Privacy Policy

Data controller

IDAW S.r.l. Unipersonale — Via Roma 8/I, 35010 Vigonza (PD), Italia — P.IVA IT 05173760280.
For the exercise of rights and for any communication concerning this policy: info@idaw.eu.

Processing operations

Handling orders and contracts

• Data: Name and surname, delivery and billing address, email address, telephone number, tax code or VAT number, characteristics of the configured product, amount and method of payment.
• Purpose: Conclusion and performance of the sales contract: made-to-measure production, shipment, invoicing, support and warranty.
• Legal basis: Performance of the contract (Art. 6(1)(b) GDPR) and, for invoicing, compliance with legal obligations (Art. 6(1)(c)).
• Retention: Ten years from invoicing, in accordance with tax and civil law. Where the order is not completed, the personal data entered in the form are erased after twelve months; only data not attributable to the data subject remain (configured product, amount, country).

Account reserved for trade professionals

• Data: Company name, name and surname, email address, certified email address, tax code or VAT number, telephone number, delivery and billing addresses, SDI recipient code.
• Purpose: Management of access to the area reserved for trade operators and application of the agreed commercial terms.
• Legal basis: Performance of the contract and pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR); compliance with legal obligations for invoicing data (Art. 6(1)(c)).
• Retention: For the duration of the relationship and, for tax data, ten years from the last invoice.

Quotes and saved configurations

• Data: Product configuration, email address where its delivery is requested, session identifier.
• Purpose: Saving, resuming and sending the configuration at the data subject's request.
• Legal basis: Pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR).
• Retention: Twenty-four months from the last change, unless converted into an order.

Reminder of the requested delivery date

• Data: Email address, relevant configuration, date or period indicated by the data subject, country and language.
• Purpose: Sending, at the data subject's request, of a notice as the deadline for ordering approaches in relation to the delivery date they indicated.
• Legal basis: Pre-contractual measures taken at the data subject's request (Article 6(1)(b) GDPR). The notice is purely informative and contains no promotional communication.
• Retention: Up to twelve months from the date indicated by the data subject, or until the request is withdrawn, which is possible at any time through the link contained in the message. After that period only data not attributable to the data subject remain: requested lead time, country, product line and amount.

Measuring visits and advertising effectiveness

• Data: Truncated IP address, with its last part removed before storage so as to significantly reduce the possibility of identification; browser and device type, language, pages viewed and time of viewing, referring site and, where access follows an advertisement, the advertising click identifier. Pages within a single visit are linked by means of the site's session identifier, which is necessary for the operation of the cart and of the order process and remains valid for a maximum of twelve months. The same identifier is stored in the browser's local storage (localStorage) in order to allow the cart and the order process to be recovered should the browser open a new session; that same datum also allows an order to be traced back to the visit preceding it.
• Purpose: Analysis of how the site is used and measurement of the effectiveness of advertising campaigns, for the purpose of allocating the related budget.
• Legal basis: Legitimate interest of the controller in measuring the effectiveness of its commercial activity (Art. 6(1)(f) GDPR), considered to prevail in view of the limited data processed, their retention by the controller and the absence of automated decision-making. Storage of the identifier in the browser's local storage requires no consent, being strictly necessary for the provision of the service requested by the user (Art. 122(1) of Italian Legislative Decree 196/2003).
• Retention: Fourteen months, after which the data are erased automatically. Only statistical data aggregated by month, product line and country remain, which cannot be attributed to any data subject.
• The measurement is carried out on the controller's servers, does not involve the installation of profiling cookies and does not allow tracking across third-party sites. Subject to consent to marketing cookies, only the outcome of the advertising click, with the related amount, and the hashed email address are disclosed to Google Ads, as set out under «Reporting sales to Google Ads».
• Right to object: the data subject may object at any time, without having to give reasons. Since the measurement does not allow the data subject to be identified, the objection is exercised by means of the control below, which acts on the browser in use.
  Do not measure my visits

Reporting sales to Google Ads

• Data: The advertising click identifier generated by Google at the time of the click, together with the amount, date and currency of the order. The data subject's email address, hashed with SHA-256 before transmission: the address is not transmitted in the clear and cannot be recovered from the resulting value; that value nonetheless constitutes pseudonymised personal data, being intended for matching against Google users' identifiers. Where no click can be attributed to the order, only the hashed address is transmitted. Name, address, telephone number and the products purchased are not transmitted.
• Purpose: Disclosure to Google Ads of the outcome of advertising campaigns, for the purpose of conversion measurement.
• Legal basis: Consent (Art. 6(1)(a) GDPR), given by accepting marketing cookies and recorded on the order at the time it is placed. Withdrawal, which may be exercised at any time from the cookie banner, prevents the disclosure of sales not yet transmitted and has no effect on those already transmitted.
• Retention: The hashed value is computed at the time of transmission and is not retained by the controller. Disclosure concerns orders placed no more than ninety days earlier. The choice expressed by the data subject remains recorded on the order for its duration, as evidence of the legal basis of the disclosure.

Record of cookie consents

• Data: Random identifier assigned to the browser, unrelated to the data subject's name, truncated IP address, browser type, choices expressed and date.
• Purpose: Retention of cookie preferences and evidence of the consent given.
• Legal basis: Compliance with a legal obligation (Art. 7(1) GDPR).
• Retention: For the duration of the processing to which the consent relates and for the subsequent limitation period.

Support via chat

• Data: Text of the messages, truncated IP address, browser, pages viewed during the conversation; name, email address and telephone number where provided by the data subject.
• Purpose: Response to requests for information and support.
• Legal basis: Pre-contractual measures at the data subject's request and legitimate interest in providing support (Art. 6(1)(b) and (f) GDPR).
• Retention: Twenty-four months from the last message.
• Draft replies are produced by means of artificial intelligence systems. Before transmission an automatic filter removes email addresses, telephone numbers, postal addresses, tax codes and VAT numbers from the text; any further personal data entered by the data subject remain in the transmitted text.

Email correspondence

• Data: Email address, name, subject and content of the messages exchanged and the related attachments.
• Purpose: Performance of the contract and management of the relationship: measurements, customisations, delivery, support and warranty.
• Legal basis: Performance of the contract (Art. 6(1)(b) GDPR); for messages preceding the order, pre-contractual measures at the data subject's request; for those not followed by an order, legitimate interest in replying and in retaining the correspondence (Art. 6(1)(f)).
• Retention: For the duration of the relationship and for the subsequent limitation period.
• Draft replies may be produced by means of artificial intelligence systems, to which the text of the message received is transmitted after application of the automatic filter referred to under «Chat support». Attachments are not transmitted.

Invitations to leave a review

• Data: Name and surname, email address and order number.
• Purpose: Invitation to leave a review following delivery.
• Legal basis: Legitimate interest in collecting feedback on its own products from purchasers (Art. 6(1)(f) GDPR).
• Retention: The invitation is sent once per order; retention periods at the review platform are set out in its own policy.
• Exclusion from these communications is granted on simple request by the data subject.
• Right to object: the data subject may object at any time, without having to give reasons, by writing to info@idaw.eu. Processing for that purpose is discontinued.

Offer of our products similar to the one you bought

• Data: Name, surname and email address.
• Purpose: Offer of the controller's products similar to those purchased.
• Legal basis: Art. 13(2) of Directive 2002/58/EC, transposed in Italy by Art. 130(4) of Legislative Decree 196/2003 and by equivalent provisions in the other Member States: use of the email address provided on purchase to offer similar products, with the right to object at any time and without formality.
• Retention: Until the data subject objects and in any case no longer than twenty-four months from the last purchase.
• The objection may be exercised by replying to the message and takes permanent effect.
• Right to object: the data subject may object at any time, without having to give reasons, by writing to info@idaw.eu. Processing for that purpose is discontinued.

Invitation to send a photograph of the installation

• Data: Name, surname and email address; the photograph, if any, sent by the data subject.
• Purpose: Invitation to send a photograph of the installed product, for the collection of images of completed work.
• Legal basis: Legitimate interest in collecting images of its own products from purchasers (Art. 6(1)(f) GDPR) for the invitation; consent of the data subject (Art. 6(1)(a)) for the sending and any publication of the photograph, of which the message gives prior notice.
• Retention: The invitation is sent once per order. Photographs are retained until consent is withdrawn.
• Right to object: the data subject may object at any time, without having to give reasons, by writing to info@idaw.eu. Processing for that purpose is discontinued.

Website security and abuse prevention

• Data: IP address and technical information relating to the request.
• Purpose: Prevention of automated submissions, abuse and attacks.
• Legal basis: Legitimate interest in the security of its own systems (Art. 6(1)(f) GDPR).
• Retention: For the time strictly necessary for the check.

Recipients of the data

The controller does not disclose personal data to third parties for their own purposes. Data are communicated solely to those necessary for the provision of the services, limited to the data required for each purpose. Those parties act, as the case may be, as processors or as independent controllers, as stated in their respective policies:

Payments

• PayPal (Europe) S.à r.l. (Lussemburgo) — privacy policy
• Mollie B.V. (Paesi Bassi) — privacy policy
• Worldline / Sherlock's (Francia) — privacy policy

Payment card data do not pass through the controller's servers and are collected directly by the payment service provider.

Transport and delivery

The data necessary for delivery — name, address and telephone number — are communicated to the carriers, freight forwarders and other parties entrusted with the transport and delivery of the goods, determined case by case according to the destination, the size of the consignment and the type of product. Each receives only the data necessary for delivery. The identity of the carrier entrusted with a given shipment is provided at the data subject's request.

Measurement and advertising

• Google Ireland Ltd (Google Ads, Analytics, Tag Manager, Merchant Center) (Irlanda) — privacy policy
• YouTube (Google Ireland Ltd) (Irlanda) — privacy policy

They come into play only with your prior consent to measurement and marketing cookies: if you refuse, they are not loaded. YouTube videos do not start on their own: on product pages they stay replaced by a placeholder until you consent, and on the assembly pages they load only when you press play yourself. The preview image is hosted on our servers too, so until you decide, no request is sent to YouTube.

Collecting reviews

• Trustpilot A/S (Danimarca) — privacy policy

Receives name, email address and order number for the purpose of the review invitation.

Automated support

• Groq Inc. (Stati Uniti) — privacy policy
• Anthropic PBC (Stati Uniti) — privacy policy

Receive the text of the chat messages and, where the system is used to produce a draft reply to an email message, the text of the message received, in both cases after the automatic removal of email addresses, telephone numbers, postal addresses, tax codes and VAT numbers. Attachments are not transmitted. Drafting is currently entrusted to Anthropic PBC; Groq Inc. operates as an alternative system should the former be unavailable.

Transfers outside the European Union

Google services are provided by Google Ireland Ltd, established in the European Union. Any onward transfer to the US parent company is covered by the European Commission adequacy decision on the EU-US Data Privacy Framework, to which Google LLC adheres.

Groq Inc. is established in the United States. The transfer is governed by the standard contractual clauses approved by the European Commission (Decision 2021/914), provided for in the data processing agreement, as appropriate safeguards under Article 46 GDPR. It concerns the text of chat and email messages, after application of the automatic filter referred to above; attachments are not transmitted.

Anthropic PBC is established in the United States. The transfer is governed by the same standard contractual clauses and has the same subject matter. Under the terms applicable to the provider's commercial services, the data transmitted are not used to train the models and are retained for a maximum of thirty days.

A copy of the safeguards adopted may be requested at

Rights of the data subject

The data subject has the right to obtain access to the personal data concerning them, their rectification or erasure, restriction of processing and data portability, as well as to object to processing based on legitimate interest. Where processing is based on consent, such consent may be withdrawn at any time, without prejudice to the lawfulness of processing carried out before withdrawal.

Requests are to be addressed to info@idaw.eu: reply within one month of receipt. This is without prejudice to the right to lodge a complaint with the supervisory authority of the State of residence or work, or with the Garante per la protezione dei dati personali (www.garanteprivacy.it), the authority of the State in which the controller is established.

Last updated: 24/9/2026
The Italian version of this policy is the authoritative one.