Privacy & Cookie Policy

Section 1 — Data controller and legal framework

This notice is provided under Article 13 of Regulation (EU) 2016/679 (GDPR), Italian Legislative Decree no. 196 of 30 June 2003 (Privacy Code), as amended by Legislative Decree no. 101/2018, and the cookie and tracking-tool guidelines adopted by the Italian Data Protection Authority on 10 June 2021.

The data controller for https://www.17wheel.com/ and its alias https://www.17wheel.it/ (together, the Website) is 17WHEEL DI CANNARIATO MATTIA, registered office at Via 25 Aprile no. 39, 29010 San Nicolò a Trebbia, Rottofreno (PC), Italy; VAT/tax code 01924010331; registration with the Emilia Business Register, REA no. PC - 370341; email: info@17wheel.it / 17wheelgraphicdesign@gmail.com; certified email (PEC): m.cannariato@pec.17wheel.it; direct contact/WhatsApp: +39 366 216 7463 (the Controller).

The Controller has not appointed a Data Protection Officer (DPO) under Article 37 GDPR, as this is not required given the nature and scale of the processing activities carried out.

Section 2 — Privacy Policy: categories of personal data

• ▸ Identity and contact data: first and last name, delivery and/or billing address, email and mobile phone number.
• ▸ Tax data: Italian tax code for private customers or VAT number for professional customers.
• ▸ Production data and graphic files: vehicle model and year, images, logos and graphic specifications submitted to create a custom livery kit, and proof revision history.
• ▸ Account credentials: email and password if the user chooses to create an account to view order status and proofs. Guest checkout is available without registration.
• ▸ Browsing data: IP addresses and technical logs generated by HTTP requests to the server, processed solely to ensure IT security and the proper provision of the web infrastructure.

Security notice

No banking data, credentials or credit-card numbers are stored on or pass through the Controller's servers. Payment processing is entirely delegated to secure external gateways (Stripe and PayPal).

Purposes, legal bases and retention periods

• ▸ Order fulfilment and delivery (proof management, vinyl printing, shipping and courier tracking). Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Retention: 10 years (contractual obligation).
• ▸ Administrative and accounting obligations (receipts and purchase/sales registers). Legal basis: legal obligation (Art. 6(1)(c) GDPR; Art. 2220 Italian Civil Code). Retention: 10 years from the order date.
• ▸ Graphic-file archive for Crash Replacement (discounted reprinting of individual damaged components). Legal basis: performance of the contractual service (Art. 6(1)(b) GDPR). Retention: 18 months from the original order date.
• ▸ Pre- and after-sales support (technical assistance by email or WhatsApp). Legal basis: legitimate interest in responding to communications (Art. 6(1)(f) GDPR). Retention: for the duration of the request, up to 12 months after closure.
• ▸ Soft spam for similar products (emails about products and services identical or similar to those already purchased). Legal basis: legitimate commercial interest (Art. 6(1)(f) GDPR; Art. 130(4) Italian Legislative Decree 196/2003). Retention: until the Customer objects (opt-out).

Exclusions: newsletters, profiling and disclosure of data

• ▸ No disclosure: data are not transferred, sold or rented to third-party companies for advertising purposes.
• ▸ No bulk newsletter: generic advertising or periodic promotions unrelated to the contractual relationship are not sent.
• ▸ No profiling: the Controller does not use profiling algorithms or behaviourally track buyers' preferences.

Recipients and processors (Art. 28 GDPR)

• ▸ Web infrastructure and hosting: Vercel Inc. (serverless/web hosting platform) and Aruba S.p.A. (domain, DNS and email management).
• ▸ Electronic payments: Stripe Payments Europe, Ltd. and PayPal (Europe) S.à r.l. et Cie, S.C.A., acting as independent controllers and complying with PCI-DSS banking standards.
• ▸ Express couriers: logistics carriers engaged for delivery, provided only with the recipient's name, delivery address and telephone number.
• ▸ Administrative consultants: tax professionals engaged to manage the business accounts.

Transfers to third countries

Data are stored primarily in the European Economic Area (EEA). Any transfer of technical data to US servers in connection with international cloud services (e.g. Vercel Inc.) complies with Chapter V GDPR under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or Standard Contractual Clauses (SCCs).

Data subject rights (Articles 15–22 GDPR)

Users may request access to, rectification or erasure of their personal data, restriction of processing or data portability. They may also object to processing on legitimate grounds or request the immediate cessation of soft-spam communications.

Requests may be sent without formalities to info@17wheel.it, 17wheelgraphicdesign@gmail.com or by certified email (PEC) to m.cannariato@pec.17wheel.it. Users may also lodge a complaint with the competent supervisory authority, the Italian Data Protection Authority: www.garanteprivacy.it.

Section 3 — Cookie Policy: what cookies are

Cookies are small text strings sent by websites visited by a user to the user's device, usually the browser, where they are stored and later sent back to those websites on a subsequent visit.

Cookies used by the Website

• ▸ Strictly necessary session and functional cookies: identifiers essential to the proper operation of the e-commerce service, navigation, keeping products in the cart during a session and access to any user account area. Legal basis: provision of the service requested by the user (Art. 122 Italian Privacy Code). As the Website uses only technical cookies, no prior blocking banner or consent-recording mechanism is required.
• ▸ Profiling and marketing cookies: the Website does not use profiling cookies and does not install third-party pixels or cookies for commercial retargeting (including Meta Pixel, TikTok Pixel or Google Ads Remarketing).
• ▸ Third-party analytics cookies: the Website does not use invasive statistical trackers. Any anonymous traffic metrics processed at infrastructure level (Vercel server logs) are not combined with browsing data to create identifiable user profiles.

Managing and disabling cookies in your browser

Users may check, block or delete cookies at any time through their browser security settings. Disabling all technical cookies may affect page display or prevent completion of a purchase.

• ▸ Google Chrome: Settings > Privacy and security > Cookies and other site data.
• ▸ Apple Safari: Preferences > Privacy > Block all cookies.
• ▸ Mozilla Firefox: Options > Privacy & Security > Cookies and Site Data.
• ▸ Microsoft Edge: Settings > Cookies and site permissions.