Privacy Policy

Privacy Policy

Last updated: December 2025

This policy describes how Tomaino Srl (hereinafter “Data Controller”) collects, uses, stores, and protects the personal data of users who browse or make purchases on the website www.tomaino.it, in accordance with Regulation (EU) 2016/679 (“GDPR”) and current Italian legislation.

Use of the website implies acknowledgement and acceptance of this Privacy Policy.

1. Data Controller

The Data Controller for personal data is:

Tomaino Srl
Via San Bernardo 56 – 20021 Bollate (MI) – Italy
Email: info@tomaino.it
Tel: 02 3510239
VAT ID: 07363110961

2. Types of personal data processed

2.1 Data provided directly by the user

The Data Controller processes personal data voluntarily provided by the user, including:

  • first and last name;
  • shipping and billing address;
  • email address and phone number;
  • data entered in contact forms or newsletter subscription.

Payment data (e.g., card numbers) is not stored by the Data Controller but is managed directly by certified payment service providers.

2.2 Automatically collected data

While browsing the website, the following data may be automatically collected:

  • IP address;
  • device and browser type;
  • browsing data and pages visited;
  • technical and analytical cookies (for more details, please refer to the Cookie Policy).

3. Purpose of processing

Personal data is processed exclusively for the following purposes:

  • order and shipping management;
  • payment and billing management;
  • customer assistance and after-sales support;
  • fulfillment of legal, tax, and accounting obligations;
  • sending communications related to order status;
  • sending commercial communications and newsletters, subject to consent;
  • prevention of fraud, abuse, and illicit use of the website;
  • statistical analysis and improvement of offered services.

4. Legal basis for processing

The processing of personal data is based on one or more of the following legal bases:

  • performance of a contract or pre-contractual measures;
  • fulfillment of legal obligations;
  • express consent of the data subject;
  • legitimate interest of the Data Controller.

5. Recipients of data

Personal data may be disclosed exclusively to third parties necessary for the provision of services, such as:

  • couriers and logistics operators;
  • payment service providers;
  • IT, hosting, and security providers;
  • tax, accounting, and legal consultants.

Personal data is never sold or transferred to third parties for advertising purposes.

6. Data retention

  • data related to orders and invoices: stored for 10 years;
  • data processed for marketing purposes: until consent is withdrawn;
  • browsing data: as provided in the Cookie Policy.

7. Processing methods and security

Data processing is carried out using IT and electronic tools, adopting adequate technical and organizational measures to ensure the security, confidentiality, and integrity of data, including SSL encryption systems, controlled access, and periodic backups.

8. Data subject rights

Pursuant to Articles 15-22 of the GDPR, the user has the right to:

  • obtain confirmation of the existence of personal data;
  • access their data;
  • request its rectification or updating;
  • request its erasure;
  • restrict or object to processing;
  • obtain data portability;
  • withdraw consent at any time;
  • lodge a complaint with the Personal Data Protection Authority.

Requests can be sent to info@tomaino.it.

9. Newsletter and commercial communications

Newsletter subscription only occurs with explicit consent. The user can withdraw consent at any time using the "Unsubscribe" link present in every communication.

10. Changes to this policy

The Data Controller reserves the right to modify this Privacy Policy at any time. Changes will be published on this page and will take effect immediately.

11. Competent court

For any dispute relating to the processing of personal data, the competent court is that of the data subject's place of residence or domicile, as provided by applicable law.