Privacy Notice

1. Data controller

The data controller is Guardarian S.r.l., with its registered office in Italy, VAT number IT12345678901. For any privacy-related matter you may write to info@guardarian.com.

2. Data we collect

We process only the data strictly necessary to complete the requested transaction:

• Identifying data: cardholder first name and surname, email address, country of residence.
• Payment data: card number, expiry date and CVC code. This data is transmitted over TLS 1.3 encryption to our payment services provider and is never stored in plain text on our servers.
• Technical data: IP address, browser user-agent and the timestamp of the operation, retained solely for security and fraud prevention purposes.

We do not collect special categories of data (ethnic origin, political opinions, health data, etc.) and we do not use automated profiling that produces legal effects.

3. Purposes and legal bases

Your data is used exclusively for the following purposes:

• Performance of the contract (Art. 6.1.b GDPR): processing the payment and providing you with the receipt.
• Legal obligation (Art. 6.1.c GDPR): retention of accounting and tax records in accordance with current legislation.
• Legitimate interest (Art. 6.1.f GDPR): prevention of fraud, cyberattacks and misuse of the service.

4. What we do NOT do with your data

We want to be explicit on this point, because it is what really matters:

• We do not sell your personal data to anyone. Ever. For any amount.
• We do not transfer it to marketing companies, data brokers, advertising networks or commercial third parties.
• We do not use it to send you advertising, unsolicited newsletters or promotional communications of any kind.
• We do not transfer it outside the European Economic Area, unless the destination country benefits from an adequacy decision of the European Commission.
• We do not share it with social networks. There are no Meta, TikTok or similar tracking pixels on the payment page.

5. To whom your data may be disclosed

Your data is accessible only to carefully selected parties bound by a data processor appointment agreement (Art. 28 GDPR):

• the payment services provider authorised by the European Central Bank, solely for the execution of the transaction;
• the cloud hosting provider (Vercel Inc.) and the in-memory database provider (Upstash Inc.), both GDPR-compliant with primary servers located in the European Union;
• the judicial and public security authorities, exclusively in the event of a duly substantiated formal request.

6. How long we retain your data

We apply the principle of data minimisation: data is retained only for as long as necessary.

• Payment data: automatically deleted once the transaction is complete and in any event no later than 31 days.
• Transaction data: retained for 10 years pursuant to tax law (Presidential Decree 600/1973).
• Security logs: 12 months, then automatically deleted.

7. Your rights

At any time you may exercise the following rights by writing to info@guardarian.com:

• access to your data (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16);
• erasure, also known as the "right to be forgotten" (Art. 17);
• restriction of processing (Art. 18);
• portability in a structured, machine-readable format (Art. 20);
• objection to processing (Art. 21);
• complaint to the Data Protection Authority (garanteprivacy.it).

We will reply within 30 days as required by law, free of charge and without asking you for any justification.

8. Security measures

We adopt technical and organisational measures appropriate to the risk (Art. 32 GDPR), including end-to-end TLS 1.3 encryption of all communications, bcrypt hashing of administrative credentials, mandatory two-factor authentication for system access, rate limiting, intrusion detection and audit logs.

9. Changes

We reserve the right to update this notice to reflect legislative or operational changes. The version currently in force is always the one published on this page, with the date of the latest update shown at the top.