Privacy Policy

Last updated: 6 June 2026

1. Data controller

2. Types of data processed

Depending on your interaction with the site, we may process:

• Registration and account data: first name, last name, email address, password (stored in encrypted form), phone (optional) and, for Professional customers, company name and VAT number.
• Google authentication data: if you sign in with Google, we receive from Google your identifier, name, email address and profile picture.
• Order and billing data: delivery and billing addresses, order details (payment data is handled directly by the payment providers).
• Browsing data: technical data collected via cookies and similar technologies (see Cookie Policy).
• Communications: the contents of requests sent via email or contact forms.

3. Purposes and legal bases

• Creating and managing the account (registration, login, email verification) - performance of a contract / pre-contractual measures (art. 6.1.b GDPR).
• Managing orders, shipping and support - performance of the contract (art. 6.1.b).
• Tax and accounting obligations - legal obligation (art. 6.1.c).
• Sending the newsletter and promotional communications - consent of the data subject (art. 6.1.a), revocable at any time.
• Site security and abuse prevention - legitimate interest (art. 6.1.f).

4. Data retention

Account data is kept for the duration of the relationship and, afterwards, for the time needed to fulfil legal obligations (e.g. tax and billing data: 10 years). Data processed on the basis of consent is kept until the consent is withdrawn.

5. Disclosure and recipients

Data may be disclosed to parties that provide us with services, appointed as data processors where necessary, including:

• hosting and IT infrastructure providers;
• couriers and shipping services;
• payment service providers;
• Google (for the "Sign in with Google" service);
• professionals and advisors (accountants, lawyers) and the competent authorities where required by law.

Data is neither disseminated nor sold to third parties.

6. Transfers outside the EU

Some providers (e.g. Google) may process data outside the European Economic Area. In such cases the transfer takes place in compliance with articles 44 et seq. of the GDPR, by means of adequacy decisions or standard contractual clauses.

7. Rights of the data subject

As a data subject you may exercise at any time the rights provided by articles 15-22 of the GDPR:

• access, rectification, erasure ("right to be forgotten");
• restriction of and objection to processing;
• data portability;
• withdrawal of consent, without affecting the lawfulness of prior processing;
• lodge a complaint with the Italian Data Protection Authority.

To exercise your rights write to support@getinart.com.

8. Changes to this notice

We reserve the right to update this notice. The current version is always available on this page, indicating the date of the last update.