Privacy Policy

Privacy Policy

Last updated: August 8, 2026

This Privacy Policy describes how Il mondo di Wit by Andreas Cattelan collects, uses, stores, and protects the personal data of users who visit the website ilmondodiwit.com, make purchases, use a customer account, subscribe to the newsletter, post reviews, contact us, or otherwise interact with the services available on the site.

The processing of personal data is carried out in compliance with Regulation (EU) 2016/679 (“GDPR”), Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, and other applicable provisions regarding the protection of personal data and electronic communications.


1. Data Controller

The Data Controller is:

Il mondo di Wit by Andreas Cattelan
Sole proprietorship
Via Zara 5
57033 Marciana Marina (LI)
Italy

VAT number: 01002090452
Email: info@ilmondodiwit.com
Email for privacy requests: admin@ilmondodiwit.com
Phone: +39 334 944 2589

You can also use the tools available in the Privacy section permanently located in the footer of the site to manage cookie preferences and, where applicable, submit requests related to your personal data.


2. What personal data we process

Depending on how the user uses the site, we may process different categories of personal data.

Identification and contact data

We may process name, surname, email address, phone number, shipping address, billing address, and any necessary tax data.

Order and purchase data

We may process information such as purchased products, quantities, amounts, order number and date, payment method, shipping information, returns, refunds, and communications related to the purchase.

Payment data

When an online payment is made, the data necessary for the transaction to be executed are also processed by the payment service provider chosen by the customer.

The Data Controller may receive information regarding the outcome of the transaction, the payment method used, the amount, and any refunds.

Complete payment card data are normally entered directly into the payment providers' systems and are not made available to the Data Controller in their complete form.

Customer account data

If customer account features are used, identification and contact data, saved addresses, order history, preferences, and information necessary for account management may be processed.

Customer communications

When the user contacts us via email, phone, WhatsApp, chat, forms on the site, or other channels, we may process contact data and the content of the communication.

Review data

When the user posts a review or a question related to a product, the displayed name, email address, rating, title, content of the review or question, and any voluntarily uploaded photos or videos may be processed.

Newsletter and marketing data

Email address, optional name, marketing preferences, subscription date and method, information necessary to document consent, and any information related to interactions with commercial communications may be processed, within the limits permitted by law.

Technical and navigation data

During the use of the site, data such as IP address, browser type, device, operating system, language, date and time of visit, pages viewed, referring URL, online identifiers, information about interactions with the site, cookies, and similar technologies may be automatically collected.


3. Purposes and legal bases of processing

Order management and contractual relationship

Data are processed to receive and confirm the order, process payment, prepare products, ship, communicate with the customer, manage returns and refunds, and provide after-sales support.

Legal basis: performance of a contract or pre-contractual measures requested by the data subject, pursuant to Art. 6, para. 1, letter b) GDPR.

Administrative, accounting, tax, and legal obligations

Data are processed to fulfill obligations under tax, accounting, commercial, and other applicable regulations.

Legal basis: compliance with a legal obligation, pursuant to Art. 6, para. 1, letter c) GDPR.

Customer support and information requests

Data are used to respond to questions, requests for information, complaints, and support requests.

The legal basis is the performance of the contract or pre-contractual measures when the request concerns a purchase and, in other cases, the legitimate interest of the Data Controller to respond to received requests and properly manage relationships with users and customers.

Security, prevention of abuse and fraud

We may process technical data and order-related information to protect the site, prevent unauthorized access, fraud, spam, abusive automated activities, and other illicit uses.

Legal basis: legitimate interest of the Data Controller, pursuant to Art. 6, para. 1, letter f) GDPR, and any applicable legal obligations.

Newsletter and commercial communications

The sending of newsletters, offers, news, promotions, and other commercial communications by electronic means is generally carried out based on the data subject's consent.

Legal basis: consent, pursuant to Art. 6, para. 1, letter a) GDPR and applicable electronic communications regulations.

Consent is optional and can be withdrawn at any time using the unsubscribe link in the communications or by contacting the Data Controller.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Communications to existing customers – similar products

In cases permitted by Art. 130, paragraph 4, of Legislative Decree 196/2003, the email address provided by the customer in the context of a sale may be used to offer similar products or services.

The customer can object to such use free of charge at any time.

Analysis, statistics, and site improvement

Analysis tools may be used to understand how the site is used, measure its performance, identify problems, and improve products, content, and services.

When such tools involve access to information stored on the user's device or tracking activities not strictly necessary, they are used only with prior consent, when required by law.

Advertising, measurement, and profiling

Subject to the user's consent, cookies, pixels, tags, and similar technologies may be used to measure advertising campaigns, attribute conversions, perform remarketing, create audiences, analyze interactions with ads and content, or display more relevant advertising.

Refusing consent does not prevent purchases or the use of essential site functionalities.


4. Cookies and similar technologies

The site uses cookies and other technologies for storing or accessing information on the user's device.

Strictly necessary cookies and technologies

They can be used without consent when necessary for the site's operation, security, shopping cart, checkout, customer accounts, session management, and storing privacy preferences.

Analytics, marketing, and other non-essential technologies

Non-strictly necessary tools are used according to the user's expressed preferences and, when required by law, exclusively after consent.

Upon first access, the user can accept, reject, or customize the use of non-essential categories.

Modification and withdrawal of preferences

Choices made through the banner can be modified later.

At any time, the user can use the links “Cookies - preferences” or “Privacy Preferences” in the footer of the site to reopen the consent management panel.

Through this panel, it is possible to consult the processing categories, view information related to cookies and other detected tools, modify preferences, or withdraw previously given consent.

Updated list of cookies

To prevent a static list from becoming incomplete or outdated, the individual cookies and tracking tools used by the site, their categories, purposes, and durations are indicated directly in the privacy preferences panel.

This panel constitutes the updated informational level regarding the cookies and tracking technologies actually used.


5. Consent management and third-party services

The site uses a third-party consent management platform specifically integrated with Shopify.

The preferences expressed by the user are communicated to the compatible systems used by the site so that non-essential technologies are managed according to the choices made.

The integration includes the Shopify Customer Privacy API and, for compatible Google services, the management of consent signals through Google Consent Mode.

Preferences can subsequently be modified or withdrawn using the tools available in the footer of the site.


6. Shopify

The online store is hosted and managed through the Shopify platform.

Shopify provides the technological infrastructure necessary for e-commerce operation and may process personal data when the user visits the site, uses the checkout, creates or uses a customer account, makes a purchase, or uses Shopify services linked to the store.

Depending on the specific activity, Shopify may act as a data processor on behalf of the Data Controller or process certain data as an independent controller within its services.

Information processed by Shopify may include identification and contact data, device and navigation information, order data, transactions, viewed or purchased products, privacy preferences, and information related to interactions with the store and Shopify services.

For more information: Shopify's Consumer Privacy Policy.


7. Shopify Network Intelligence and Enhanced Services

The Shopify Network Intelligence feature is enabled for this store.

When this feature is active, Shopify may securely use data from customer interactions with this store along with data from interactions with Shopify and other Shopify merchants to power features referred to by Shopify as Enhanced Services.

These services can be used, among other things, to:

  • provide more personalized experiences;
  • improve store products, services, and performance;
  • understand how users interact with the store and advertising campaigns;
  • improve security and fraud prevention;
  • make certain communications or advertising more relevant, when the user has given the required consent.

As part of these services, information about the user's activity on our store may be shared with Shopify and other providers involved in providing the services, including in countries other than the user's location.

For users subject to EEA, UK, or Swiss regulations, non-essential activities that require consent, including certain forms of personalization or advertising based on user activity at this store, other merchants, or Shopify, are subject to the preferences expressed through the consent management system.

The third-party banner used by the site is integrated with the Shopify Customer Privacy API.

When the user does not consent to the use of non-essential technologies, the relevant preferences are communicated to Shopify and the device data from the site are managed by Shopify Network Intelligence in accordance with these choices for non-essential purposes.

When a request for personal data deletion related to the store is granted, Shopify also provides mechanisms to propagate the deletion to affected data within Shopify Network Intelligence, where applicable.

Shopify also offers its own Privacy Portal through which data subjects can directly exercise applicable rights against Shopify.

Shopify Consumer Privacy Policy
Shopify Privacy Portal


8. Payments

During checkout, various payment methods may be made available through Shopify and/or external payment providers.

The actual methods available may vary depending on the country, device, amount, currency, and current store configuration.

These may include, among others, Shopify Payments and its managed payment methods, credit or debit cards, PayPal, Shop Pay, Amazon Pay, Apple Pay, Google Pay, Satispay, and other tools displayed during checkout.

The chosen provider receives the data necessary to authorize, execute, and secure the transaction and to fulfill its regulatory obligations.

Some payment providers act as independent data controllers for their respective activities. In such cases, their respective privacy policies also apply.

The Data Controller usually does not store the full payment card number.


9. Shipping, couriers, and logistics operators

To deliver orders, strictly necessary data may be communicated to couriers, postal operators, logistics companies, and platforms used to organize shipments.

Data may include the recipient's name and surname, delivery address, phone number, email address, and other information necessary for proper shipment management.

Operators used may include, depending on the destination and service chosen, Poste Italiane, SDA, BRT, UPS, and other carriers that may be used for specific shipments.

Packlink

For some shipments, Packlink, managed by Auctane S.L.U., may be used as an intermediary platform to compare, purchase, and manage shipping services.

When Packlink is used, the data necessary for shipping may be transmitted to the platform and, through it, to the carrier responsible for delivery.

Packlink Privacy and Cookie Policy

SpedirePro by Alsendo

For some shipments, the platform SpedirePro by Alsendo may be used to organize and manage the transport service.

When this service is used, the data necessary for shipping may be transmitted to the platform and to the carrier actually responsible for delivery.

SpedirePro Privacy Policy

International shipments

For shipments to non-EU countries, some data may also be communicated, when necessary, to logistics operators, customs intermediaries, customs authorities, or other public authorities.

Legal basis: performance of the contract and, where applicable, compliance with legal obligations.


10. Reviews – Judge.me

The site uses Judge.me to collect, manage, verify, and publish reviews and questions related to products and the shopping experience.

When the user submits a review, the following may be processed, depending on the information provided:

  • name or display name;
  • email address;
  • rating;
  • review title;
  • review text;
  • any uploaded photos or videos;
  • information necessary to verify that the review is linked to a purchase;
  • technical data necessary for the operation and security of the service.

The display name, rating, review text, and any multimedia content may be published on the site.

The email address is not normally shown publicly as part of the review.

Judge.me Privacy Policy


11. hCaptcha

Some forms or functions of the site may be protected by hCaptcha, a service provided by Intuition Machines, Inc.

hCaptcha is used to verify that certain actions are performed by real people and to protect the site from spam, bots, fraud, and other abusive activities.

To perform this verification, technical data and information related to interaction with the site may be analyzed, such as IP address, device, browser, visit duration, movements, or other technical information necessary for the security assessment.

Legal basis: the Controller's legitimate interest in site security, fraud prevention, and protection from abusive automated activities, pursuant to Art. 6, para. 1, letter f) GDPR.

hCaptcha Privacy Policy


12. Newsletter

Users can voluntarily subscribe to the site's newsletter.

Data is used to send information about products, news, promotions, initiatives, and other commercial communications in accordance with expressed preferences.

Subscription is optional and not a necessary condition for making purchases.

Each commercial communication sent via email contains a system that allows unsubscribing.

It is also possible to withdraw consent by contacting the Controller.


13. Analytics and Advertising Services

With consent, where required, the site may use analytics, measurement, and advertising services provided by third parties.

The actual providers used and associated tracking tools are indicated in the Cookies - preferences panel.

These tools may process information related to the device, IP address, online identifiers, pages and products viewed, actions performed on the site, purchases, and interactions with advertising campaigns.

The use of non-essential tools is subject to the preferences expressed by the user.

For compatible Google services, consent signals are also managed through Google Consent Mode.


14. WhatsApp, Social Networks, and External Services

When the user voluntarily chooses to contact us via WhatsApp, social networks, or other messaging services, the data necessary for communication is also processed by the respective service provider according to its privacy policy.

The Controller uses the received data to respond to requests, provide assistance, and, when necessary, manage the contractual relationship with the customer.

The site may also contain links to third-party sites or services.

When the user decides to access these external services, the privacy policies of the respective providers also apply.


15. Data Recipients

Personal data may be communicated, to the extent necessary for their respective functions, to categories of subjects such as:

  • Shopify and related providers;
  • payment service providers and financial institutions;
  • couriers and logistics operators;
  • Packlink;
  • SpedirePro by Alsendo;
  • Judge.me;
  • hCaptcha;
  • IT, hosting, and security service providers;
  • email and newsletter service providers;
  • analytics and advertising tool providers, with consent when required;
  • accountants, consultants, and other professionals;
  • tax, judicial, administrative, or customs authorities in cases provided by law.

When a provider processes personal data on behalf of the Controller, the related relationship is governed in accordance with Art. 28 GDPR where applicable.

Some providers may instead act as independent data controllers for certain activities.

Personal data will not be disseminated unless required by law or resulting from an explicit choice of the data subject, for example in the case of publishing a review.


16. International Data Transfers

Some providers used by the site may have offices, affiliated companies, or infrastructures located outside the European Economic Area.

When personal data is transferred to third countries, processing takes place in compliance with Articles 44 et seq. of the GDPR using, as appropriate, European Commission adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, Data Privacy Framework when applicable, or other instruments and safeguards recognized by law.

Shopify operates internationally and may also process personal data in Canada, the United States, and other countries according to the safeguards described in its privacy policies and data processing agreements.


17. Retention Period

Data is retained only for the time necessary for the purposes for which it was collected, without prejudice to legal obligations and the need to ascertain, exercise, or defend a right.

Orders and administrative and tax documentation

Data subject to accounting and tax retention obligations are retained for the period provided by applicable law, normally 10 years for documentation subject to this obligation.

Customer account

Data is retained for the period of account usage and, subsequently, for as long as necessary to fulfill legal obligations and protect the Controller's rights.

Requests and assistance

Communications are retained for the time necessary to manage the request and subsequently, where necessary, to document the relationship with the customer or protect a right.

Newsletter and marketing

Data is processed until consent is withdrawn, the data subject objects, or until it is no longer necessary or appropriate to retain it for the relevant purpose, without prejudice to the minimum information necessary to document consent, withdrawal, or objection.

Reviews

Reviews and related data are retained for the period necessary for the management and publication of the review, unless a request for deletion is applicable and without prejudice to any obligations or legitimate interests for retention.

Cookies and tracking tools

The durations of individual tools are indicated in the Cookies - preferences panel.


18. Mandatory or Optional Nature of Provision

The provision of data necessary for order management, payment, invoicing, and shipping is necessary to conclude and execute the contract.

Without such data, it may not be possible to complete the purchase.

The provision of data for newsletters, marketing, personalized advertising, non-essential analytics, and profiling is optional.

Refusal or withdrawal of consent for these purposes does not prevent purchases or the use of essential site features.


19. Data Subject's Rights

In the cases provided for by Articles 15-22 GDPR, the data subject may exercise their rights and in particular may request:

  • confirmation of the existence or otherwise of personal data concerning them;
  • access to their personal data;
  • rectification of inaccurate data;
  • integration of incomplete data;
  • erasure of data in the cases provided;
  • restriction of processing;
  • data portability when applicable;
  • objection to processing;
  • withdrawal of consent at any time;
  • information relating to any automated decision-making processes in cases provided for by law.

The data subject always has the right to object to the processing of their data for direct marketing purposes.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Requests can be sent to:

admin@ilmondodiwit.com

or through the GDPR Privacy Requests tools available in the Privacy section of the site footer.


20. Rights and Preferences relating to Shopify

For activities where Shopify acts directly as a data controller, the data subject may have additional rights vis-à-vis Shopify.

Through the Shopify Privacy Portal, it is possible to check the options available for access, erasure, objection and, where provided, refusal of the use or sharing of data for activity-based advertising with different merchants.

Access the Shopify Privacy Portal

These rights are in addition to the rights that the user can exercise directly against Il mondo di Wit.


21. Rights relating to cookies and tracking

To modify only cookie preferences, it is not necessary to send a request via email.

The user can always use Cookies - preferences or Privacy Preferences in the footer.

Updated preferences replace those previously expressed for the affected browser or device according to the technical functioning of the consent management system.


22. Rights for users from other countries

Depending on the country or state of residence, the user may have additional privacy rights.

For users subject to applicable US regulations, for example, rights relating to the sale or sharing of personal data and targeted advertising may be provided.

For such requests, the US Privacy Requests tools available in the Privacy section of the footer can be used.

For users subject to Canadian law, additional rights may be available through the Canadian Privacy Rights section.

The existence and extent of these rights depend on the legislation applicable to the individual data subject.


23. Right to lodge a complaint

The data subject who believes that the processing of their personal data violates the GDPR can lodge a complaint with the competent supervisory authority.

For Italy, the competent authority is the:

Garante per la protezione dei dati personali
www.garanteprivacy.it

The data subject's right to appeal to the judicial authority remains unaffected.


24. Automated decisions

The Controller does not directly adopt decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them, unless this is provided for and permitted by law.

Some technological, payment, security, or fraud prevention providers may use automated systems to assess risk, detect fraud, or protect transactions according to their responsibilities and privacy policies.

Personalization and advertising activities carried out with consent do not, in themselves, involve decisions with legal effects similar to those provided for by Art. 22 GDPR.


25. Data Security

The Controller adopts technical and organizational measures appropriate to the risk to protect personal data from unauthorized access, loss, alteration, destruction, or unlawful disclosure.

Communications between the user's browser and the site are protected by encrypted HTTPS/TLS connection.

However, no computer system or method of transmission over the Internet can guarantee absolute security.


26. Minors

The site and the products sold are not specifically intended for the collection of personal data of minors.

Should the Controller become aware of having collected personal data of a minor in violation of applicable law, it will take the necessary measures for its deletion or proper management.


27. Changes to this Policy

This Privacy Policy may be updated to reflect regulatory changes, changes in processing methods, new services, new providers, or changes in the site's configuration.

The updated version will be published on this page indicating the date of the last update.

If a change involves a new activity for which the law requires consent, such consent will be requested before proceeding with the relevant processing.


28. Contacts

Il mondo di Wit by Andreas Cattelan
Via Zara 5
57033 Marciana Marina (LI)
Italy

VAT number: 01002090452
Email: info@ilmondodiwit.com
Privacy: admin@ilmondodiwit.com
Phone: +39 334 944 2589

You can also use the functions available in the Privacy section in the footer of ilmondodiwit.com.