version no. 1 of 02-09-2026
With this document (the “Privacy Notice”) the Data Controller, as defined below, wishes to inform you about the purposes and methods of the processing of your personal data and about the rights granted to you by Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”). This Privacy Notice may be supplemented by the Controller where any additional services requested by you involve further processing.
Data Controller
KEY5 DI DELBONO NICOLA, with registered office at VIA CESARE CANTU’ 47, 25038 Rovato (Brescia), Italy; Telephone: 390302077122; Email: info@key5.it; VAT no. / Tax code: 02085470983;
Types of data processed
The processing activities carried out are aimed at acquiring the following personal data:
- Behavioural data: Browsing logs;
- Common data: Personal details;
- Financial data: Banking details.
Categories of data subjects
The processing activities carried out are addressed to the following categories of data subjects: Web users
Purposes of the processing and legal basis for the processing
1. E-commerce DelbonoDesign.com
The processing of personal data is necessary to obtain the information required to conclude and perform the contract entered into with the Data Controller for the sale of design objects, furnishing accessories, lamps and lighting accessories, indoor and outdoor furniture for home, office and contract use, and tableware and kitchen items.
Legal basis for the processing: Performance of a contract - Art. 6(1)(b) GDPR
Purposes of the processing: 1) Performance and management of the contract entered into with the Data Controller; 2) Acquisition of preliminary information before the conclusion of contracts; 3) Communications sent to and/or received from customers in connection with the performance and/or conclusion of the contract, carried out by various means of communication such as telephone, email, instant messaging (WhatsApp) and postal mail.
Nature of the provision of data:
Mandatory - Failure to provide the data will make it impossible for the Data Controller to perform the contract.
Personal data retention period:
The personal data used to perform the contract will be processed for the time necessary to manage the existing relationship with the Data Controller. Information collected to assess the conclusion of a contract will be deleted within 6 months if the contract is not finalised.
Processing methods:
The processing is carried out mainly with electronic means.
2. WEBSITE - Browsing data
Obtaining anonymous statistical information on the use of the website, checking that it works correctly, and establishing liability in the event of alleged computer crimes against the Controller.
Legal basis for the processing: Legitimate interest - Art. 6(1)(f) GDPR
Purposes of the processing: 1) Analysis of data for the development and maintenance of the website; 2) Establishing liability in the event of potential computer crimes against the website and/or the data subjects; 3) Anonymous statistical analysis of the use of the website.
Nature of the provision of data:
Mandatory - Failure to provide the data will make it impossible for the company to provide the web service.
Personal data retention period:
The data are kept for 30 days.
Processing methods:
The processing is carried out with electronic means.
3. WEBSITE - Requests sent through the website
Requests made by data subjects through the Data Controller's website.
Legal basis for the processing: Performance of a contract - Art. 6(1)(b) GDPR
Purposes of the processing: 1) Sending requests through the tools of the web platform.
Nature of the provision of data:
Optional - Failure to provide the data will make it impossible for the Data Controller to respond to the data subject's requests.
Personal data retention period:
Until the request has been handled.
Processing methods:
The processing is carried out with electronic means.
4. WEBSITE - Use of the service and reserved area
Use of the services offered through the reserved area of the Controller's website.
Legal basis for the processing: Performance of a contract - Art. 6(1)(b) GDPR
Purposes of the processing: 1) Registration in the reserved area; 2) Use of the service provided through access to the reserved area of the website.
Nature of the provision of data:
Optional - Failure to provide the data will make it impossible for the Data Controller to provide services through the reserved area of the website.
Personal data retention period:
Until the user is deleted.
Processing methods:
The processing is carried out with electronic means.
5. Defence in judicial and out-of-court proceedings
Your personal data may be processed to establish, exercise or defend the Controller's rights in judicial and out-of-court proceedings.
Legal basis for the processing: Legitimate interest - Art. 6(1)(f) GDPR
Purposes of the processing: 1) Establishing, exercising or defending the Controller's rights in judicial proceedings; 2) Out-of-court debt recovery.
Nature of the provision of data:
Mandatory - The provision of data to the Data Controller is strictly necessary for any defence in judicial and out-of-court proceedings for a period longer than that provided by law and in any case until the conclusion of the proceedings.
Personal data retention period:
Personal data will be used for a period longer than that provided by law and in any case until the time limits for appeals have expired and no later than the conclusion of the proceedings.
Processing methods:
The processing is carried out mainly with electronic and paper means.
6. Management of IT systems
Your personal data will be used, in the Controller's legitimate interest, for the management of IT systems.
Legal basis for the processing: Legitimate interest - Art. 6(1)(f) GDPR
Purposes of the processing: 1) Management of IT systems, including infrastructure management, business continuity and IT security.
Nature of the provision of data:
Mandatory - An objection to the processing may make it impossible for the Data Controller to perform the contract with the data subject/customer.
Personal data retention period:
Your personal information is kept for the duration of the contractual relationship and, after the end of the contractual relationship, for the period of time necessary to ensure the exercise or defence of rights.
Processing methods:
The processing is carried out with electronic means.
7. Google Fonts
Your personal data will be used to improve the usability of the content of the Controller's website through the use of the Google Fonts service. Google fonts allow pages to load faster and are automatically optimised for the web, reducing the volume of data transmitted to users' clients and improving the quality of the use of the content of the Controller's website or applications. The use of Google fonts is safe and avoids distortion in the display of texts on the Controller's website or application. Google Fonts supports all the most common browsers and works reliably on most modern mobile operating systems.
Legal basis for the processing: Legitimate interest - Art. 6(1)(f) GDPR
Purposes of the processing: 1) Use of CSS files, which determine the style and quality of the content of the website/app, provided by the Google Fonts service.
Nature of the provision of data:
Mandatory - An objection to the processing may make it impossible for the Data Controller to ensure the best possible viewing of the content on the website/app.
Personal data retention period:
The ways in which the data are collected and stored can be found at https://policies.google.com/privacy
Processing methods:
The Google Fonts service is provided by Google as an independent controller. The use of Google Fonts does not require registration or authentication with Google systems. No cookie is stored in the browser. The files (CSS, fonts) are delivered to the browser through the Google domains fonts.googleapis.com and fonts.gstatic.com. The CSS and fonts provided are completely separate from all other Google services. For further information, please see Google's privacy policy at https://policies.google.com/privacy
8. GA4 - Statistical processing of visitors through Google Analytics 4 (GA4)
The data processed by the Data Controller relate to the processing of statistical data on visits to a specific website or mobile application through Google Analytics 4 (GA4), which does not record or store IP addresses.
Legal basis for the processing: Performance of a contract - Art. 6(1)(b) GDPR
Purposes of the processing: 1) The purpose of the processing is the collection and processing of the personal data of the user of the website and/or mobile applications in order to carry out statistical analysis using the Google Analytics 4 (GA4) tool.
Nature of the provision of data:
Mandatory - The provision of personal data is necessary for the delivery of the services through the Data Controller's website. Statistical processing is closely connected with the technical cookies used to record the user's visits. If the user blocks cookies, it will be impossible to use the services of the website/application.
Personal data retention period:
The data collected for statistical processing are kept for 14 months and deleted after that period from the date on which the personal information was collected.
Processing methods:
The processing is carried out with electronic means: during data collection, Google Analytics 4 does not record or store IP addresses. When Analytics collects measurement data, all IP lookups are performed on servers located in the EU before the traffic is forwarded to Analytics servers for processing. Analytics deletes any IP addresses collected from EU users before recording this data through domains and servers located in the EU. Analytics provides approximate geographic location data by deriving the following metadata from IP addresses: city (plus the latitude and longitude derived from the city), continent, country, region, subcontinent (and ID-based equivalents). In addition, Analytics provides controls to: - disable the collection of Google Signals data by geographic area; - disable the collection of granular location and device data by geographic area. Google Analytics uses regional data centres to ensure that measurements relating to web users and mobile app users are sent to Google Analytics as quickly and securely as possible. When Analytics establishes a connection with the nearest available Google data collection centre, measurement data is sent to Analytics over an encrypted HTTPS connection. At the collection centres the data is further encrypted before being forwarded to the Analytics processing servers and made available on the Analytics platform. IP addresses are used to determine the optimal local data centre. In Google Analytics 4, IP addresses are used at the time of collection to determine location information (country, city, latitude and longitude of the city) and are then deleted before the data is recorded in any data centre or server. Regional data collection improves the performance of websites and mobile apps by minimising the distance and total time needed to send data over a secure connection to Google's data centres. Regional data collection and Google's data centre infrastructure also provide redundancy, so that in the unlikely event that a local data centre is no longer available, another one in that region can continue to provide the full service and support users. The Data Controller has excluded from GA4 data collection the functions relating to user profiling and the functions relating to personalised advertising; the Controller also does not cross-reference the statistical processing of Analytics with the users registered to the services offered by the website.
Transfer of data outside the EU
Personal data are processed exclusively within the European Union.
Recipients of the processing
- Data Processor: Suppliers; Privacy and personal data protection services; Hosting services; ICT services; Electronic invoicing services; Cloud services;
- Independent Controller: Banks;
Rights of the data subject - complaint to the supervisory authority
In relation to the processing described in this Privacy Notice, as a data subject you may, under the conditions laid down by the GDPR, exercise the rights set out in Articles 15 to 22 of the GDPR and, in particular, the following rights:
- right of access: the right to obtain confirmation of whether or not personal data concerning you are being processed and, if so, to obtain access to your personal data;
- right to rectification: the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data;
- right to erasure (right to be forgotten): the right to obtain, without undue delay, the erasure of personal data concerning you. The right to erasure does not apply to the extent that the processing is necessary for compliance with a legal obligation, for the performance of a task carried out in the public interest, or for the establishment, exercise or defence of legal claims;
- right to restriction of processing – Article 18 GDPR: the right to obtain restriction of processing where: a) the data subject contests the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) the personal data are required by the data subject for the establishment, exercise or defence of legal claims; d) the data subject has objected to the processing pending verification of whether the legitimate grounds of the controller override those of the data subject.
- right to restriction of processing: the right to obtain the restriction of processing;
- right to data portability: the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning you and to transmit them to another controller;
- right to object: the right to object to the processing of personal data concerning you on grounds relating to your particular situation and, in any case, to the use of your data for marketing purposes.
Where processing is based on consent, you may withdraw it (withdrawal of consent). You may also withdraw the consent given at any time and as easily as it was given, without affecting the lawfulness of the processing based on the consent given before its withdrawal.
You also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you. However, we may adopt an automated decision if it is necessary for entering into or performing a contract with us, if it is authorised by Italian or European Union law, or if you have given your consent.
In any case, you have the possibility to contest the decision, express your views on it and request the intervention of a person who can review it.
You may lodge a complaint at any time with the Italian Data Protection Authority (Garante per la protezione dei dati personali): http://www.garanteprivacy.it.
The above rights may be exercised against the Controller by contacting the details given above.
