Information on the processing of personal data
Under Regulation (EU) 2016/679 ("GDPR"), this page describes how the personal data of users of www.tatta-shop.it is processed.
Data controller
Tatta Media Group S.r.l.
VAT number: 10484161210
Registered office: Via Campana 185, 80078 Pozzuoli (NA), Italy
Privacy contact: hello@tatta-shop.it
What data we process
- Account and order data: name, email, addresses, phone number, purchase history — provided by you when registering or making a purchase.
- Payment data: handled directly by our payment providers (Stripe, PayPal, Klarna); the shop does not store card numbers.
- Data for personalised products: text, names or images you send us for personalisation.
- Browsing and cookie data: see our Cookie Policy.
- Communications: requests sent via contact forms, reviews, newsletter sign-ups.
- Chats with our virtual assistant: messages exchanged with our AI assistant are stored to improve the service and manage any orders started via chat; please do not enter payment details in chat.
Why we process it (purposes and legal bases)
- Performance of a contract: managing accounts, orders, shipping, returns and customer support (Art. 6.1.b GDPR).
- Legal obligations: invoicing and tax/accounting requirements (Art. 6.1.c).
- Consent: sending the newsletter, publishing reviews, marketing and statistical cookies (Art. 6.1.a). Consent can always be withdrawn.
- Legitimate interest: website security, fraud prevention, reminders about uncompleted carts for registered customers (Art. 6.1.f).
Who may receive your data
Data may be processed by providers acting on our behalf: website hosting, couriers for shipping, Brevo (email delivery), Stripe, PayPal and Klarna (payments), Meta Platforms and Google (marketing and statistical cookies, subject to prior consent). Some providers may process data outside the European Economic Area: in such cases, the transfer takes place on the basis of adequate safeguards (European Commission's standard contractual clauses).
How long we keep it
Order and invoicing data: 10 years (legal requirements). Accounts: until deletion is requested. Newsletter: until you unsubscribe. Contact requests: for as long as needed to handle them.
Your rights
You may exercise, at any time, the rights set out in Articles 15-22 of the GDPR: access, rectification, erasure, restriction, portability, objection and withdrawal of consent. If you have an account, in the "GDPR - Personal Data" section of your profile you can download your data or request its deletion. Alternatively, you can write to the contact address shown above. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
Last updated: September 2026.