Privacy policy
How we handle your data
Updated 12 October 2026. It applies to gardenmac.com in every language, to the checkout, to the emails we send you, to our support channels (phone, WhatsApp, Facebook, Instagram, email and chat) and to the internal management system in which we follow every request. It is written under Regulation (EU) 2016/679 (GDPR) and the Italian Privacy Code (Legislative Decree 196/2003).
Who the controller is
Furioso Group S.r.l.s., trading as GARDENMAC.
Registered office: Via Civitas Castelromano 11, 86170 Isernia (IS), Italy.
Logistics hub: Via Saccucci 5, 86090 Pesche (IS), Italy.
VAT number and tax code 01021630940 · REA IS-220132 · Certified email (PEC) furiosogroup@pecimprese.it.
For any question about your data write to assistenza@gardenmac.com, call +39 0865 860247 or message us on WhatsApp at +39 377 085 9705. We are not required to appoint a Data Protection Officer (DPO) and have not appointed one.
What data we collect
- Contact and identity details: first and last name, shipping and billing address, email, phone; if you ask for an invoice, also VAT number, tax code, SDI code or certified email (PEC).
- Orders and payments: what you bought, when, at what price and with which method. Card numbers never pass through our systems: they are handled by Shopify Payments, PayPal, Klarna and Scalapay. For cash on delivery we only receive the delivery address and the phone number for the confirmation call.
- Communications with us: emails, messages on WhatsApp, Facebook and Instagram, the forms on the site (contact, withdrawal, newsletter), chat conversations and phone calls, along with the photos and videos you send us for a support request. Calls to +39 0865 860247 are answered by a voice assistant based on artificial intelligence; calls are recorded and transcribed: we tell you at the start of the call. If you prefer not to be recorded, write to us on WhatsApp or by email.
- Support and sales cases: what we need to follow your request, that is the model of the tool, the fault you describe, the pickup and return addresses, quotes, our staff's notes and the status of the case.
- Browsing data: IP address, device and browser type, pages viewed, products added to the cart, where the visit came from. They come from the cookies and tools described in the Cookie policy.
- Reviews: the name, text, photos and videos you send us through Loox, published on the site with your consent.
- Contact requests from campaigns: if you leave your name and phone number in a form on Facebook, Instagram, TikTok or Google asking for advice, we receive that data to call you back.
The site is not intended for children under 16 and we do not knowingly collect their data.
Why we use it and on what basis
| Purpose | Legal basis | For how long |
|---|---|---|
| Selling and delivering: order, payment, shipping, order status notifications | Performance of the contract | 10 years from the order (tax obligation) |
| Invoicing and complying with tax and accounting obligations | Legal obligation | 10 years |
| Support, warranty, returns and withdrawal, repairs | Performance of the contract and legitimate interest in documenting requests | 10 years from the last service |
| Answering people who ask for advice or a quote, including calling them back by phone or WhatsApp | Pre-contractual steps taken at your request | 24 months from the last contact if you do not buy |
| Recording and transcribing calls to the voice assistant, to handle the request and improve the service | Consent, given by continuing the call after the notice | 12 months for the recording and the transcript; the written summary becomes part of the case and follows its retention times |
| Following every request in our internal management system: bringing together orders, messages, emails, calls and shipments in the customer record, also with the help of an artificial intelligence assistant that sorts messages and opens cases | Performance of the contract for existing customers; legitimate interest in replying quickly and not losing any request | The same retention times as the purpose the data serves: for example 10 years for orders and support, 24 months for people who contacted us without buying |
| Answering in the site chat (English, Spanish, French and Polish versions) | Pre-contractual steps taken at your request; consent, if you ask to receive our news | 12 months from the conversation; until withdrawal for the news subscription |
| Newsletter, emails, SMS and WhatsApp messages with offers, guides and news | Consent, which you can withdraw at any time | Until withdrawal |
| Personalised advertising on Meta, Google and TikTok and campaign measurement | Consent given through the cookie banner | See Cookie policy |
| Statistics on how the site is used | Consent given through the cookie banner | See Cookie policy |
| Asking for and publishing a review after a purchase | Legitimate interest for the invitation; consent for publication | As long as the review stays published |
| Preventing fraud and abuse, defending our rights | Legitimate interest | For as long as needed for the dispute |
If you subscribed to the newsletter but do not buy, you can unsubscribe with the link at the bottom of every email. Order communications (confirmation, shipping, delivery) are sent anyway, because they are needed for the contract.
When these periods expire we delete the data or make it anonymous; it disappears from the backups within 90 days.
Do you have to give us your data? To buy, receive the goods and get support we need your name, address, email and phone: without them, we cannot fulfil the order or follow up your request. Everything else, from the newsletter to reviews, is optional.
Who processes data on our behalf
We do not sell your data. We only entrust it to providers working on our behalf, under a contract that binds them to use it solely for the service they provide to us.
Store and payments
Shopify (Shopify International Ltd, Ireland) hosts the site, the checkout, orders and customers; our data is stored in the European Union. Payments go through Shopify Payments, PayPal, Klarna and Scalapay; the cash-on-delivery form is by Releasit. Receipts are printed by Order Printer Pro.
Shipping
Name, address and phone go to the courier that delivers, usually GLS (in some cases SDA, BRT or Poste Italiane). We prepare the shipping labels with Sell&Send (a Qapla' platform) and with Paccofacile, which receive the same data.
Support and advice
Our internal management system, described below, runs on a dedicated server from Hostinger (Hostinger International Ltd, Cyprus) in a data centre in Frankfurt, Germany, and to sort messages it uses the Claude artificial intelligence by Anthropic. The voice assistant on +39 0865 860247 runs on ElevenLabs, which stores recordings and transcripts on our behalf; the forms it fills in (support requests, callbacks, phone orders) go through n8n, installed on one of our Hostinger servers, and through Airtable. In the English, Spanish, French and Polish versions of the site the chat is by Jotform. Support and sales (phone, WhatsApp, Facebook and Instagram messages, email and callbacks to people who leave their details) are also handled on our behalf by an external contractor, appointed as processor, who in the management system only sees the support and sales areas, the ones needed to follow your requests.
Email, messages and reviews
Newsletters, emails and SMS are sent from Klaviyo. The @gardenmac.com mailboxes are provided by Register.it and we read them with Gmail (Google): from there a copy of support emails enters the management system. We receive and send WhatsApp messages from our business number with WhatsApp Business and its Cloud API platform (Meta), which brings them into the management system. We reply to the messages you send us on Facebook and Instagram from Meta Business Suite (Meta). Review requests and reviews go through Loox; our business profile on Trustpilot may invite you to leave a rating.
Advertising and statistics
Meta (Facebook, Instagram), Google (Ads, Analytics, YouTube) and TikTok receive browsing and purchase data to measure campaigns and show you relevant ads. The transmission follows your choice on the cookie banner, except for the tools listed in the Cookie policy under «Tools that do not go through the banner», which start before your choice.
Marketplaces and advisers
If you buy on eBay, the order and your details reach Shopify through the sync app (Digital Product Labs) so that we can fulfil it. Our accountant receives billing data for tax compliance. Authorities receive data only when the law requires it.
Shopify as an independent controller. For some advanced features (fraud protection, Shop, personalised advertising across the Shopify network of stores) Shopify uses the data collected in our store together with data from other stores, as an independent controller. How it does so and how to exercise your rights towards Shopify is explained in the Shopify Consumer Privacy Policy and in the Shopify Privacy Portal.
Where we keep your data and how we protect it
Orders, payments and customer accounts stay on Shopify; payments are handled by PCI-DSS certified operators and card numbers never reach us. To follow every request from start to finish we also use an internal management system, developed by us, which can only be opened with a personal account.
- What it contains: customers' name, phone, email and address (for businesses also the VAT number); support, shipping, sales and quote cases, with our staff's notes; the WhatsApp messages and emails you send us; the summary of calls to the voice assistant; orders, shipments and payments received. No payment card data.
- Where it is: on a dedicated server in a data centre in Frankfurt, Germany, managed by Hostinger as processor.
- Who can access it: the people who work for Gardenmac, each with their own account and with permissions limited to their own area (logistics, support, sales). The staff of a supplier that keeps goods in storage with us can only access the page for their own goods and for the shipments made on their behalf, and do not see our customers.
- How we protect it: an always encrypted connection; passwords stored only in encrypted form; two-step verification, with a code generated by an app, mandatory for every account; access blocked after repeated failed attempts; technical access to the server restricted and protected by cryptographic keys, a firewall and automatic blocking of intrusion attempts; security updates installed automatically.
- Backups: one copy every night, kept for 30 days, and a second copy off the server, on a company computer in Italy with an encrypted disk.
Where we use artificial intelligence
In three places, always as an aid to our work.
- The voice assistant on +39 0865 860247 is an artificial intelligence that runs on ElevenLabs. It takes your request (a support request, a callback, a cash-on-delivery order) and passes it on to us. The call is recorded and transcribed with your consent, which you give by continuing after the notice; if you prefer to write to a person, use WhatsApp at +39 377 085 9705 or assistenza@gardenmac.com.
- The Nico chat, in the English, Spanish, French and Polish versions of the site, is an artificial intelligence assistant on the Jotform platform, which uses models from OpenAI and Google to write its answers. It answers questions about the products and subscribes your email to our news only if you ask it to. Do not write in the chat any data that is not needed, such as documents or payment details.
- In the management system an assistant based on Anthropic's Claude reads the messages we receive (WhatsApp, emails, site forms and call summaries), links them to the right customer and opens or updates the case. It does not write to you on its own: replies to customers are always sent by a person on our staff.
None of these tools makes decisions on its own that have legal effects on you or that affect you in a similar way, such as refusing a warranty claim or a refund: those are always made by a person. Under its commercial terms, Anthropic does not use the data that passes through the management system to train its models and normally deletes it within 30 days.
Transfers outside the European Union
Some providers are based or keep servers in the United States or in other countries outside the European Economic Area: among them Meta, Google, TikTok, Klaviyo, Anthropic, ElevenLabs, Airtable and, for the chat's artificial intelligence, Jotform. Transfers are made to companies certified under the EU-US Data Privacy Framework or under the European Commission's Standard Contractual Clauses with the required additional safeguards. You can ask for a copy of the safeguards applied by writing to assistenza@gardenmac.com. The internal management system and its backups, on the other hand, stay in the European Union, in Germany and in Italy.
Your rights
At any time you can ask us to:
- access the data we hold about you and receive a copy;
- correct it if it is wrong or incomplete;
- erase it, except what the law requires us to keep (for example invoices);
- restrict its use or object to processing based on legitimate interest;
- port it to another provider in a readable format;
- withdraw consent to marketing or cookies: withdrawal does not affect what was done before.
An email to assistenza@gardenmac.com is enough: we reply within 30 days and, if needed, ask you to confirm your identity. For the newsletter use the unsubscribe link at the bottom of every email; for cookies the Manage cookie preferences button. If you believe we have not respected your rights you can contact the Italian Garante per la protezione dei dati personali or the supervisory authority of the country where you live.
If there is a data breach
No system is one hundred per cent secure. If we discover a personal data breach, for example unauthorised access, a loss or an email sent to the wrong recipient, we record it in our internal register and assess its risk. If it may result in a risk to people, we notify the Italian Garante per la protezione dei dati personali within 72 hours of becoming aware of it; if the risk to you is high, we inform you directly and without delay, explaining what happened, what we have done and what you can do.
If you suspect that your account has been used by someone else, or you receive a message in our name that seems strange to you, write to us immediately at assistenza@gardenmac.com.
Cookies
Which cookies and tracking tools the site uses, what they are for and how to change your mind is explained in the Cookie policy. Choices are made in the banner shown on your first visit and can be changed at any time from Manage cookie preferences.
Changes
If we change tools or purposes we update this page and the date at the top. For changes that really matter we also tell you by email, if you are a customer.
Want to exercise a right or have a question?
Or call +39 0865 860247 or message us on WhatsApp at +39 377 085 9705.