Privacy notice

Here we explain which personal data we collect when you visit Casa Cenina or make a purchase, why we do so, who we entrust it to and what rights you have.
You will find details about cookies in our Cookie policy.

Last updated: 21 October 2026

Contents

1. Who the data controller is

Cenina S.r.l.
Loc. Cenina, 184/A – 52010 Capolona (AR) – Italy
VAT number and tax code IT01651310516
Privacy e-mail: [email protected]
Phone: +39 0575 421407

We have not appointed a Data Protection Officer (DPO) because, given the type and scale of our processing, the law does not require one.

2. What data we collect

Account data: first name, last name, e-mail, password (stored encrypted; if you sign in with Google or Facebook you do not have one with us), phone number, addresses, optional nickname.
Order data: products purchased, amounts, shipping and billing address, tax code or VAT number if you request an invoice, chosen payment method, shipment status, returns and refunds. We never see or store your full card details: they are handled directly by the payment provider.
Communications: the messages you send us through the contact form, e-mail, phone or WhatsApp.
Preferences and activity on the Site: wishlist, availability alerts, products viewed and searches, loyalty programme points and vouchers.
Content you publish: forum posts, comments, reviews and photos of your projects.
Guest Club: if you take part in our affiliate programme, details of your website and the data needed to pay your commissions.
Browsing data: IP address, browser and device type, pages requested, date and time. These are recorded automatically by our servers and security services.
Cookies and similar technologies: see the Cookie policy.

If you sign in with Google or Facebook, we receive from the service you choose only your first name, last name and e-mail address. We do not receive your password and we never post anything on your behalf. You can remove the connection in the settings of your Google or Facebook account.

We do not ask you for special categories of data (for example health data). We do not process data of minors: purchases are reserved for adults.

3. Why we use it and on what legal basis

Purpose	Legal basis	How long
Creating and managing your account	Performance of the contract	As long as you keep your account. We delete it when you ask us to, or if our e-mails to your address bounce because it is no longer valid or are reported as unwanted
Handling orders, payments, shipments, returns, guarantee and customer service	Performance of the contract	For the duration of the relationship, then for 10 years for accounting obligations and to protect our rights
Meeting tax and accounting obligations (invoices, registers)	Legal obligation	10 years (Article 2220 of the Italian Civil Code)
Answering your requests	Pre-contractual measures, contract or our legitimate interest	The time needed to handle the request, then up to 24 months
Availability alerts and wishlist	Your request (performance of a service)	As long as you keep the alert or wishlist
Newsletter and promotional communications	Consent, which you can withdraw at any time	Until you withdraw your consent
E-mails about products similar to those you have already bought, even if you are not subscribed to the newsletter	Legitimate interest (Article 130(4) of the Italian Privacy Code), with the option to object in every e-mail	Until you object
Personalisation: product recommendations and communications based on your purchases and browsing (profiling)	Consent, which you can withdraw at any time	Until you withdraw it, and in any case no more than 12 months after your last activity
Invitation to leave a review on Trustpilot after a purchase	Legitimate interest (checking the quality of our service), with the option to object	One invitation per order
Loyalty programmes and Guest Club	Performance of the contract (programme rules)	For the duration of your participation, then 10 years for accounting data
Forum, comments, reviews and project gallery	Performance of the service you requested	As long as the content remains published
Site security, fraud prevention and protection of our rights	Legitimate interest	Technical logs for 3 years; longer only in case of disputes
Statistics and advertising through cookies	Consent (see the Cookie policy)	As stated in the Cookie policy

At the end of these periods we delete the data or make it anonymous.

4. Do you have to give us your data?

The fields marked as mandatory in our forms are needed to register you, fulfil your order or reply to you: without them we cannot provide the service. All other data is optional.

Consent to the newsletter and to profiling is always optional: if you do not give it, you can still register and shop normally.

5. Who we share data with

Your data is processed by our authorised staff and is never made public. We share it only with the parties we need in order to provide our service. They act either as our data processors (under a contract that requires them to protect it) or as independent controllers when they process data for their own purposes, such as banks and payment networks.

Category	Providers
Payments	Stripe (also for the payment methods offered through Stripe, such as Klarna, Apple Pay or Google Pay: the related data is handled by Stripe, not by us), PayPal, Amazon Pay; our bank for bank transfers
Shipping	DHL, BRT/DPD, FedEx, Poste Italiane and, occasionally, other couriers
Hosting, network and security	Google Cloud (Site servers), Cloudflare (caching and security)
E-mail and newsletter delivery	Amazon Web Services (Amazon SES), Google (Gmail)
Personalisation	Recombee
Reviews	Trustpilot
Statistics and advertising (only with your consent to cookies)	Google (Analytics, Ads, Tag Manager), Meta (Facebook, Instagram)
Social sign-in	Google, Meta (only if you choose this option)
Advice and compliance	Accountant and tax and legal advisers, for legal obligations
Authorities	Public and judicial authorities, when required by law

The up-to-date list of data processors is available on request at [email protected].

6. Transfers of data outside the European Union

Some providers (for example Google, Meta, Amazon, Stripe and PayPal) may also process data in the United States or other countries outside the European Union. In these cases data is transferred only with the safeguards required by the GDPR: an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for participating companies) or Standard Contractual Clauses approved by the Commission. You can ask us about the safeguards in place by writing to [email protected].

7. How we protect your data

We use encrypted connections (HTTPS) across the whole Site, passwords stored in encrypted form, access limited to the staff who need it, and backups. Card payments go directly through the payment provider, which is certified to the PCI DSS standard.

8. Your rights

At any time you can ask us to:

access your data and receive a copy of it;
correct or update it (you can change much of it yourself in your account);
erase it, except for data we must keep by law (for example invoices);
restrict its processing;
receive it in a machine-readable format to transfer it to another service (portability);
object to processing based on our legitimate interest and, in any case and without giving reasons, to direct marketing;
withdraw the consent you have given us, without affecting processing carried out before the withdrawal.

To exercise these rights write to [email protected]. We reply within one month. To stop receiving the newsletter you can also use the unsubscribe link in every e-mail or the Newsletter section of your account.

If you believe that the processing of your data breaches the law, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the EU country where you live or work.

9. Automated decisions

We do not make decisions that have legal effects on you or similarly significantly affect you based solely on automated processing. Personalised product recommendations are only used to show you items that might interest you.

10. Changes to this notice

We may update this notice, for example if we change providers or services. We always publish the updated version here with the date of the latest change. If the changes are significant, we will also let you know by e-mail or with a notice on the Site.