Privacy Policy
Last updated: June 2026
This Privacy Policy describes how Maurizia Bonvini (hereinafter “Data Controller”), an independent artist based in Italy, collects, uses and protects the personal data of users who visit and/or make purchases on the website www.mauriziabonvini.com (hereinafter “Website”).
Personal data is processed in compliance with EU Regulation 2016/679 (GDPR), Italian Legislative Decree 196/2003 (Privacy Code) as amended by Legislative Decree 101/2018, and the applicable provisions of the Italian Data Protection Authority (Garante per la protezione dei dati personali).
1. Data Controller
Maurizia Bonvini
Independent Artist
Italy
Email: maurizia_bonvini@hotmail.com
To exercise your rights or for any request related to personal data, please contact the Data Controller at the email address above.
2. Types of Data Collected
2.1 Data provided voluntarily by the user
When making a purchase through the online shop (WooCommerce), the Website collects the following personal data necessary to process the order:
- First name and last name
- Billing and/or shipping address (street, house number, postcode, city, province, country)
- Phone number
- Email address
- Additional order notes (optional)
For commission requests or general contact inquiries, the following data is collected:
- First name and last name
- Email address
- Free-text message sent via the contact form
2.2 Automatically collected data
Like most websites, the Website automatically collects certain technical information through the use of cookies and similar technologies, including:
- IP address
- Browser type and operating system
- Pages visited and duration of visit
- Referring website address (referrer)
For more information about the cookies used, please see our Cookie Policy.
3. Purposes and Legal Bases for Processing
| Purpose | Legal basis |
|---|---|
| Order management (purchase, payment, shipping) | Performance of a contract (Art. 6.1.b GDPR) |
| Compliance with fiscal and accounting obligations | Legal obligation (Art. 6.1.c GDPR) |
| Responding to contact requests and commissions | Legitimate interest / pre-contractual measures (Art. 6.1.b-f GDPR) |
| Technical operation of the Website (technical cookies) | Legitimate interest (Art. 6.1.f GDPR) |
| Anonymous statistical analysis of Website usage | Legitimate interest (Art. 6.1.f GDPR) |
| Promotional communications or newsletter | Explicit consent (Art. 6.1.a GDPR) — not currently active |
4. Payment Methods
The Website currently accepts payments by bank transfer (wire transfer). In this case, the Data Controller’s bank details are communicated to the buyer in the order confirmation email. The Data Controller does not collect or store the buyer’s banking data.
Additional payment methods may be integrated in the future (such as PayPal and SumUp). These services will operate as independent data controllers or processors: payment will be handled directly on their secure platforms. We recommend reviewing their respective privacy policies before proceeding with payment:
5. Recipients of Data
Personal data may be shared, to the extent strictly necessary, with the following categories of recipients:
- Technical service providers: hosting provider (Website server), WordPress/WooCommerce platform manager
- Shipping services: couriers or postal services used to deliver purchased artworks
- Payment platforms: where applicable (PayPal, SumUp)
- Competent authorities: where required by law or by order of the authorities
Data is not sold, assigned or shared with third parties for commercial or marketing purposes.
6. International Data Transfers
Some technical service providers (e.g. hosting servers, payment platforms) may process data in countries outside the European Economic Area (EEA). In such cases, the transfer takes place in compliance with the guarantees provided by Articles 44–49 of the GDPR (e.g. Standard Contractual Clauses approved by the European Commission).
7. Data Retention
Personal data is retained for the period strictly necessary for the purposes for which it was collected:
- Order data: retained for 10 years from the completion of the purchase, in compliance with Italian fiscal and accounting obligations
- Contact and commission data: retained for the time necessary to handle the request and, thereafter, for a maximum of 12 months unless otherwise agreed
- Technical browsing data: retained for the period indicated in the Cookie Policy
8. Data Subject Rights
Under Articles 15–22 of the GDPR, you have the right to:
- Access your personal data processed by the Data Controller (Art. 15)
- Rectify inaccurate or incomplete data (Art. 16)
- Obtain erasure (“right to be forgotten”) of your data, where applicable (Art. 17)
- Restrict processing in certain circumstances (Art. 18)
- Receive your data in a structured format (data portability, Art. 20)
- Object to processing on legitimate grounds (Art. 21)
- Withdraw consent at any time, without prejudice to the lawfulness of prior processing
To exercise your rights, please send a request to: maurizia_bonvini@hotmail.com. Requests will be handled within 30 days.
Right to lodge a complaint
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it, or with the supervisory authority of your country of residence within the EU.
9. Minors
The Website is not intended for persons under the age of 18. The Data Controller does not knowingly collect personal data from minors. Should the Data Controller become aware that data has been inadvertently collected from minors, it will be promptly deleted.
10. Data Security
The Data Controller adopts appropriate technical and organisational measures to protect personal data from unauthorised access, loss, disclosure or destruction. The Website is protected by an encrypted connection (HTTPS/SSL).
11. Changes to this Policy
The Data Controller reserves the right to modify this Privacy Policy at any time, particularly in the event of regulatory changes or the introduction of new services (e.g. new payment methods). Changes will be published on this page with an updated date. In case of material changes, registered users will be notified.
Date of issue: June 2026 — Compliant with EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.