Data controller
IDAW S.r.l. Unipersonale — Via Roma 8/I, 35010 Vigonza (PD), Italia — P.IVA IT 05173760280.
To exercise your rights, or for any question about this policy, write to us at info@idaw.eu.
What we process, and why
Handling orders and contracts
- Data: First and last name, delivery and billing address, email address, telephone number, tax code or VAT number, details of the configured product, amount and payment method.
- Purpose: To enter into and perform the sales contract: made-to-measure production, shipping, invoicing, customer support and warranty.
- Legal basis: Performance of the contract (Article 6(1)(b) GDPR) and, for invoicing, legal obligation (Article 6(1)(c)).
- Retention: 10 years from invoicing, as required by tax and civil law. If instead you do not complete the order, the personal data you had started entering in the form — name, contact details, addresses and any notes — is deleted after 12 months: all that remains is the non-personal information (configured product, amount, country), which can no longer be traced back to you and is used solely to understand how many purchases are not completed.
Account reserved for trade professionals
- Data: Company name, first and last name, email address, certified email address (PEC), tax code or VAT number, telephone, delivery and billing addresses, recipient code (SDI).
- Purpose: To manage access to the area reserved for trade professionals and apply the agreed commercial terms.
- Legal basis: Performance of the contract and pre-contractual steps taken at your request (Article 6(1)(b) GDPR); legal obligation for billing data (Article 6(1)(c)).
- Retention: For the duration of the relationship and, for tax data, 10 years from the last invoice.
Quotes and saved configurations
- Data: Product configuration, your email address if you ask to receive the quote, session identifier.
- Purpose: To let you save a configuration, pick it up again later and receive it by email.
- Legal basis: Pre-contractual steps taken at your request (Article 6(1)(b) GDPR).
- Retention: 24 months from the last change, unless the configuration becomes an order.
Measuring visits and advertising effectiveness
- Data: Truncated IP address, with the last part removed before storage so as to significantly reduce the possibility of identifying you; browser and device type, language, pages viewed and time of the visit, referring site, and the advertising click identifier when you arrive from an ad. The pages of a single visit are linked through the site's session identifier, which stays valid for up to one year.
- Purpose: To understand how the site is used and which ads actually bring customers, so as not to waste advertising budget.
- Legal basis: Legitimate interest (Article 6(1)(f) GDPR): measuring the effectiveness of our own commercial activity. We consider it to prevail because the data stays with us, is kept to a minimum and is not used to make automated decisions about you; you can object at any time, and if you do, we stop.
- Retention: 14 months, after which the records are deleted automatically. Only aggregate statistics by month, product line and country remain, from which no one can be traced.
- Two things we think it is fair to tell you. First: if your visit ends in an order, we link that order to the visit that preceded it, so we know which ad produced it. Second: this measurement is ours and stops here — it runs on our servers, adds no profiling cookies, does not follow what you do on other sites and shares nothing with third parties. That is a different matter from the Google tools described below, which come into play only if you consent to measurement and marketing cookies.
- Right to object: You can object at any time, without having to give us a reason, by writing to info@idaw.eu. We will then stop processing your data for this purpose.
Record of cookie consents
- Data: A random identifier assigned to the browser (not linked to your name), truncated IP address, browser type, the choices you made and the date.
- Purpose: To remember your cookie preferences and to be able to demonstrate, if needed, which consent had been given.
- Legal basis: Legal obligation (Article 7(1) GDPR: the controller must be able to demonstrate consent).
- Retention: For the whole duration of the processing the consent relates to, and for the limitation period that follows, since this is the evidence the law requires us to be able to produce.
Support via chat
- Data: The text of the messages, truncated IP address, browser, pages viewed during the conversation; name, email and telephone only if you provide them so we can get back to you.
- Purpose: To answer requests for information and support.
- Legal basis: Pre-contractual steps, or legitimate interest in providing support (Article 6(1)(b) and 6(1)(f) GDPR).
- Retention: 24 months from the last message.
- Replies are produced with an artificial intelligence system. Before sending, an automatic filter strips email addresses, telephone numbers, postal addresses, tax codes and VAT numbers from the text. The filter recognises those formats: we still ask you not to type personal data you do not need to share in the chat, because other information about you, if you type it, stays in the text that is sent.
Email correspondence
- Data: Email address, name, subject and content of the messages you write to us and we write to you, together with any attachments.
- Purpose: To carry out the service and deliver the goods you bought: taking measurements, agreeing customisations, arranging delivery, handling support and warranty, and being able to reconstruct what was agreed.
- Legal basis: Performance of the contract (Article 6(1)(b) GDPR): without this correspondence a made-to-measure piece of furniture can be neither produced nor delivered. For messages from people who write to us before ordering, the pre-contractual steps taken at their request apply; for those that do not lead to an order, the legitimate interest in replying and keeping a record (Article 6(1)(f)).
- Retention: For the duration of the relationship and the limitation period that follows, because that is where the evidence of what had been agreed is found.
Invitations to leave a review
- Data: First and last name, email address and order number.
- Purpose: To send you, after delivery, the invitation to tell others how it went.
- Legal basis: Legitimate interest in gathering feedback on our products from those who bought them (Article 6(1)(f) GDPR).
- Retention: The invitation is sent only once after the order; retention periods at the review platform are set out in its own privacy policy.
- Just tell us once — replying to any of our emails is enough — and your order is excluded from these messages.
- Right to object: You can object at any time, without having to give us a reason, by writing to info@idaw.eu. We will then stop processing your data for this purpose.
Offer of our products similar to the one you bought
- Data: First name, last name and email address.
- Purpose: To offer you, after your purchase, our products similar to the one you bought. It is one of the two emails announced in our terms of sale.
- Legal basis: Article 13(2) of Directive 2002/58/EC (the ePrivacy Directive), implemented in Italy by Article 130(4) of the Data Protection Code and by equivalent provisions in the other EU countries, which allows the email address you gave us at the time of purchase to be used without consent to offer you our products similar to those you bought, provided you can object at any time and without formalities. Buying from us does not sign you up to any newsletter.
- Retention: Until you tell us to stop, and in any case no longer than 24 months after your last purchase.
- To stop receiving it, just tell us once — simply replying to the message is enough: no procedure is needed, and it applies permanently.
- Right to object: You can object at any time, without having to give us a reason, by writing to info@idaw.eu. We will then stop processing your data for this purpose.
Invitation to send us a photo of your finished furniture
- Data: First name, last name and email address; and, if you decide to reply, the photograph you send us.
- Purpose: To ask you for a photo of the installed furniture — customers' pictures are what helps most those who are configuring theirs — giving you a discount on your next purchase in return.
- Legal basis: For the invitation, our legitimate interest in gathering real images of our products from those who received them (Article 6(1)(f) GDPR), with the possibility of objecting at any time. For the photograph, your consent (Article 6(1)(a)): before you decide, the email tells you we might publish it on our website and social channels, and it is you who choose whether to send it. If you do not reply, nothing happens and we do not write to you again.
- Retention: The invitation is sent only once after the order. The photographs you send us are kept for as long as you allow us to use them: if you change your mind, write to us and we will take them down.
- Right to object: You can object at any time, without having to give us a reason, by writing to info@idaw.eu. We will then stop processing your data for this purpose.
Website security and abuse prevention
- Data: IP address and technical information about the request, for the strictly necessary time.
- Purpose: To prevent automated submissions, attempted abuse and attacks.
- Legal basis: Legitimate interest in the security of our own systems (Article 6(1)(f) GDPR).
- Retention: A few hours, for the duration of the checking window.
Who we share data with
We do not sell your personal data. We share it only with those parties needed to deliver our services, and only the data each of them needs for its own purpose. Depending on the case, these parties process the data either as processors on our behalf or as independent controllers, as set out in their own privacy policies:
Payments
Your card details never pass through our servers: they are collected directly by the payment provider.
Shipping and delivery
They receive the name, address and telephone number, which are essential for delivery.
Measurement and advertising
- Google Ireland Ltd (Google Ads, Analytics, Tag Manager, Merchant Center) (Irlanda) — privacy policy
- YouTube (Google Ireland Ltd) (Irlanda) — privacy policy
They come into play only with your prior consent to measurement and marketing cookies: if you refuse, they are not loaded. YouTube videos do not start on their own: on product pages they stay replaced by a placeholder until you consent, and on the assembly pages they load only when you press play yourself. The preview image is hosted on our servers too, so until you decide, no request is sent to YouTube.
Collecting reviews
Receives the name, email address and order number in order to send you the invitation to leave a review after your purchase.
Automated support
Receives the text of chat messages after the automatic removal of identifying data.
Transfers outside the European Union
Google services are provided by Google Ireland Ltd, established in the European Union. Where data is passed on to the US parent company, the transfer is covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework, to which Google LLC adheres.
The provider of the chat's artificial intelligence service, Groq Inc., is established in the United States. The transfer is governed by the standard contractual clauses approved by the European Commission (Decision 2021/914), set out in the data processing agreement signed with that provider, as appropriate safeguards under Article 46 GDPR. In any event it concerns only the text of the messages, already stripped of identifying data.
You can ask us for a copy of the safeguards in place by writing to info@idaw.eu.
Your rights
You can ask us at any time to access your data, to correct it, to erase it, to restrict its processing, to receive it in a readable format so you can take it elsewhere, and to object to processing based on legitimate interest. Where processing rests on your consent, you can withdraw it whenever you like, without affecting the lawfulness of what was done before.
Write to info@idaw.eu: we reply within one month. If you believe the processing of your data breaks the law, you can lodge a complaint with the supervisory authority of the country where you live or work, or with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), which is the authority of the country where we are established.
Last updated: 22/8/2026
The Italian version of this policy is the authoritative one.
