Privacy notice

Updated 24 October 2026 · version 2026-10-24-v62.

Data controller and contact details

The data controller is Antonio Villani, VAT no. 04504830714, REA FG-333253, Via Nicola Fiani 134, 71017 Torremaggiore (FG), Italy. For personal data enquiries: amministrazione@piglialapuglia.com, telephone +39 0882 393404, certified email (PEC) villania@pec.it.

Purchases, payment, delivery and support

Purchases require names, contact details, delivery addresses, products, options and payment references to fulfil orders, deliver products and manage support, returns, withdrawal and refunds. Purchase data are processed to perform the contract or take pre-contractual steps; tax and accounting data meet applicable obligations. Without necessary data, the order or related service cannot be completed. Newsletter consent is separate and optional.

Payment is handled by the provider selected from those shown at checkout. PayPal manages its own flow. Where available, Stripe receives the email address, necessary delivery details and order summary to open its payment page; card details are entered directly in Stripe components. The shop verifies amount, currency and result with the provider before recording receipt. Where available, Apple Pay and Google Pay receive the data needed to select and authorise payment. When the Customer uses the shop’s Apple Pay or Google Pay buttons, wallet payment data go directly to PayPal through its components; when choosing a wallet on Stripe’s hosted payment page, Stripe and the wallet service handle those data directly. The shop keeps transaction references and the verified result, not the wallet token; its form does not request full card details. Confirmations retain the summary and the version of the accepted terms. Order number and email are used to verify access to the withdrawal function.

Requesting an invoice is optional and can be selected before submitting the order. The necessary billing and issuance details are then collected, such as name or company name, tax or VAT number, billing address and, where relevant, recipient code or certified email (PEC). The request and data are stored with the order and sent by the owner to the appointed accountant, who issues the invoice. Checkout records the request; it does not automatically issue an invoice.

Essential order emails

Brevo sends essential communications about orders, payments, refunds, shipping and withdrawal. It receives the recipient’s address and content needed for each message, including any attached summaries. These messages relate to contract management and applicable obligations; newsletter subscription is not required. Unsubscribing from promotions does not prevent receipts or essential order messages.

The mailbox amministrazione@piglialapuglia.com, managed by Register, is the contact mailbox for replies and support.

Custom labels and Canva editor

The editor embeds Canva and components from canva.com, canva-hosted-embed.com and canvacode.com. Loading it sends requests to these services, which receive at least the technical data needed to connect. Read the Canva privacy policy and the Canva cookie policy.

The editor code examined on 20 October 2026 uses a temporary browser URL (URL.createObjectURL) to display the selected logo. The email button prepares a request and asks you to attach the file manually. This local function does not prove that Canva’s SDKs and external components perform no other processing: no promise is made that the service transmits or retains no copies. You can also request personalisation directly by email without using the editor.

Names, messages and materials sent to the owner are used to answer the request and agree the label, based on requested pre-contractual steps or the contract (GDPR Article 6(1)(b)). Personalisation content is optional; without necessary materials, the requested artwork cannot be made. Reuse for advertising or a portfolio is not included. The retention period for files received by the owner is stated below and does not guarantee providers’ independent retention periods.

Website, email and WhatsApp enquiries

The quote form prepares a message with the details you choose to enter; it does not automatically send a request. Choosing email or WhatsApp prepares the text in that service: review it before sending. The owner processes received enquiries to reply and prepare a quote, based on requested pre-contractual steps (GDPR Article 6(1)(b)). Name, quantity and idea description are optional. Sending an enquiry does not subscribe you to the newsletter.

Optional newsletter

The newsletter is not currently available through the shop. Brevo is selected for future promotional mailings: subscription will require optional consent, separate from ordering and not pre-ticked, with an unsubscribe option. Subscription terms, including retention periods, will be stated on its form.

Purchasing does not automatically add you to a promotional list. Purchase data are not used for profiling or automated promotional abandoned-basket recovery.

Providers, access and international transfers

Operational order management is restricted to the owner. The website and records use Sites and Cloudflare; Brevo sends the messages described and Register manages the mailbox. PayPal and, when offered at checkout, Stripe provide payments; Apple and Google are involved when their wallet is selected. Carriers, selected for each shipment, receive only necessary delivery data. The appointed accountant receives the data needed for tax compliance and issues invoices.

For infrastructure information, see theOpenAI European privacy policy and theCloudflare privacy policy. These policies describe processing on international infrastructure, including in the United States. Cloudflare states that its cookie data may, by default, be processed in its US data centres; no site-specific localisation setting has been verified.

Providers’ transfer sections describe their mechanisms, including adequacy decisions and standard contractual clauses where applicable. These general documents do not by themselves establish which contract, data protection role, processing country or safeguard applies to the owner’s specific account. Exclusively European processing and unverified contractual safeguards are therefore not claimed. Contact the controller using the details above to exercise rights or request copies of the safeguards actually applicable.

Retention

The controller has set the following operational periods, separate from mandatory retention of contract and tax records:

Data and purpose	Planned period
Contract and tax records	For the applicable statutory periods.
Support requests	24 months after the request is closed.
Customer’s original artwork files	12 months after delivery of the personalised order.
Unfinished checkout attempts	30 days after the last recorded activity, after checking that no payments need reconciliation.
Technical logs controlled by the owner	90 days after recording.
Operational email logs at Brevo	1 month after sending under the current account settings; message previews are not retained. Copies forming contract or tax records follow the corresponding obligations.

Disputes, open complaints and specific obligations may require only the necessary data to be retained for the relevant period. These periods cover data and copies under the controller’s control, not Canva’s or other providers’ independent retention. Session or access-link expiry does not itself delete contract or tax records that must be kept.

The basket uses browser local storage for products, quantities, options and any promotional code entered. Its contents stay on the device until removed or browser storage is cleared. The checkout form does not save contact details or addresses in local storage.

The technical shopping session lasts up to 7 days; the personal withdrawal access link lasts 24 hours. These periods control access and are separate from the retention periods above.

The inventory below distinguishes functions documented in website code from technical observations on 20 October 2026. A listed item is not necessarily used on every visit.

Cookies and browser storage
Name and provider	Verified function and duration
`plp_locale` Shop Piglia la Puglia	Language preference (Italian, English, German or simplified Chinese) to retain your choice while browsing and on return from payment. A session cookie on the website domain, with SameSite=Lax and Secure over HTTPS, without a persistent expiry. It contains no contact details and is not used by the site for advertising or profiling.
`__Host-appgarden-visitor` Sites hosting infrastructure	Observed in a Set-Cookie header on piglialapuglia.com before user choices, path /, duration 90 days (7,776,000 seconds). The specific purpose was not confirmed by available documentation; it is not classified as technical, analytics or advertising solely from its name. Server-side uses and additional recipients were not verified.
`__cf_bm` Cloudflare	Protection against automated traffic, documented by the provider. Observed on the site and in Canva; expires after 30 minutes of inactivity. Security protections remain active.
`__Host-plp_shop_session` Shop Piglia la Puglia	Signed session linking checkout requests and protections against unauthorised requests. Up to 7 days; HttpOnly, Secure and SameSite=Lax cookie. It contains no Customer contact details.
`piglia-shop-preview-v31` Shop local storage	Items, quantities and options for the user’s basket; until the contents are removed or browser storage is cleared.
`piglia-shop-shipping-v1` Shop local storage	Selected shipping zone and service; until changed or browser storage is cleared.
`piglia-shop-promotion-v1` Shop local storage	Only the promotional code entered for the basket; until removed or browser storage is cleared. It does not subscribe the user to promotions.
`piglia-shop-order-attempt-v1` Shop session storage	Order-attempt reference and a key to avoid duplicate payments, without contact details or addresses. Kept for the tab session, which the browser may restore; also removed when the purchase flow resets it.
`NID` Google, in the Google Pay flow	Observed at checkout before wallet-loading changes, lasting about 6 months. Google documents several uses across its services, including preferences, analytics and advertising; this does not prove that all apply during payment. Checkout now loads Google Pay only after an explicit availability-check request.
`__paypal_storage__` PayPal component local storage	Key observed at checkout with wallet components loaded. The specific purpose and retention for this configuration were not confirmed; no undocumented duration is assigned. Wallet components now start only on request.
`CDI` and `CL` Domain www.canva.com	Observed when loading the embedded editor, lasting 365 and 180 days respectively. Specific purposes and any consent exemption were not verified.
`_cfuvid` Cloudflare within Canva	Session cookie distinguishing visitors sharing an IP address for rate-limiting rules, according to Cloudflare documentation.

For security cookies, see the official Cloudflare documentation. Technical basket, session and security functions are separate from marketing and non-essential analytics. Silence or scrolling is not treated as consent. The absence of a banner does not mean external providers’ tools have been certified as exempt.

The editor check also observed resources classified as Cloudflare Web Analytics and Sentry; exemption was not established for all related configurations. The external provider’s notices and the limits above remain relevant. Deleting browser cookies does not guarantee technical withdrawal from embedded services’ independent processing.

External wallets on request

Checkout does not automatically start wallet SDKs. The Check Apple Pay and Check Google Pay buttons connect only to the selected service, using the PayPal components needed for that flow. Other methods can be used without starting wallets. Close wallet services reloads checkout and stops the previous document’s activity; another check must be requested again.

Requesting a payment function is not recorded as marketing consent and does not establish exemption for all provider processing. See the Google cookie information and thePayPal notice on cookies and similar technologies. Classifying processing beyond payment requires checking the actual service terms and configuration.

Rights and requests

Contact the controller to exercise applicable rights of access, rectification, erasure, restriction, objection and portability. Promotional consent may be withdrawn without affecting earlier lawful processing. You may lodge a complaint with the Italian Data Protection Authority (Garante). Erasure may be limited for documents retained to meet obligations or handle an actual dispute; the controller assesses the request.

Read this notice together with the terms of sale.