Privacy policy

Information notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Last updated: 9 September 2026. Version 2.0.

1. Who processes your data

The Data Controller is Stefania Dei Rossi, sole proprietor trading as Oro & Disegni.

Registered office: Piazza Benco 4, 34122 Trieste (TS), Italy.
Shop and atelier: Campo Santa Maria Nova, Sestiere Cannaregio 6043/B, 30121 Venice, Italy.
Italian tax code: DRSSFN91P65L424Z. VAT number: 01317500328.
Email: info@stefaniadeirossi.com. Certified email: s.deirossi@pec.it.

No Data Protection Officer has been appointed, as none of the cases under Article 37 GDPR applies. For any matter concerning your data, please write to the addresses above.

2. Who this notice applies to

This notice applies to anyone who:

• buys in the shop in Venice;
• buys online at stefaniadeirossi.com;
• books and attends the gilding workshops at the atelier, directly or through booking platforms;
• commissions consultancy, restoration work, bespoke pieces or collaborations;
• subscribes to the newsletter;
• gets in touch by email, telephone, WhatsApp or social media;
• browses the website (for cookies and tracking tools, please see the Cookie Policy).

3. What data we process

• Identification and contact data: first name, surname, address, email, telephone.
• Tax and administrative data: tax code, VAT number, e-invoicing recipient code, billing details.
• Purchase and delivery data: items purchased, shipping address, order history, returns.
• Payment data: transaction outcome and reference. Card details are handled directly by the payment providers and are not stored by the Data Controller.
• Workshop data: session date, number of participants, any requirements you choose to share.
• Images and video: recorded during the workshops, only with specific prior consent (see section 5).
• Browsing data and cookies: as set out in the Cookie Policy.

Special categories of data under Article 9 GDPR, such as health data, religious beliefs or sexual orientation, are not requested. If you volunteer such information, for example a food intolerance ahead of the closing aperitivo, it is used only to handle your request and deleted immediately afterwards.

4. Why we process data, on what legal basis and for how long

Purpose	Legal basis	Retention
Sales in the shop and online: order handling, payment, shipping, returns and warranty	Performance of a contract (Art. 6(1)(b) GDPR)	10 years from the transaction, for civil and tax obligations
Booking and delivery of the gilding workshops	Performance of a contract (Art. 6(1)(b) GDPR)	10 years from the transaction
Consultancy, restoration, commissioned works and collaborations	Performance of a contract and pre-contractual steps (Art. 6(1)(b) GDPR)	10 years from completion of the assignment
Invoicing, accounting, tax compliance and electronic invoicing through the Italian SDI system	Legal obligation (Art. 6(1)(c) GDPR)	10 years, as required by Italian tax law
Replying to enquiries and quotation requests received by email, telephone, WhatsApp or social media	Pre-contractual steps (Art. 6(1)(b)) or legitimate interest in replying (Art. 6(1)(f) GDPR)	24 months from the last contact
Sending the newsletter and promotional communications	Consent (Art. 6(1)(a) GDPR)	Until consent is withdrawn or you unsubscribe
Sending communications about similar products and services to existing customers	Legitimate interest (Art. 6(1)(f) GDPR and Art. 130(4) of Italian Legislative Decree 196/2003)	Until you object
Recording and publishing workshop photographs and video for promotional purposes	Consent (Art. 6(1)(a) GDPR) and release under Arts. 96-97 of Law 633/1941	36 months, except for material already published
Workshop photographs and video for internal documentation and archive	Consent (Art. 6(1)(a) GDPR)	36 months
Publishing reviews and testimonials naming the person who gave them	Consent (Art. 6(1)(a) GDPR)	Until consent is withdrawn
Establishing, exercising or defending legal claims	Legitimate interest (Art. 6(1)(f) GDPR)	For the duration of the dispute and until the limitation periods expire

Once these periods end, data is deleted or irreversibly anonymised.

5. Photographs and video during the workshops

Photographs and video may be taken during the workshops at the atelier. Participants are filmed and their images used only with specific written consent, collected through a dedicated release form signed before or at the start of the session.

Consent is free and optional: refusal does not prevent participation and carries no disadvantage. Consent is given separately for promotional use (website, social media, newsletter, advertising, portfolio and third-party platforms) and for internal use (documentation, archive, training material).

Consent may be withdrawn at any time by writing to info@stefaniadeirossi.com. Withdrawal stops all future use, but the removal of material already published or already distributed by third parties cannot be guaranteed.

6. Who we share data with

Data may be shared, only to the extent necessary, with the following categories of recipients, acting either as processors under Article 28 GDPR or as independent controllers:

• the e-commerce platform and website hosting provider;
• payment service providers, in store and online, and banks;
• couriers and shipping companies, to deliver orders;
• the email marketing platform provider, for the newsletter;
• third-party booking and retail platforms through which workshops and products are distributed;
• website analytics and online advertising providers, within the limits of the consent given through the cookie banner;
• the accountant and the electronic invoicing intermediary;
• legal, IT and insurance advisers;
• public and judicial authorities, where required by law.

An up-to-date, named list of processors is available on request at info@stefaniadeirossi.com. Data is not disseminated or sold to third parties for their own marketing purposes.

7. Transfers outside the European Economic Area

Some providers used for the website, payments, email marketing, analytics and social media are based, or hold servers, in the United States or in other countries outside the European Economic Area. Such transfers take place solely on the basis of the safeguards under Chapter V GDPR:

• the European Commission adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, for US providers that have certified under it (Art. 45 GDPR);
• failing certification, the standard contractual clauses approved by the European Commission, supplemented where necessary by additional measures (Art. 46 GDPR).

A copy of the safeguards in place can be requested at info@stefaniadeirossi.com.

8. If you do not provide your data

Providing the data needed to complete a purchase, book a workshop, accept a commission or issue an invoice is mandatory: without it the request cannot be fulfilled. Providing data for the newsletter, for photographs and video and for testimonials is optional, and refusal has no effect on the commercial relationship.

9. Your rights

You may exercise the rights under Articles 15 to 22 GDPR at any time:

• access to the data concerning you (Art. 15);
• rectification of inaccurate or incomplete data (Art. 16);
• erasure of data (Art. 17);
• restriction of processing (Art. 18);
• data portability, in a structured, machine-readable format (Art. 20);
• objection to processing based on legitimate interest, including direct marketing (Art. 21);
• withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).

Requests may be sent to info@stefaniadeirossi.com or by post to the registered office. Exercising these rights is free of charge and requires no particular form. A reply follows within one month, extendable by two further months for complex requests.

If you believe the processing infringes data protection law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or bring proceedings before the courts.

10. Minors

The services are not aimed at children under 14, who may not purchase or subscribe to the newsletter on their own. A minor's participation in a workshop requires the consent of the person holding parental responsibility.

11. Automated decision-making

No solely automated decision-making, including profiling, producing legal effects or similarly significantly affecting individuals is carried out.

12. Security

Appropriate technical and organisational measures are in place to protect data against destruction, loss, unauthorised access and disclosure, including an encrypted website connection, access limited to authorised persons only, and the selection of providers offering GDPR compliance guarantees.

13. Changes

This notice may be updated to reflect legal or organisational changes. The version in force is always the one published at stefaniadeirossi.com, showing the date it was last updated. Material changes will be notified to registered data subjects with reasonable notice.