Last updated: 28 August 2026.
1. Controller
SP Quality S.r.l., VAT and tax code 11043610010, Strada Cebrosa 25, 10036 Settimo Torinese (TO), Italy; +39 011 818 2350; [email protected] (the “Controller”).
2. Data, purposes and legal bases
- Browsing and security: technical data, IP address, logs and session/device identifiers to provide and protect the site and prevent abuse; performance of the service and legitimate interest in security.
- Account, basket, orders and payments: identity, contact, address, tax, basket, order, delivery, payment and communication data for pre-contractual measures, performance of the contract and legal obligations.
- Support, returns and guarantees: messages and documents needed to reply, handle claims and protect rights; contract, legal obligations and legitimate interests.
- Newsletter: email address and consent evidence for promotional communications; consent can be withdrawn at any time. Similar-product communications to existing customers are used only where the legal soft-spam conditions apply and with simple free opt-out.
- Administration and tax: order, payment and invoicing records required by law.
- Analytics and site improvement: only with your consent, technical and interaction data such as pages visited, referring URL, browser and device characteristics, clicks and scrolling are processed through Google Analytics and Microsoft Clarity to measure site use and find browsing problems. Clarity sessions are technical replays, not videos of the person, and input fields are masked by the service. Legal basis: consent; refusal does not affect purchases.
- Advertising measurement and personalisation: only with your consent, Google Ads and Meta Pixel may measure campaigns and conversions and use online identifiers for more relevant advertising. Legal basis: consent, which can be withdrawn at any time.
3. Custom wafers and images
When Cialda Studio is used, we process the uploaded image, preview, composition instructions and print file to make the requested product. The legal basis is pre-contractual measures and performance of the contract. Files are available only to authorised staff and, where needed, the production laboratory. We do not use them for advertising or to train artificial-intelligence systems.
Unpurchased designs are automatically deleted after the configured period, currently 90 days. Designs linked to an order are kept for the configured production and support period, currently no longer than 365 days, unless a legal claim or obligation requires longer retention. The declaration concerning rights to use the image is separate from this notice.
4. Required and optional data
Mandatory fields are needed for the account, order, delivery or tax obligations. Newsletter consent is optional and refusal does not affect purchases.
5. Recipients
Data may be processed by authorised staff and necessary providers, including hosting and IT infrastructure, email and support, couriers and logistics, the edible-print laboratory, payment providers selected at checkout, administrative/tax advisers and authorities where required. Processors acting on our behalf are bound under Article 28 GDPR where applicable.
6. Transfers outside the EEA
If a provider processes data outside the European Economic Area, transfers rely on an adequacy decision or appropriate safeguards, including Standard Contractual Clauses and any necessary supplementary measures. Details may be requested from the Controller.
7. Retention
Data are kept for the time necessary for the stated purposes and legal obligations. Order and invoice records follow civil and tax retention periods; account data are kept until closure and for subsequent obligations or claims; support records until resolution and expiry of relevant limitation periods; newsletter data until withdrawal and technical suppression. Cialda Studio periods are stated above. Security logs are kept for periods proportionate to risk.
8. Automated decisions
The site does not make decisions based solely on automated processing that produce legal or similarly significant effects under Article 22 GDPR. Commercial profiling is not carried out without a legal basis and specific information.
9. Rights
You may request access, rectification, erasure, restriction, portability or object, and withdraw consent without affecting earlier processing, by writing to [email protected]. You may complain to the Italian Data Protection Authority or your competent supervisory authority.
10. Cookies and changes
See the Cookie notice. The publication date and version identify the applicable text.
