1. Data controller
The data controller is Marca Mold S.r.l., Via Ticino, 91 – 20014 Nerviano (MI), Italy – VAT no. IT06089670159, tax code 06089670159, certified e-mail [email protected]. For any matter concerning personal data you can write to [email protected] or call +39 0331 406311.
We have not appointed a data protection officer (DPO): none of the cases in Art. 37 GDPR applies — we are not a public authority, we do not carry out large-scale systematic monitoring and we do not process special categories of data on a large scale. Requests concerning personal data are to be sent to the same address.
2. What data we process, why and for how long
| What | Data | Legal basis | Retention |
|---|---|---|---|
| Contact form | name, e-mail address, company, message text | Art. 6(1)(b) – pre-contractual measures at the data subject’s request | 24 months from the last contact |
| Account and sign-in | e-mail address, first and last name, company, telephone; sign-in credentials (single-use link, OTP code, device passkey) | Art. 6(1)(b) – performance of the contract | for the duration of the relationship and 10 years from the last order |
| Uploaded 3D models | the CAD files and the geometric data we derive from them | Art. 6(1)(b) – performance of the quotation and the supply | until the user deletes them; files linked to an order for 10 years |
| Quotations and orders | billing and shipping details, order contents, amounts | Art. 6(1)(b) and Art. 6(1)(c) – tax and accounting obligations | 10 years (Art. 2220 Italian Civil Code) |
| Payments | outcome of the transaction and payment identifier. Card details do not pass through our systems and we do not store them | Art. 6(1)(b) and Art. 6(1)(c) | 10 years for the accounting records |
| Shipping | consignee, address, contact details, parcel dimensions and weight | Art. 6(1)(b) | 10 years for the accounting records |
| Server technical logs | IP address, date and time, page requested, browser type | Art. 6(1)(f) – legitimate interest in the security of the service | 12 months |
3. Whether providing data is required
The data marked as mandatory in the forms is what we need to answer the request or to carry out the order: without it, we cannot. Providing the other data is optional.
4. Who we share data with
Data is not disseminated and is not passed to third parties for marketing purposes. It is processed by our authorised staff and disclosed to those who provide us with ancillary services, appointed as processors under Art. 28 GDPR:
- Stripe Payments Europe, Ltd. (Ireland) – collection of card and PayPal payments;
- Paccofacile / Tecnosogima S.r.l. (Italy) – quotations and shipment management;
- the carriers appointed for the individual shipment;
- tax and accounting advisers, and the authorities when the law so requires.
The servers that host the site and the application are ours and located in Italy, at our own premises. Uploaded files stay on company storage systems. The mail server is ours too and sits at the same premises: service e-mails (sign-in link, order confirmations, replies to the contact form) do not pass through an external mail provider.
5. Transfers outside the European Economic Area
We do not transfer data outside the EEA. Should a supplier do so for its own technical needs, the transfer takes place on the basis of the standard contractual clauses approved by the European Commission or of an adequacy decision.
6. Automated decision-making
The quoted price is calculated automatically from the geometry of the model and the options chosen. It is not a decision producing legal effects concerning the person within the meaning of Art. 22 GDPR: it is the calculation of a commercial offer, which can always be discussed by writing to us. We do not carry out profiling.
7. Your rights as a data subject
You can at any time request access to your data, its rectification or erasure, the restriction of processing, its portability, and object to processing based on legitimate interest (Arts. 15-22 GDPR). Where processing is based on consent, consent can be withdrawn at any time without affecting the lawfulness of what was done before.
Requests are to be sent to [email protected]. We reply within one month. Anyone who believes the processing infringes the Regulation may lodge a complaint with the Italian data protection authority (garanteprivacy.it) or bring the matter before the courts.
8. Cookies and tracking tools
This site uses no profiling cookies and hosts no third-party tracking or analytics tools. There is no Google Analytics, no advertising pixel, no typeface or map loaded from external servers.
The quoting application uses technical cookies only, needed to keep the session of whoever has signed in and to remember the chosen language. For these cookies, under Art. 122 of the Italian Privacy Code, no consent is required and no banner appears: they are indispensable to provide the requested service. They can be deleted from the browser settings, with the consequence of having to sign in again.
9. Children’s data
The quoting engine is intended for professional use and is not directed at minors. We do not knowingly collect data from children under fourteen, the threshold set in Italy by Art. 2-quinquies of the Privacy Code implementing Art. 8 GDPR. If we learn that we have recorded a minor’s data without the consent of whoever holds parental responsibility, we delete it without delay: reports are to be sent to [email protected].
10. Security
The site is served exclusively over an encrypted connection (HTTPS). Passwords are not stored in clear text. Access to the private area is by single-use link, temporary code or device key, with no password to memorise.
11. Changes
This notice may be updated. The version in force is always the one published at this address, with the date at the foot.
Last updated: 9 September 2026.
These texts are drawn up in Italian. The versions in other languages are a courtesy translation: in the event of any divergence the Italian text prevails.