis: our legitimate interest in replying to the requests we receive (art. 6.1.f GDPR).

We do not process your data for marketing purposes, we do not send promotional communications in the absence of an explicit request from you, and we do not transfer data to third parties for commercial purposes.

Card payments

Card payments are handled by Nexi Payments S.p.A. The fields where you enter your card number, expiry date and security code are hosted directly by the provider's systems inside the page: that data does not pass through our servers and is not stored by us.

We only receive the outcome of the transaction and the references needed to link the payment to the order. The processing carried out by the provider as an independent controller is described in its own privacy notice.

Who we share data with

Data may be processed, on our behalf or as independent controllers, by the parties that enable us to deliver the service:

• The payment services provider, to execute transactions.
• The couriers and logistics operators handling deliveries.
• The IT suppliers that maintain our systems, within the limits of the technical work required.
• The e-mail providers used to deliver service communications (Brevo, based in the European Union, and Google).
• Tax and accounting advisers and, where necessary, lawyers, within the limits of their respective engagements.
• Public authorities, where disclosure is required by law.

Suppliers processing data on our behalf are appointed as processors pursuant to article 28 GDPR, and an up-to-date list is available on request. Your data is neither disseminated nor sold.

Transfers outside the European Union

Your account and order data is stored exclusively on servers owned by the controller and located in Italy: we do not use external hosting or storage services.

The one exception is the sending of service communications (order confirmations, shipping notifications, credential resets), for which we rely on two e-mail providers: Brevo, a company based in France that processes data within the European Union, and Google, whose services may involve processing in the United States.

Transfers to the United States take place on the basis of the adequacy decision adopted by the European Commission on 10 July 2023 (EU-U.S. Data Privacy Framework), to which Google adheres, and of the standard contractual clauses referred to in article 46 GDPR. The data involved is limited to what is needed to deliver the message: the recipient's e-mail address and the content of the communication.

How long we keep data

We keep data for as long as strictly necessary for the purposes for which it was collected, and in any case for the periods required by law:

• Account data: for the duration of the relationship and until a deletion request, if any.
• Orders, invoices and accounting records: 10 years from issue, as required by Italian civil and tax law.
• Technical security logs: 14 days (Apache web server logs, rotated daily).
• Support requests: for as long as needed to handle the request and any follow-up.

Once those periods have elapsed, data is deleted or irreversibly anonymised.

How we protect data

We apply technical and organisational measures appropriate to protect data against unauthorised access, loss or disclosure: traffic encryption, personal sign-in credentials, storage of authentication tokens exclusively on the server side, and access restricted to authorised staff only.

No system is absolutely secure. In the event of a personal data breach entailing a high risk to your rights, we will make the notifications required by articles 33 and 34 GDPR.

Your rights

At any time you can exercise the rights granted by articles 15 to 22 GDPR:

• Access — find out whether we process data concerning you and obtain a copy of it.
• Rectification — correct inaccurate data or complete incomplete data.
• Erasure — obtain the deletion of your data, in the cases provided for by law.
• Restriction — ask for processing to be temporarily suspended.
• Portability — receive your data in a structured format or have it transmitted to another controller.
• Objection — object to processing based on legitimate interest, on grounds relating to your particular situation.

To exercise them, simply write to the address given at the beginning of this notice. We will reply within one month, extendable by two further months in complex cases. Exercising your rights is free of charge.

Complaint to the supervisory authority

If you believe that the processing of your data infringes the law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it) or bring the matter before the courts.

Automated decision-making

We do not carry out profiling and we do not take automated decisions producing legal effects concerning you or similarly significantly affecting you.

Cookies

The site uses technical cookies only, which are necessary for it to work. Details of each cookie, with its purpose and duration, are set out in the Cookie Policy.

Changes to this notice

This notice may be updated to reflect changes to the services offered or to the applicable law. The date at the top of the page shows the last update; material changes will be communicated to you by appropriate means.