Information on the processing of personal data
Under Regulation (EU) 2016/679 ("GDPR"), this page describes how the personal data of users of www.tatta-shop.it is processed.
Data controller
Tatta Media Group S.r.l.
VAT number: 10484161210
Registered office: Via Campana 185, 80078 Pozzuoli (NA), Italy
Privacy contact: hello@tatta-shop.it
What data we process
- Account and order data: name, email, addresses, phone number, purchase history — provided by you when registering or placing an order.
- Payment data: managed directly by our payment providers (Stripe, PayPal, Klarna); the shop does not store card numbers.
- Data for personalised products: text, names or images you send us for personalisation.
- Browsing and cookie data: see the Cookie Policy.
- Communications: requests sent via contact forms, reviews, newsletter sign-ups.
- Chat with our virtual assistant: messages exchanged with our AI assistant are stored to improve the service and to manage any orders started in chat; please do not enter payment details in the chat.
Why we process it (purposes and legal bases)
- Performance of a contract: managing accounts, orders, shipments, returns and customer support (Art. 6.1.b GDPR).
- Legal obligations: invoicing and tax/accounting compliance (Art. 6.1.c).
- Consent: sending the newsletter, publishing reviews, marketing and statistical cookies (Art. 6.1.a). Consent can always be withdrawn.
- Legitimate interest: website security, fraud prevention, reminders about abandoned carts for registered customers (Art. 6.1.f).
Emails to customers about similar products
If you make a purchase on tatta-shop.it, Tatta Media Group S.r.l. may use the email address you provided for your order to send you communications about products similar to those you have purchased (new designs, collections and Napoli Tattà® drops), no more than once a week, without asking for specific consent, as provided for by Art. 130, paragraph 4, of Italian Legislative Decree 196/2003, on the basis of our legitimate interest (Art. 6, para. 1, letter f, GDPR).
You can object at any time, free of charge and without any consequences for your order:
- at the time of purchase, by ticking the box «I do not want to receive emails about similar products»;
- later on, using the link at the bottom of every email;
- or by writing to hello@tatta-shop.it.
We keep the address for this purpose for up to 24 months from your last purchase, or until you object.
"Notify me when it's out"
If you ask to be notified when a design is released (from the shop search or the "Coming soon" page), we use your email only for this purpose, based on your consent (Art. 6, para. 1, letter a, GDPR): we first ask you to confirm it with one click, then send you a single email on the release day. We count confirmed requests to help us decide which designs to create. The newsletter is separate and only sent if you choose to sign up.
We delete unconfirmed requests after 7 days, requests that have already been notified after 30 days, and requests for designs that were never released after 12 months. You can withdraw your consent at any time by writing to hello@tatta-shop.it.
Who the data may be shared with
Your data is processed by providers working on our behalf, each only for their own service:
- Shop hosting and software: the provider that hosts the shop's server; PrestaShop SA (France), which provides the shop software, for services related to the PrestaShop account.
- Payments: Stripe Payments Europe Ltd (Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) and Klarna Bank AB (Sweden). Card details are handled by them: we never see them.
- Shipping: couriers and Poste Italiane S.p.A., to whom we pass on the recipient's name, address and phone number.
- Email: Brevo (Sendinblue SAS, France), for order emails, the newsletter, reminders and notifications. These emails may contain an invisible image that tells us whether they have been opened.
- Electronic invoices: when you request an invoice, we forward it to the Italian Revenue Agency (Agenzia delle Entrate) via the Interchange System (Sistema di Interscambio).
- Virtual assistant in the shop: the messages you type in chat are processed by an artificial intelligence model from Anthropic PBC (United States), solely to reply to you.
- Statistics and advertising, only with your consent: Google Ireland Ltd (Google Analytics 4), Meta Platforms Ireland Ltd (Meta Pixel and Conversions API, for Facebook and Instagram), TikTok Technology Limited (Ireland, TikTok Pixel) and Pinterest Europe Ltd (Ireland, Pinterest Tag). Details are in the Cookie Policy.
Some of these providers (in particular Google, Meta, TikTok, Pinterest, PayPal, Stripe and Anthropic) may also process data outside the European Economic Area, for example in the United States. In such cases, the transfer takes place on the basis of the EU–US adequacy decision (Data Privacy Framework), for companies that adhere to it, or the European Commission's standard contractual clauses. We never sell your data to anyone.
How long we keep it
Order and invoicing data: 10 years (legal obligations). Account: until deletion is requested. Newsletter: until you unsubscribe. Emails to customers about similar products: up to 24 months from your last purchase or until you object. Contact requests: for as long as needed to handle them.
Your rights
You can exercise, at any time, the rights set out in Articles 15-22 of the GDPR: access, rectification, erasure, restriction, portability, objection and withdrawal of consent. If you have an account, in the "GDPR - Personal Data" section of your profile you can download your data or request its deletion. Alternatively, write to the contact shown above. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
Last updated: October 2026.