Privacy policy

1) Introduction and contact details of the Data Controller 1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about the handling of your personal data when using our website. Personal data is any data with which you can be personally identified. 1.2 The data controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Mattioli & Waldschmidt GmbH, Gymnasiumstraße 45, 74072 Heilbronn, Germany, Tel.: +49 15224865538, E-Mail: info@mawaitalienischefeinkost.com. The data controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data collection when visiting our website 2.1 When using our website for informational purposes only, i.e., if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to our server ("server log files"). When you access our website, we collect the following data, which is technically necessary to display the website:

  • Our visited website

  • Date and time at the moment of access

  • Amount of data sent in bytes

  • Source/reference from which you came to the page

  • Browser used

  • Operating system used

  • IP address used (if applicable: in anonymized form) Processing is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files subsequently if there are concrete indications of illegal use. 2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries). You can recognize an encrypted connection by the character string "https://" and the lock symbol in your browser line.


     

3) Hosting & Content-Delivery-Network 3.1 Shopify For the hosting of our website and the display of page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada. All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider. For data transfers to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission. 3.2 Cloudflare We use a Content Delivery Network from Cloudflare Inc., San Francisco, USA. This service enables us to deliver large media files faster. The processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website (Art. 6(1)(f) GDPR). For data transfers to the USA, the provider is certified under the EU-US Data Privacy Framework. 3.3 Shopify (CDN) We use a Content Delivery Network from Shopify. Data may also be transferred to Shopify Inc. (Canada) and Cloudflare Inc. (USA) under the same legal bases and adequacy frameworks mentioned above.


 

4) Cookies In order to make visiting our website attractive and to enable the use of certain functions, we use cookies. Some are deleted after the browser is closed ("session cookies"), while others remain on your device ("persistent cookies"). If personal data is processed by individual cookies used by us, the processing takes place in accordance with Art. 6(1)(b) GDPR for the execution of the contract, Art. 6(1)(a) GDPR in the case of granted consent, or Art. 6(1)(f) GDPR to safeguard our legitimate interests. You can set your browser so that you are informed about the setting of cookies and individually decide on their acceptance or exclude them. If cookies are not accepted, the functionality of our website may be restricted.

5) Contacting us 5.1 WhatsApp-Business You can contact us via WhatsApp (WhatsApp Ireland Limited). We use the "Business Version". If you contact us regarding a specific transaction, we process your phone number and name based on Art. 6(1)(b) GDPR. For general inquiries, it is based on Art. 6(1)(f) GDPR. We use a dedicated mobile device that only saves the numbers of users who have already contacted us via WhatsApp. Data may be transferred to Meta Platforms Inc. (USA) under the EU-US Data Privacy Framework. 5.2 Contact Form/Email When contacting us via form or email, personal data is processed solely to handle your inquiry (Art. 6(1)(f) GDPR, and Art. 6(1)(b) GDPR if related to a contract).

6) Data processing when opening a customer account Pursuant to Art. 6(1)(b) GDPR, personal data will continue to be collected and processed if you provide it to us when opening a customer account. Account deletion is possible at any time.

7) Use of customer data for direct marketing 7.1 Subscription to our email newsletter If you subscribe (double opt-in), we will send you regular information about our offers based on your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time. After unsubscribing, your email may be stored in a blocklist to prevent further emails (Art. 6(1)(f) GDPR). 7.2 Goods availability notification via email You can register for back-in-stock notifications (Double opt-in, Art. 6(1)(a) GDPR). You can cancel at any time.

8) Data processing for order processing 8.1 Personal data is passed on to transport companies and credit institutions as necessary for contract fulfillment (Art. 6(1)(b) GDPR). 8.2 Shipping providers (DHL / DHL Express / UPS) With your explicit consent during checkout (Art. 6(1)(a) GDPR), we pass your email/phone number to the courier for delivery arrangements. Otherwise, we only pass on the recipient's name and delivery address (Art. 6(1)(b) GDPR). 8.3 Payment providers (PayPal / Shopify Payments) We pass on payment and order details to providers strictly for payment processing (Art. 6(1)(b) GDPR). Some providers may conduct a credit check (Art. 6(1)(f) GDPR).

9) Data processing for processing donations Personal data for donations is processed and stored for 10 years for accounting purposes (Art. 6(1)(b) and (c) GDPR). Payments are processed via PayPal.

10) Web analysis services (Shopify Analytics) With your explicit consent (Art. 6(1)(a) GDPR), we use Shopify Analytics to collect pseudonymized data (including IP address) via cookies for statistical usage analysis. You can revoke consent via the Cookie Consent Tool.

11) Site functionalities We use plugins from Facebook, Instagram, LinkedIn, and YouTube. To protect your data, plugins use a "2-click" or "Shariff" solution, meaning no direct connection is made until you click to activate them (consent under Art. 6(1)(a) GDPR). Data transfers to the USA are covered by the EU-US Data Privacy Framework.

12) Tools and miscellaneous DATEV: We use DATEV cloud software for accounting (Art. 6(1)(f) GDPR).

13) Rights of the data subject 13.1 You have the following rights: Right of access (Art. 15 GDPR), Rectification (Art. 16 GDPR), Erasure (Art. 17 GDPR), Restriction of processing (Art. 18 GDPR), Notification (Art. 19 GDPR), Data portability (Art. 20 GDPR), Revocation of consent (Art. 7(3) GDPR), Right to lodge a complaint (Art. 77 GDPR). 13.2 RIGHT TO OBJECT IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR FOR THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS. IF YOUR DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME.

14) Duration of the storage of personal data The duration depends on the legal basis, purpose, and statutory retention periods (e.g., commercial and tax law). Data processed via consent is kept until revocation. Contractual data is deleted when no longer needed after retention periods expire. Data based on legitimate interest is kept until you object.