Last updated: August 17, 2026
This Privacy Policy describes how personal data is collected and processed when you visit www.ceciliamatteoli.com (the "Website") and how you can exercise your rights under Regulation (EU) 2016/679 ("GDPR").
1. Data Controller
The data controller is Cecilia Matteoli.
For any question regarding this policy or your personal data, you can write to: info@ceciliamatteoli.com
2. Data We Collect
a) Data you provide through the contact form. When you use the contact form, we collect your name, your email address and the content of your message. Providing this data is voluntary, but necessary to respond to your inquiry.
b) Data you provide when placing an order. If you buy something in the Shop, we collect the data needed to process and ship your order: your name, shipping address, email address and telephone number, together with the details of the items ordered, the shipping option chosen and the PayPal transaction reference. Providing this data is necessary to conclude and fulfil the purchase. Payment card details are handled directly by PayPal and are never received or stored by this Website.
c) Technical and browsing data. Like most websites, the hosting server may automatically record technical information such as IP addresses, browser type, date and time of the request. This data is used exclusively to ensure the correct operation and security of the Website and is not used to identify visitors.
The Website does not use profiling tools or advertising trackers. It uses technical cookies, and — only if you accept the cookie banner — Google Analytics 4 to understand overall site traffic. For more details please see the Cookies Policy.
3. Purposes and Legal Basis of Processing
Data submitted through the contact form is processed in order to respond to your messages and inquiries; the legal basis is the execution of pre-contractual measures taken at your request and the legitimate interest of the controller in replying to communications received (Art. 6(1)(b) and (f) GDPR).
Order data is processed in order to conclude and perform the contract of sale, to ship the items and to handle any subsequent request such as a return or a withdrawal; the legal basis is the performance of a contract to which you are a party (Art. 6(1)(b) GDPR). Where the data must also be kept to comply with accounting or tax obligations, the legal basis is compliance with a legal obligation (Art. 6(1)(c) GDPR).
Technical browsing data is processed on the basis of the legitimate interest of the controller in guaranteeing the security and proper functioning of the Website (Art. 6(1)(f) GDPR).
4. Third-Party Services
Google Analytics 4 — only with your consent. If you accept the cookie banner shown on your first visit, we use Google Analytics 4, provided by Google Ireland Ltd., to understand overall Website traffic (pages viewed, traffic sources). This is never activated before you make a choice, and never activated if you decline. You can change your choice at any time via the "Cookie preferences" link in the footer. See the Google Privacy Policy.
Google reCAPTCHA. The contact form is protected by Google reCAPTCHA, a service provided by Google Ireland Ltd. that helps distinguish real visitors from automated bots. To perform this check, reCAPTCHA may collect technical information about your device and browsing behaviour. The use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.
Google Fonts. The Website uses fonts served by Google Fonts. When loading the pages, your browser connects to Google servers, which may process your IP address. Further information is available in the Google Privacy Policy.
PayPal. Orders placed in the Shop are paid through PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.). When you pay, you are redirected to a window managed by PayPal: your card or account credentials are entered there and are never received or stored by this Website. PayPal acts as an independent controller for the payment transaction and communicates back to the Website only the data needed to confirm and fulfil the order. See the PayPal Privacy Statement.
External links. The Website contains links to external platforms such as Instagram. This policy does not apply to those services: when you visit them, the privacy policies of the respective providers apply.
5. Data Retention
Messages received through the contact form and the related data are kept only for the time necessary to handle the request and any follow-up correspondence, after which they are deleted, unless a longer retention is required to comply with legal obligations or to establish, exercise or defend legal claims.
Order data is kept for the time necessary to fulfil the order and to handle returns, withdrawals and warranty claims, and thereafter for as long as required by the applicable accounting and tax rules.
6. Data Sharing
Personal data is not sold or shared with third parties for marketing purposes. Data may be processed by technical providers acting on behalf of the controller (such as the hosting provider and the email service provider) or disclosed where required by law. In addition, the data strictly necessary to complete a purchase is exchanged with PayPal as the payment provider, and the delivery details are passed to the postal or courier service used to ship the order.
7. Your Rights
Under the GDPR you have the right to access your personal data, obtain its rectification or erasure, restrict or object to its processing, and receive your data in a portable format. You may exercise these rights at any time by writing to info@ceciliamatteoli.com. You also have the right to lodge a complaint with your competent data protection supervisory authority.
8. Security
Appropriate technical and organisational measures are adopted to protect personal data against unauthorised access, loss or disclosure.
9. Changes to this Policy
This Privacy Policy may be updated from time to time. Any changes will be published on this page with the updated revision date.