Privacy policy

This notice is provided pursuant to Regulation (EU) 2016/679 (GDPR) to users who interact with the online gift voucher shop of Risotteria Melotti - Milano.

1. Data controller

Melotti Milano S.R.L.
Registered office: Via Tondello 59, 37063 Isola della Scala (VR)
VAT no. / Tax code: 05036950235
Email: milano@risotteriamelotti.com
Phone: 02 38267836

2. Data collected

When you purchase a voucher we collect:

• the buyer's first name and surname
• the buyer's email address
• phone number (optional)
• the recipient's details (name and email) if the order is a gift
• order details (denomination, quantity, amount, date)
• IP address and browser user agent, solely for security and audit purposes (staff access logs)

Payment (card) data does not pass through our servers: it is collected directly by Stripe, which acts as an independent data controller. We receive only the outcome of the transaction from Stripe.

3. Purposes and legal basis

• Performance of the contract (art. 6 §1 lett. b GDPR): issuance of the voucher, sending of transactional emails (order confirmation, voucher delivery, tax receipt), management of redemption on the premises.
• Legal obligation (art. 6 §1 lett. c GDPR): tax and accounting requirements (retention of the order for VAT purposes).
• Legitimate interest (art. 6 §1 lett. f GDPR): security of the platform (access logs, abuse prevention).
• Consent (art. 6 §1 lett. a GDPR): only for marketing communications, which are optional and may be withdrawn at any time.

4. Recipients

• Stripe Payments Europe Ltd. (Ireland) — payment processing, independent data controller of the payment data.
• Sendinblue / Brevo SAS (France) — sending of transactional emails, acting as data processor.
• Internal staff of Risotteria Melotti - Milano authorised to manage orders and issue tax receipts.
• Tax and judicial authorities, within the limits of legal obligations.

5. Transfers outside the EU

The providers indicated above operate within the European Economic Area. In the event of any transfers outside the EU, these shall take place with adequate safeguards pursuant to artt. 44 et seq. GDPR (standard contractual clauses of the European Commission).

6. Retention

Order data is retained for the time necessary to perform the contract and for the tax limitation periods (10 years pursuant to art. 2220 of the Italian Civil Code). Technical logs are retained for a maximum of 12 months. Marketing consent is retained until withdrawal.

7. Rights of the data subject

Pursuant to artt. 15–22 GDPR you may at any time exercise the rights of:

• access to the data concerning you
• rectification and erasure (within the limits of the retention obligations)
• restriction of and objection to processing
• data portability
• withdrawal of marketing consent
• lodging a complaint with the Italian Data Protection Authority (garanteprivacy.it)

To exercise your rights, write to milano@risotteriamelotti.com. We will respond within 30 days.

8. Cookies

The website uses exclusively technical cookies, which are essential for its operation (session and CSRF protection). For details, please refer to the Cookie policy.