1. Data we process
- Company and representative details: legal name, tax/VAT and registration numbers, address, country, contact name, email, phone, WhatsApp, website, business type, estimated volume and language.
- Account and security data: protected credentials, sessions, IP address or derived values, user agent, login attempts and technical logs.
- If you choose Google sign-in: the stable Google identifier, name, email and confirmation that the email is verified. We do not retain Google access or refresh tokens.
- Commercial data: selected stock, purchase mode and quantities for each lot or style, notes, references and enquiry status.
- Usage data: catalogue views and favourites linked to a random identifier only when analytics is allowed; a selection stored on the device; and any web-push subscription.
2. Purposes and legal bases
- Registration, B2B verification, accounts, enquiries and quotes: pre-contractual steps and contract (GDPR Art. 6(1)(b)).
- Website, account and infrastructure security, abuse prevention and legal defence: legitimate interests (Art. 6(1)(f)).
- Tax, accounting and authority requirements: legal obligation (Art. 6(1)(c)).
- Internal measurement of catalogue views and interest: consent (Art. 6(1)(a)), withdrawable in cookie settings.
- Web notifications: consent and browser permission, both revocable at any time.
3. Required data and sources
Required fields are needed to verify a B2B operator or answer an enquiry; without them, the requested function cannot be provided. Data usually comes from you or the company you represent. Company checks may use public registers.
4. Recipients, providers and transfers
- Authorised TRA-COM SRLS personnel and advisers bound by confidentiality.
- Cloudflare for hosting, database, files, security and application delivery.
- Google receives technical data only when you voluntarily choose Google sign-in; we request only openid, email and profile.
- Technical providers strictly needed for support, notifications and operations. Seller product images may be processed through APIMart and the configured AI provider; buyer personal data is not sent for that purpose.
- WhatsApp/Meta receives data only when you choose to open and send a message; its own terms apply.
- Where a provider processes data outside the EEA, transfers must rely on an adequacy decision or GDPR safeguards.
5. Retention
- Commercial enquiries: up to 365 days from submission, unless legal defence or law requires longer.
- Account and company profile: during the relationship and afterwards as needed for legal duties or disputes.
- Login sessions: normally 30 days; login-attempt and security records for shorter or risk-proportionate periods.
- Notifications and preferences: until withdrawal, deactivation, or deletion from the account/browser.
6. Your rights
You may request access, correction, deletion, restriction, portability or object, and may withdraw consent by contacting the privacy address. Withdrawal does not affect earlier lawful processing. You may also complain to the Italian Data Protection Authority (garanteprivacy.it).
7. Automated decisions, children and changes
We do not make decisions with legal effects based solely on automated processing. The service is for professional operators and not children. Material changes will be shown through the updated date and revised notice.
8. Payments through Stripe
When a quotation offers online payment, we use Stripe to process the payment, prevent fraud, authenticate the transaction, and manage receipts, disputes and refunds. Stripe may receive identification and contact details, billing and delivery addresses, amount, currency, order references, device data, IP address and payment-method data. Complete card details are not stored in our systems.
Processing is necessary for the contract, legal obligations and our legitimate interest in payment security and fraud prevention. Stripe can act as a processor and, for certain regulatory, security and service-improvement purposes, as an independent controller under its privacy notice. We retain payment references, outcomes, amounts, refunds and accounting records as needed for the contract and tax, accounting, anti-fraud and legal-defence duties.