1. Data controller
The data controller is Marca Mold S.r.l., Via Ticino, 91 – 20014 Nerviano (MI), Italy – VAT no. IT06089670159, tax code 06089670159, certified e-mail [email protected]. For any matter concerning personal data you can write to [email protected] or call +39 0331 406311.
We have not appointed a data protection officer (DPO): none of the cases in Art. 37 GDPR applies — we are not a public authority, we do not carry out large-scale systematic monitoring and we do not process special categories of data on a large scale. Requests concerning personal data are to be sent to the same address.
2. What data we process, why and for how long
| What | Data | Legal basis | Retention |
|---|---|---|---|
| Contact form | name, e-mail address, company, message text | Art. 6(1)(b) – pre-contractual measures at the data subject’s request | 24 months from the last contact |
| Website chat | message text, the page you write from, your e-mail address if you leave it to be notified of the reply | Art. 6(1)(b) – pre-contractual measures at the data subject’s request | 90 days from the last message |
| Account and sign-in | e-mail address, first and last name, company, telephone; sign-in credentials (single-use link, OTP code, device passkey) | Art. 6(1)(b) – performance of the contract | for the duration of the relationship and 10 years from the last order |
| Uploaded 3D models | the CAD files and the geometric data we derive from them | Art. 6(1)(b) – performance of the quotation and the supply | until the user deletes them; files linked to an order for 10 years |
| Quotations and orders | billing and shipping details, order contents, amounts | Art. 6(1)(b) and Art. 6(1)(c) – tax and accounting obligations | 10 years (Art. 2220 Italian Civil Code) |
| Payments | outcome of the transaction and payment identifier. Card details do not pass through our systems and we do not store them | Art. 6(1)(b) and Art. 6(1)(c) | 10 years for the accounting records |
| Shipping | consignee, address, contact details, parcel dimensions and weight | Art. 6(1)(b) | 10 years for the accounting records |
| Server technical logs | IP address, date and time, page requested, browser type | Art. 6(1)(f) – legitimate interest in the security of the service | 12 months |
3. Whether providing data is required
The data marked as mandatory in the forms is what we need to answer the request or to carry out the order: without it, we cannot. Providing the other data is optional.
4. Who we share data with
Data is not disseminated and is not passed to third parties for marketing purposes. It is processed by our authorised staff and disclosed to those who provide us with ancillary services, appointed as processors under Art. 28 GDPR:
- Stripe Payments Europe, Ltd. (Ireland) – collection of card and PayPal payments;
- Paccofacile / Tecnosogima S.r.l. (Italy) – quotations and shipment management;
- the carriers appointed for the individual shipment;
- tax and accounting advisers, and the authorities when the law so requires.
- Cloudflare, Inc., which operates the proxy for the links in our emails (go.marca.it), as processor.
If you accept the measurement cookies, Google Ireland Ltd receives from the Google Ads tool your arrival from one of our ads and, if you order, the order number and amount. It processes them as an independent controller, under its own privacy policy (policies.google.com/privacy).
If you write to us via the WhatsApp button, the conversation takes place on the WhatsApp service of WhatsApp Ireland Ltd (Meta group), under its terms; we receive your number and the messages you send us and use them only to reply to you.
If you write to us from the website chat, the messages reach our internal messaging system, on our own servers in Italy, and are read only by the staff handling requests. We use them to reply to you and, if you leave your e-mail address, to let you know when the reply arrives. To protect the chat from spam, before the first message a Cloudflare Turnstile security check (Cloudflare, Inc.) verifies that a person is writing; the same check protects sign-up to the quoting application.
The servers that host the site and the application are ours and located in Italy, at our own premises. Uploaded files stay on company storage systems. The mail server is ours too and sits at the same premises: service e-mails (sign-in link, order confirmations, replies to the contact form) do not pass through an external mail provider.
5. Transfers outside the European Economic Area
We do not transfer data outside the EEA. Should a supplier do so for its own technical needs, the transfer takes place on the basis of the standard contractual clauses approved by the European Commission or of an adequacy decision.
The exception is the IP address of anyone who clicks a link in our emails, which may pass through the servers of Cloudflare, Inc. (USA). The transfer takes place on the basis of the EU-US Data Privacy Framework, in which Cloudflare participates.
In the same way, the IP address of anyone passing the Turnstile security check, in the website chat or when signing up to the quoting application, may pass through Cloudflare’s servers.
With consent to the measurement cookies, the data collected by the Google Ads tool may also be processed by Google LLC (USA), on the basis of the EU-US Data Privacy Framework, to which Google adheres.
6. Automated decision-making
The quoted price is calculated automatically from the geometry of the model and the options chosen. It is not a decision producing legal effects concerning the person within the meaning of Art. 22 GDPR: it is the calculation of a commercial offer, which can always be discussed by writing to us. We do not carry out profiling, except for the individual measurement of email effectiveness for those who have consented to tracking.
7. Marketing communications by email
Controller: Marca Mold S.r.l., Via Ticino 91, 20014 Nerviano (MI), Italy, VAT no. IT06089670159, certified email (PEC) [email protected].
Privacy contact: [email protected], tel. +39 0331 406311.
What we do. We send you marketing communications by email (news, offers, invitations on 3D printing, moulding and design) only if you have asked us to, through a dedicated checkbox that is optional and never pre-ticked (for example in your quoting tool profile). We do not share your consent with other companies of the group.
Legal basis: your consent (Art. 6.1.a GDPR and Art. 130(1) of the Italian Privacy Code).
Data processed:
- email address, name and company;
- date, channel and exact wording of the consent;
- sends, bounces and unsubscribes;
- clicks on links in the emails (see below).
How we measure. The links in our emails go through go.marca.it, a service of ours reached via Cloudflare, which records the click and takes you to the chosen page.
- Without consent to tracking we only count that a recipient clicked, without knowing who.
- With consent to tracking (a separate, optional checkbox) we link the click to your address to understand which communications lead to quotes and orders. Without this consent you still receive the emails. You can withdraw it at any time, and from then on your clicks are anonymous again.
- The IP address and browser of the click are used only to recognise automatic checks by spam filters.
- We do not use pixels to find out whether you open the emails.
Google Ads. From Google we read only aggregate statistics of our advertising campaigns: costs, impressions, clicks. We do not send personal data to Google.
Who processes the data.
- Our authorised staff.
- Servers, databases and email are systems of the group, in Italy, at our premises.
- Cloudflare (link proxy) sees the IP address of whoever clicks.
Retention.
- Consent and subscription: until withdrawn. Proof of consent: for as long as needed to demonstrate it.
- After unsubscribing: only what is needed not to write to you again.
- Clicks linked to a person: 24 months at most. Individual analyses: 12 months at most.
- Database backups follow their own rotation, up to 24 months.
Withdrawal and unsubscribing: with the link in every email (one click, no sign-in), from your quoting tool profile or by writing to [email protected]. Withdrawal does not affect processing carried out before it.
Your rights: as set out in the rights section of this notice (access, rectification, erasure, restriction, objection, portability, complaint to the Garante).
8. Your rights as a data subject
You can at any time request access to your data, its rectification or erasure, the restriction of processing, its portability, and object to processing based on legitimate interest (Arts. 15-22 GDPR). Where processing is based on consent, consent can be withdrawn at any time without affecting the lawfulness of what was done before.
Requests are to be sent to [email protected]. We reply within one month. Anyone who believes the processing infringes the Regulation may lodge a complaint with the Italian data protection authority (garanteprivacy.it) or bring the matter before the courts.
9. Cookies and tracking tools
This site hosts no third-party analytics: there is no Google Analytics, and no fonts or maps loaded from external servers. The measurements are described below and work only with consent.
The site and the quoting application use only technical cookies, except for the measurement cookies described below, needed to keep the session of those who have signed in and to remember the chosen language. Under art. 122 of the Italian Privacy Code, no consent is required for these cookies. They can be deleted from the browser settings, after which you will need to sign in again.
The website chat uses a technical cookie, __Host-marca_chat (13 months), which is created only when you send the first message and lets you find the conversation again when you return to the site. It is deleted with «End and forget» in the chat or from the browser settings.
We ask every visitor, with a notice at the bottom of the page, to consent to a measurement cookie (mk_visitatore, 13 months). With consent we record the pages viewed and the main actions on the site and in the quoting application. If you arrive from a link in one of our emails (cookie mk_click, 30 days), sign up or sign in, we link them to you, to understand which communications and pages are useful. The choice is stored in the mk_consenso cookie (6 months). We do not record the visitor’s IP address. Without consent we record nothing.
With the same consent we load the Google Ads conversion measurement tool (Google Ireland Ltd), which uses the cookies _gcl_au and _gcl_aw (90 days) to recognise visitors who arrive from one of our ads on Google and to count the orders that follow. We send Google only the order number and the value of the goods, never name, e-mail or address, and we do not use it to show personalised advertising. Without consent the tool is not loaded.
You can change your choice at any time from the cookie preferences.
10. Children’s data
The quoting engine is intended for professional use and is not directed at minors. We do not knowingly collect data from children under fourteen, the threshold set in Italy by Art. 2-quinquies of the Privacy Code implementing Art. 8 GDPR. If we learn that we have recorded a minor’s data without the consent of whoever holds parental responsibility, we delete it without delay: reports are to be sent to [email protected].
11. Security
The site is served exclusively over an encrypted connection (HTTPS). Passwords are not stored in clear text. Access to the private area is by single-use link, temporary code or device key, with no password to memorise.
12. Changes
This notice may be updated. The version in force is always the one published at this address, with the date at the foot.
Last updated: 26 October 2026.
These texts are drawn up in Italian. The versions in other languages are a courtesy translation: in the event of any divergence the Italian text prevails.