Privacy and Cookie Policy

This notice describes how personal data relating to users who visit federicomargallo.it or use its contact and purchase-enquiry services are processed, in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable Italian law.

1. Data controller

Federico Margallo
MARGALLO Fine Art Photography
Pieve di Teco (IM), Italy
Email: info@federicomargallo.it

The controller’s full postal address is not published on the website because it coincides with a private residence. It may be provided when necessary for the conclusion or performance of a sale, compliance with a legal obligation, or in response to a legitimate request from the data subject.

2. Personal data processed

Browsing data

During normal browsing, the website systems and hosting provider may collect certain technical data, such as the IP address, date and time of the request, requested page, browser type and information required for the website’s operation and security. This information is not used to profile users.

Data submitted through the contact form

The contact form may collect:

• first and last name
• email address
• destination country, where provided
• subject and content of the enquiry
• selected artwork, size and finish when the enquiry is submitted from an artwork page

Enquiry and purchase data

When a user requests information about an artwork or proceeds with a purchase, the data required to manage the enquiry, payment, production, documentation and shipment may be processed. This may include the user’s name, contact details, delivery address, order details and payment references. Online banking credentials or other unnecessary banking information are neither requested nor stored.

Limited-edition register

A paper register is maintained to document the authenticity and provenance of limited-edition artworks. It contains only:

• the purchaser’s first and last name
• the artwork purchased
• format
• edition number
• certificate of authenticity reference
• purchase date

Postal address, telephone number, email address and payment details are not retained in this register.

3. Purposes and legal bases

Personal data are processed to:

• respond to enquiries and provide information about the artworks, on the basis of pre-contractual steps requested by the data subject
• manage orders, payments, production, documentation and shipment, on the basis of performance of a contract
• comply with administrative, tax and legal obligations
• document authenticity, provenance and print runs and prevent disputes or duplication, on the basis of the controller’s legitimate interests
• ensure the operation, integrity and security of the website, on the basis of the controller’s legitimate interests
• establish, exercise or defend legal claims

Personal data are not used for profiling, personalised advertising or newsletters. Should promotional communications be introduced in the future, specific consent will be requested where required.

4. Provision of personal data

Providing data through the contact form is voluntary, although fields marked as mandatory are required in order to respond to the enquiry.

Providing the data requested during a sale is necessary to conclude and perform the purchase. Without such data, it may not be possible to process the order, prepare the relevant documentation or arrange delivery.

5. Processing methods and security

Personal data are processed electronically and, for the limited-edition register, on paper. Organisational and technical measures proportionate to the nature of the data are adopted to prevent loss, unauthorised access, unlawful use or disclosure. Access is restricted to the controller and to parties that genuinely require the data to provide the requested services.

6. Recipients

Personal data may be disclosed, only to the extent necessary, to:

• Aruba S.p.A. or related companies, for hosting, email and technical infrastructure services
• banks and parties involved in processing the payment
• carriers and shipping companies responsible for delivery
• tax, administrative, technical or legal advisers, where necessary
• public authorities or other parties to whom disclosure is required by law

Personal data are not sold, made publicly available or disclosed to third parties for their own commercial purposes.

7. Transfers outside the European Economic Area

The website is configured to limit the use of services involving transfers of personal data outside the European Economic Area. If a technical provider transfers data to a third country, the transfer will take place in compliance with the conditions and safeguards set out in Articles 44 and following of the GDPR.

8. Retention periods

Personal data are retained in accordance with the following criteria:

• general enquiries with no subsequent interaction: for no longer than 12 months
• discussions relating to a potential purchase: for no longer than 24 months from the last communication, unless further retention is necessary
• data and documents relating to completed sales: for the time necessary to perform the contract and, where applicable, for up to 10 years to comply with administrative or tax obligations and protect legal rights
• data in the limited-edition register: for as long as necessary to document the authenticity, provenance and correct management of the artwork’s print run
• technical data and server logs: in accordance with the service provider’s retention periods and for as long as necessary for the security, operation and protection of the website

At the end of the applicable periods, data are deleted, anonymised or retained solely where required by law or necessary to protect a legal right.

9. Data-subject rights

Where provided for by the GDPR, data subjects may request:

• confirmation as to whether their personal data are being processed and access to such data
• rectification or updating of their data
• erasure of their data
• restriction of processing
• objection to processing based on legitimate interests
• data portability, where applicable

The exercise of certain rights may be limited where retention is necessary to comply with a legal obligation, perform a contract or establish, exercise or defend legal claims.

Requests may be sent to info@federicomargallo.it. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) through www.garanteprivacy.it.

10. Cookies and similar technologies

The website does not use profiling cookies, advertising cookies or technologies designed to track users, and does not analyse their behaviour for statistical purposes.

The website may use only technical functions or local-storage mechanisms required to:

• remember the selected language
• remember the light or dark display mode
• ensure the proper operation and security of its pages

These mechanisms are not used to identify or profile users or to follow them across other websites and do not require prior consent. Consequently, no cookie-consent banner is displayed.

Links to social media profiles are ordinary external links. The website does not embed social feeds, advertising pixels or tracking buttons. When opening an external link, users will be subject to the relevant provider’s terms and privacy information.

11. Changes to this notice

This notice may be updated to reflect changes in legislation, technology or the services actually provided. The updated version will be published on this page together with its revision date.