Legal information
Last updated: 1 September 2026
This notice describes how NUVOLA ZERO S.R.L. processes the Personal Data of users who visit nuvolazero.it, create an account, submit enquiries, subscribe to the newsletter or purchase products and services online.
Processing is carried out in accordance with Regulation (EU) 2016/679 (“GDPR”), Italian Legislative Decree No. 196/2003 as amended, and applicable legislation on electronic communications and tracking technologies.
NUVOLA ZERO S.R.L. is the Data Controller for the processing of Personal Data for the purposes described in this notice, except where a third-party provider acts as an independent controller in connection with its own services.
The Controller has not appointed a Data Protection Officer (DPO), as there is currently no legal requirement to do so.
Depending on how the website is used, the following categories of Personal Data may be processed:
The Controller does not request special categories of data within the meaning of Article 9 GDPR through the website’s ordinary forms. Users are asked not to enter health information or other particularly sensitive data voluntarily in free-text fields unless strictly necessary for their enquiry.
| Purpose | Main data | Legal basis |
|---|---|---|
| Displaying and operating the website, security, preventing abuse and managing logs | Technical data, IP addresses, logs and device information | Controller’s legitimate interest in ensuring the security, integrity and operation of the service (Art. 6(1)(f) GDPR) |
| Responding to enquiries via forms, email or telephone | Name, surname, email, telephone and enquiry content | Pre-contractual steps requested by the data subject (Art. 6(1)(b) GDPR); for other enquiries, legitimate interest in replying (Art. 6(1)(f) GDPR) |
| Creating and managing accounts | Identification data, email, credentials and account data | Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR) |
| Managing orders, deliveries, assistance, returns, refunds and warranties | Identification and contact data, addresses, order, shipping and payment details | Performance of a contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR) |
| Tax, administrative and accounting compliance | Order, billing and payment data | Legal obligation (Art. 6(1)(c) GDPR) |
| Newsletters and commercial communications | Name, email and information potentially used for segmentation | Consent (Art. 6(1)(a) GDPR). The Controller does not automatically subscribe purchasers to the newsletter without a valid legal basis |
| Non-essential analytics, advertising measurement, remarketing, profiling and personalised advertising | Usage data, online identifiers, events, conversions and, where the relevant features are enabled, hashed first-party data | Consent expressed through the CMP (Art. 6(1)(a) GDPR), where required by applicable law |
| Managing and demonstrating privacy and cookie preferences | Consent choices, technical identifiers and information required to demonstrate consent | Legal obligation and legitimate interest in demonstrating compliance (Arts. 6(1)(c) and 6(1)(f) GDPR) |
| Establishing, exercising or defending legal claims | Data relevant to the relationship or dispute | Controller’s legitimate interest (Art. 6(1)(f) GDPR) and, where applicable, legal obligation |
The website is hosted on server infrastructure and uses technical components required to deliver pages, manage the database, maintain security and prevent unauthorised access or fraudulent activity.
Ordinary browsing may generate technical logs containing, among other things, IP address, date and time, requested resource, server response, browser, operating system and information useful for security and diagnosing technical issues.
Hosting, maintenance, systems support and infrastructure providers may process this data on behalf of the Controller to the extent necessary to deliver their services and under agreements complying with Article 28 GDPR, where applicable.
Google Tag Manager is used to manage website tags and scripts centrally. Its use is coordinated with Cookiebot and the consent settings applicable to the individual services loaded through the container.
Google Analytics 4 (“GA4”), fornito da Google Ireland Limited, è utilizzato per analizzare il traffico, comprendere l’utilizzo del sito, misurare eventi e conversioni e migliorare l’esperienza e le prestazioni del servizio.
GA4 may process usage data, device and browser information, browsing events, traffic sources, product interactions and purchases, online identifiers and other technical data. GA4 uses IP addresses during collection but does not log them in Analytics data centres.
Nuvola Zero’s GA4 property is linked to Google Ads; advertising features, Google Signals and User-ID are also enabled. These features are used within the limits of the consent preferences expressed by the User.
The Controller has set user-level and event-level data retention to 14 months; aggregated reports and information managed independently by Google may be subject to different rules.
Google Ads is used to promote Nuvola Zero products, measure campaign effectiveness, attribute conversions, build audiences and conduct remarketing and personalised advertising, subject to consent where required.
Events processed may include page or product views, additions to basket, checkout initiation, purchases and conversion values. If Enhanced Conversions or other matching features based on first-party data are enabled, Google may receive identifiers provided by the User, such as email address or telephone number, hashed before transmission in accordance with the service’s procedures and only where the applicable consent conditions are met.
Nuvola Zero also uses Google Shopping/Merchant Center to publish and promote its product catalogue. User interactions with Google services are additionally subject to Google’s terms and privacy notices.
The Controller uses Google Search Console to check the indexing, visibility and performance of the website in search results. In its normal use through property verification, the service does not require a separate profiling tool to be installed in the User’s browser and therefore does not involve specific collection of Personal Data by nuvolazero.it beyond the ordinary browsing data described in this notice.
The website uses remotely loaded Google Fonts. The User’s browser may therefore request font files from Google servers, transmitting technical information necessary to fulfil the request, including the IP address and browser-related information.
The website may include Google Maps or other Google content. Where such resources are loaded directly from Google, the User’s browser may establish connections with Google servers and transmit technical data and online identifiers, subject to the applicable consent settings.
Further information on Google services: Privacy Policy Google.
Nuvola Zero uses Meta advertising technologies, including Meta Pixel and, where configured, Conversions API (“CAPI”), to measure campaigns, attribute conversions, create audiences and carry out remarketing on Facebook and Instagram. These technologies are activated in accordance with applicable consent choices.
Events may include page and product views, searches, additions to basket, checkout initiation, purchases and conversion values, together with technical information such as IP address, browser, device and online identifiers.
Where the relevant functions are enabled, CAPI may transmit server-side events and hashed customer identifiers, including email or telephone number, to help match events and improve measurement and attribution, subject to applicable consent requirements.
Nuvola Zero may also use Meta Shop/catalogue functions to display and promote products. Interactions taking place directly on Meta platforms are subject to Meta’s own privacy terms.
Provider for the EEA: Meta Platforms Ireland Limited. Further information: Privacy Policy Meta.
Nuvola Zero uses TikTok advertising and commercial services to promote products, measure campaign performance, attribute conversions, create audiences and conduct remarketing, including through integrations and technical components supplied by third parties such as CEDCommerce.
TikTok Pixel and any server-side/API connections may process events related to browsing and the purchasing journey, such as content and product views, additions to basket, checkout initiation, registration and purchases, along with technical details including IP address, user agent, online identifiers and product and transaction parameters.
If Advanced Matching is enabled, TikTok may receive customer identifiers such as email, telephone, name, location or external IDs, hashed according to the service’s procedures, to improve measurement, attribution and audience creation.
Where a purchase or commercial interaction takes place directly through TikTok Shop, TikTok and/or its technical partner may share the data required to manage the order with Nuvola Zero for fulfilment, shipping, customer support and administrative compliance.
Main EEA provider: TikTok Technology Limited, Ireland. Further information: Privacy Policy TikTok.
Nuvola Zero uses Brevo to manage its newsletter and communications automations linked to subscription forms.
When the User consents to the newsletter, their name, email address, subscription date and source, and information necessary to manage consent and unsubscribing may be transmitted to Brevo. Depending on the features enabled, Brevo may also record message delivery and interaction information, such as opens, clicks and unsubscribes.
The legal basis for sending newsletters and promotional messages is the User’s consent. The User may withdraw it at any time using the unsubscribe link in the communications or by emailing info@nuvolazero.it.
The website does not use double opt-in as a technical subscription requirement; the Controller nevertheless retains evidence of consent obtained through the systems in use.
Provider: Brevo, Sendinblue SAS, France. Further information: Privacy Policy Brevo.
The contact form collects first name, surname, email address and telephone number, together with the content of any message sent by the User. This data is used to manage and respond to the enquiry.
The website uses Google reCAPTCHA v3 to protect contact, registration, login, checkout and newsletter forms against spam, abuse and automated submissions. reCAPTCHA may analyse technical and behavioural information required to assess the risk of a request, including IP address, browser, device, page interactions and other technical signals used by the service.
reCAPTCHA is loaded only in areas where it is needed to protect the relevant forms. Provider: Google Ireland Limited. Further information: Privacy Policy Google.
Users may create an account directly on the website. The information required for registration and authentication is processed to create the account, provide access to restricted features, display order history and simplify subsequent purchases.
The legal basis is performance of the contractual relationship and measures requested by the User. Account registration does not automatically result in subscription to commercial communications.
Passwords are managed through WordPress/WooCommerce authentication systems and are not made available in plain text to the Controller’s staff.
Nuvola Zero uses WordPress and WooCommerce to manage the catalogue, basket, checkout, customer accounts, orders, transactional communications and related e-commerce features.
At checkout, the information needed for billing and shipping is requested, including first name, surname, contact details, billing and delivery addresses, and any additional mandatory or optional information shown on the form.
Order data is used to conclude and perform the contract, manage payments and delivery, send order-status communications, provide assistance, handle returns, refunds and warranties, and comply with tax and administrative obligations.
WooCommerce is a software component installed on the website’s infrastructure. Automattic or other entities associated with WooCommerce may process data only to the extent that external functions or services actually used involve such disclosure.
Full payment-card details are neither collected nor stored by Nuvola Zero. Users enter their payment details directly within the secure environments of their selected payment service providers at checkout.
PayPal enables online payments and may process identification, contact, transaction, device, fraud-prevention and financial information in accordance with its own notice and the capacity established by its relationship with the User.
Further information: Privacy Statement PayPal.
Scalapay offers instalment payments. When a User selects Scalapay, the information needed to assess, authorise and manage the transaction is processed directly by Scalapay under its own terms.
Further information: Privacy Policy Scalapay.
For card payments, Nuvola Zero uses the IGFS® gateway provided by N&TS GROUP Networks & Transactional Systems Group S.p.A. Card data is entered and processed directly in the payment provider’s environment; Nuvola Zero receives only the information needed to establish the transaction outcome and reconcile the order.
Further information: Privacy Policy N&TS GROUP.
To deliver orders, Nuvola Zero shares with carriers and logistics platforms only the data strictly necessary for shipment, such as the recipient’s name and surname, address, email, telephone number, order reference and delivery instructions.
Services currently or progressively used may include:
Couriers may act as independent controllers for processing associated with delivery and carriers’ own obligations, while technical platforms may also act as processors on Nuvola Zero’s behalf, depending on the service actually provided.
Useful information: GLS Privacy · InPost Privacy · Sendcloud Privacy.
The website uses Smash Balloon Instagram Feed to display content published on Nuvola Zero’s Instagram profile. The plugin is configured to integrate with Cookiebot and, before consent, may operate in a restricted mode displaying locally stored content and images while avoiding third-party browser requests. After consent, additional features may involve connections to Meta services.
The website may display public reviews from Google services. Depending on the technical configuration of the widget or feed, content may be retrieved and stored locally or loaded through requests to Google services. Information published by the reviewers themselves may be displayed, including display name, profile picture, rating, date and review text.
The website includes a link enabling a conversation via WhatsApp. The presence of the link alone does not necessarily involve data transmission to WhatsApp until the User activates it. When the User opens WhatsApp or its web service, WhatsApp/Meta processes data according to its own notices.
Some fonts are loaded through Adobe Fonts using an Adobe web project. To deliver the fonts, Adobe receives technical information concerning the project and request, including the IP address required to deliver the file. Adobe states that it does not store IP addresses in connection with its Adobe Fonts service for websites and does not use cookies merely to deliver fonts.
Further information: Adobe Fonts Privacy.
Icons and graphic assets sourced from libraries such as Flaticon, when downloaded and hosted on Nuvola Zero’s server as SVG or other local files, do not cause the User’s browser to connect to the original asset provider and therefore do not, by that method of use alone, constitute separate processing of Personal Data by Flaticon.
Personal Data may be processed by authorised personnel of the Controller and disclosed, as necessary, to the following categories of recipients:
Parties processing data on Nuvola Zero’s behalf are appointed as Data Processors pursuant to Article 28 GDPR where the relevant conditions apply. An up-to-date list of processors may be requested by emailing info@nuvolazero.it.
Some providers used by Nuvola Zero belong to international groups or use infrastructure and sub-processors located outside the European Economic Area (“EEA”). This may involve the transfer of, or access to, Personal Data from third countries.
Where required by the GDPR, such transfers are based on a European Commission adequacy decision, the EU–US Data Privacy Framework for participating organisations, Standard Contractual Clauses approved by the European Commission or another valid mechanism under Articles 45–49 GDPR, accompanied by supplementary safeguards where necessary.
Further information on the mechanisms adopted by individual providers is available in their respective privacy notices or may be requested from the Controller.
Personal Data is retained no longer than is necessary for the purposes for which it is processed, without prejudice to legal obligations and the need to protect rights in legal proceedings.
| Processing | Indicative criterion / period |
|---|---|
| Technical and security logs | For as long as strictly necessary for technical and security purposes; normally no longer than 30 days, except for security incidents, investigations, legal requirements or other documented technical needs |
| Form enquiries and pre-contractual assistance | Up to 12 months after the enquiry is closed, unless further retention is required for a contract or dispute |
| Customer account | For the lifetime of the account. Following closure, data no longer needed for other purposes is erased or anonymised, while purchase information is retained for statutory periods |
| Orders, invoices, payments, returns and shipments | Generally 10 years, or another period required by applicable tax, civil and accounting laws, plus any time necessary to manage disputes |
| Newsletters and direct marketing | Until consent is withdrawn or the User objects. The Controller may periodically check whether consent remains current and erase or deactivate inactive contacts no longer needed |
| Evidence of withdrawal or objection | Minimum necessary data may be retained on a suppression list to ensure the User’s request is respected and to demonstrate compliance |
| Google Analytics 4 | 14 months for user-level and event-level data, as set by the Controller; aggregated reports are not necessarily subject to the same limit |
| Cookies and tracking technologies | According to the lifespan of each technology indicated in the Cookie Policy and CMP; consent may be withdrawn at any time |
| Cookiebot preference logs and evidence | For the period required to respect and document the User’s choices, depending on CMP configuration and accountability obligations |
In the circumstances and within the limits laid down by the GDPR, Data Subjects may exercise the following rights:
Requests may be submitted free of charge to info@nuvolazero.it. The Controller will respond without undue delay, normally within one month of the request, except where an extension is permitted by the GDPR.
For more information on the Italian authority, visit: www.garanteprivacy.it.
The Controller may update this notice to reflect regulatory, technical or organisational changes or changes to the services used.
The updated version will be published on this page with the last-updated date. Where changes substantially affect processing based on consent, the Controller will obtain fresh consent if required by applicable law.
We use Brevo as our marketing platform. By submitting this form, you agree that the personal information you provide will be transferred to Brevo for processing in accordance with Brevo’s Privacy Policy.
