Privacy policy
How we handle your data
Updated 16 September 2026. It applies to gardenmac.com in every language, to the checkout, to the emails we send you and to our support channels: phone, WhatsApp and email. It is written under Regulation (EU) 2016/679 (GDPR) and the Italian Privacy Code (Legislative Decree 196/2003).
Who the controller is
Furioso Group S.r.l.s., trading as GARDENMAC.
Registered office: Via Civitas Castelromano 11, 86170 Isernia (IS), Italy.
Logistics hub: Via Saccucci 5, 86090 Pesche (IS), Italy.
VAT number and tax code 01021630940 · REA IS-220132 · Certified email (PEC) furiosogroup@pecimprese.it.
For any question about your data write to assistenza@gardenmac.com, call +39 0865 860247 or message us on WhatsApp at +39 377 085 9705. We are not required to appoint a Data Protection Officer (DPO) and have not appointed one.
What data we collect
- Contact and identity details: first and last name, shipping and billing address, email, phone; if you ask for an invoice, also VAT number, tax code, SDI code or certified email.
- Orders and payments: what you bought, when, at what price and with which method. Card numbers never pass through our systems: they are handled by Shopify Payments, PayPal, Klarna and Scalapay. For cash on delivery we only receive the delivery address and the phone number for the confirmation call.
- Communications with us: emails, WhatsApp messages, the forms on the site (contact, withdrawal, newsletter) and phone calls. Calls to +39 0865 860247 are handled by an automated voice assistant and are recorded and transcribed: we tell you at the start of the call. If you prefer not to be recorded, write to us on WhatsApp or by email.
- Browsing data: IP address, device and browser type, pages viewed, products added to the cart, where the visit came from. They come from the cookies and tools described in the Cookie policy.
- Reviews: the name, text, photos and videos you send us through Loox, published on the site with your consent.
- Contact requests from campaigns: if you leave your name and phone number in a form on Facebook, Instagram, TikTok or Google asking for advice, we receive that data to call you back.
The site is not intended for children under 16 and we do not knowingly collect their data.
Why we use it and on what basis
| Purpose | Legal basis | For how long |
|---|---|---|
| Selling and delivering: order, payment, shipping, order status notifications | Performance of the contract | 10 years from the order (tax obligation) |
| Invoicing and complying with tax and accounting obligations | Legal obligation | 10 years |
| Support, warranty, returns and withdrawal, repairs | Performance of the contract and legitimate interest in documenting requests | 10 years from the last service |
| Answering people who ask for advice or a quote, including calling them back by phone or WhatsApp | Pre-contractual steps taken at your request | 24 months from the last contact if you do not buy |
| Recording and transcribing calls to the voice assistant, to handle the request and improve the service | Consent, given by continuing the call after the notice | 12 months |
| Newsletter, emails, SMS and WhatsApp messages with offers, guides and news | Consent, which you can withdraw at any time | Until withdrawal |
| Personalised advertising on Meta, Google and TikTok and campaign measurement | Consent given through the cookie banner | See Cookie policy |
| Statistics on how the site is used | Consent given through the cookie banner | See Cookie policy |
| Asking for and publishing a review after a purchase | Legitimate interest for the invitation; consent for publication | As long as the review stays published |
| Preventing fraud and abuse, defending our rights | Legitimate interest | For as long as a dispute may arise |
If you subscribed to the newsletter but do not buy, you can unsubscribe with the link at the bottom of every email. Order communications (confirmation, shipping, delivery) are sent anyway, because they are needed for the contract.
Who processes data on our behalf
We do not sell your data. We only entrust it to providers working on our behalf, under a contract that binds them to use it solely for the service they provide to us.
Store and payments
Shopify (Shopify International Ltd, Ireland) hosts the site, the checkout, orders and customers; our data is stored in the European Union. Payments go through Shopify Payments, PayPal, Klarna and Scalapay; the cash-on-delivery form is by Releasit. Receipts are printed by Order Printer Pro.
Shipping
Name, address and phone go to the courier that delivers, usually GLS (in some cases SDA, BRT or Poste Italiane). We prepare the shipping labels with Sell&Send (a Qapla' platform) and with Paccofacile, which receive the same data.
Support and advice
The voice assistant on +39 0865 860247 runs on ElevenLabs, which stores recordings and transcripts on our behalf. Requests and appointments are managed in an internal CRM on Airtable and Google Workspace (Gmail and Sheets). The WhatsApp channel is also handled on our behalf by an external contractor, appointed as processor, who only sees the conversations they follow. The chat on the site is Shopify Inbox: the messages you send from it, with your email address if you leave one, reach us through Shopify.
Email, messages and reviews
Newsletters, emails and SMS are sent from Klaviyo; WhatsApp messages are sent from our business number with WhatsApp Business (Meta). Review requests and reviews go through Loox; our business profile on Trustpilot may invite you to leave a rating.
Advertising and statistics
Meta (Facebook, Instagram), Google (Ads, Analytics, YouTube) and TikTok receive browsing and purchase data to measure campaigns and show you relevant ads. The transmission follows your choice on the cookie banner, except for the tools listed in the Cookie policy under «Tools that do not go through the banner», which start before your choice.
Marketplaces and advisers
If you buy on eBay, the order and your details reach Shopify through the sync app (Digital Product Labs) so that we can fulfil it. Our accountant receives billing data for tax compliance. Authorities receive data only when the law requires it.
Shopify as an independent controller. For some advanced features (fraud protection, Shop, personalised advertising across the Shopify network of stores) Shopify uses the data collected in our store together with data from other stores, as an independent controller. How it does so and how to exercise your rights towards Shopify is explained in the Shopify Consumer Privacy Policy and in the Shopify Privacy Portal.
Transfers outside the European Union
Some providers are based or keep servers in the United States or in other countries outside the European Economic Area: among them Meta, Google, TikTok, Klaviyo, ElevenLabs, Airtable and Google Workspace. Transfers are made to companies certified under the EU-US Data Privacy Framework or under the European Commission's Standard Contractual Clauses with the required additional safeguards. You can ask for a copy of the safeguards applied by writing to assistenza@gardenmac.com.
Your rights
At any time you can ask us to:
- access the data we hold about you and receive a copy;
- correct it if it is wrong or incomplete;
- erase it, except what the law requires us to keep (for example invoices);
- restrict its use or object to processing based on legitimate interest;
- port it to another provider in a readable format;
- withdraw consent to marketing or cookies: withdrawal does not affect what was done before.
An email to assistenza@gardenmac.com is enough: we reply within 30 days and, if needed, ask you to confirm your identity. For the newsletter use the unsubscribe link at the bottom of every email; for cookies the Manage cookie preferences button. If you believe we have not respected your rights you can contact the Italian Garante per la protezione dei dati personali or the supervisory authority of the country where you live.
Security
The site runs over an encrypted connection (HTTPS), payments are handled by PCI-DSS certified operators and access to data is limited to the people who need it for their work, with personal accounts and two-factor authentication. No system is one hundred per cent secure: if you suspect your account has been used by someone else, write to us immediately.
Cookies
Which cookies and tracking tools the site uses, what they are for and how to change your mind is explained in the Cookie policy. Choices are made in the banner shown on your first visit and can be changed at any time from Manage cookie preferences.
Changes
If we change tools or purposes we update this page and the date at the top. For changes that really matter we also tell you by email, if you are a customer.
Want to exercise a right or have a question?
Or call +39 0865 860247 or message us on WhatsApp at +39 377 085 9705.