Home
Back to home Go to the collection

Clear information on personal data, purposes, retention and rights.

Privacy notice under the GDPR

Privacy Policy

Last updated: September 10, 2026.

This notice describes how personal data is processed when you visit the site, send a request or buy a Ceramiche Corallo product. This English translation is provided for convenience; if it differs from the Italian text, the Italian version prevails.

1. Data controller

The data controller is Rosa Corallo, trading as Ceramiche Corallo, based at Via Don Luigi Sturzo, 113, 95041 Caltagirone (CT), Italy.

2. Data processed

  • Browsing and security data: IP address, date and time, page requested, user agent, technical logs and data needed to prevent abuse.
  • Contact data: name, email, phone number and the content of messages sent through forms, email or other channels chosen by the user.
  • Order data: products, variants, quantities, delivery and billing address, notes and order status.
  • Payment data: outcome, amount and transaction identifiers. Full card details are processed by the payment service provider and are not stored by the site.
  • Cookie preferences: categories accepted or rejected and the date of the choice.
  • Conversations with the digital assistant: requests, shopping preferences and optional answers to short feedback questions given to Mora, collected in pseudonymous form in order to reply and to improve the service. We automatically filter out email addresses, phone numbers, tax codes and sequences recognizable as payment data. Even so, please do not enter payment data or sensitive information.
  • Statistical or advertising data: only after explicit consent to the corresponding category.
  • Direct marketing preferences: consent status, date, source and version of the privacy notice, for email or phone.

3. Purposes and legal bases

  • Replying to requests and preparing quotes: performance of pre-contractual measures requested by the data subject.
  • Managing orders, payments, deliveries, returns and customer support: performance of the contract.
  • Meeting administrative, tax and accounting obligations: legal obligation.
  • Protecting the site, transactions and the controller's rights: legitimate interest in security and legal defense.
  • Providing the digital assistant requested by the user, suggesting products that match the preferences expressed and analyzing requests in pseudonymous form to improve the service: performance of pre-contractual measures requested by the data subject and legitimate interest in improving the service and keeping it secure.
  • Measuring traffic with Google Analytics 4: optional consent to the “analytics” category.
  • Activating Google Tag Manager, Google Ads or Meta Pixel: optional consent to the “marketing” category.
  • Sending news about collections and commercial offers to the contact details provided, if requested through a separate choice: optional consent of the data subject.

Consent can be withdrawn at any time, without affecting the lawfulness of processing already carried out.

4. Provision of data

Data marked as required in forms is needed to answer your request or complete the order. If it is not provided, we may be unable to provide the service. Analytics and marketing consents, including those for direct marketing communications, are always optional, and refusing them does not restrict purchasing or essential browsing.

5. Recipients and providers

Data may be disclosed, to the extent necessary, to:

  • hosting, maintenance, security and email providers;
  • Stripe or another payment service provider selected at checkout;
  • couriers, freight forwarders and other parties involved in delivery;
  • administrative, tax or legal advisors;
  • Google and Meta, only after the relevant consent and according to the active configuration.
  • OpenAI, as the technology provider of the digital assistant, limited to the text needed to generate the reply.

Providers process data as processors, independent controllers or authorized persons, according to the role assigned to them by law.

6. Transfers outside the European Economic Area

Some technology providers may also process data outside the European Economic Area. In such cases, the transfer is based on an adequacy decision, the EU-U.S. Data Privacy Framework where applicable, standard contractual clauses or another safeguard provided for by the GDPR.

7. Retention

  • Requests and quotes: for as long as needed to handle them and, as a rule, no longer than 24 months from the last contact, unless there is a dispute.
  • Digital assistant conversations: in the browser for the browsing session and, on Ceramiche Corallo's side, for 90 days in a restricted-access archive, linked to a pseudonymous session identifier. API requests are configured so that no history is created on the provider's side; any technical and security logs provided for by the service still apply.
  • Orders and administrative documents: for the period required by tax and accounting law, normally 10 years.
  • Security logs: for a period proportionate to the purposes of protection and incident management.
  • CookieConsent preference: up to 180 days, unless the user makes a new choice or deletes it.
  • Analytics and marketing data: according to the settings of the services concerned and in any case only while consent remains valid.
  • Direct marketing preferences: until consent is withdrawn or, if there is no interaction, for no longer than 24 months from the last relevant activity.

8. Rights of the data subject

In the cases provided for by Articles 15–22 of the GDPR, you can request access, rectification, erasure, restriction, portability and objection, and you can withdraw your consent. You can exercise your rights by writing to info@ceramichecorallo.it.

Withdrawing consent to direct marketing communications does not change your cookie preferences, which can still be managed separately.

You can also lodge a complaint with the Italian Data Protection Authority (Garante).

9. Cookies and changing your preferences

For categories, providers and durations, see the Cookie Policy. You can review your choice at any time with the button below.

10. Minors and updates

The site is not intended to knowingly collect data from minors without the involvement of the person exercising parental responsibility. This notice may be updated to reflect legal or technical changes; the date shown at the top identifies the current version.