tulvano.
Cart (0)Sign in

Privacy notice

Page under review: the parts in square brackets will be completed by the operator and its lawyer before the shop opens.

Version 0.2 of 31 October 2026, under review. This notice is given under Articles 13 and 14 of Regulation (EU) 2016/679 (the "Regulation") to everyone who uses the Tulvano shop: visitors of the catalogue, people who open an account, buyers, and people who arrive from their connected property management system.

Controller

The controller is Lelio Pellegrini, sole proprietorship (impresa individuale), seated at Piazzale Brescia 16, 20149 Milan (MI), Italy, VAT number 05422890961, entered in the register of companies of Milano Monza Brianza Lodi, REA MI-2550187 (Article 13(1)(a) of the Regulation).

For any question about this notice or your data write to info@domusdesk.com or to the certified e-mail address pellegrini.lelio@pec.it. No data protection officer has been designated (Article 13(1)(b)).

What data we process

  • Account: e-mail address, the name you choose to show, password (stored only as a hash), language and, if you turn the second factor on, the key of your authenticator app.
  • Orders: delivery and invoicing addresses, your declaration of buying as a business or as a consumer, VAT number or tax code for the invoice, the order lines, the payments and the invoices issued.
  • Communications: the e-mails we send you to confirm your address, reset your password and follow your order, with the date of sending and the delivery outcome.
  • Technical data: IP address, browser identifier, date and time of requests, for the operation and the security of the site (request limits, abuse prevention).

If you arrive from a connected property management system (Article 14 of the Regulation), we receive from that system, at your first sign-in, your stable identifier there, your name, your e-mail address, your language and the role you hold in your organization (Article 14(1)(d)). The source is the system that sent you here, on your organization's mandate (Article 14(2)(f)); this notice is given to you at the first sign-in, before the first communication (Article 14(3)(b)). We receive and store no password of that system.

Purposes and legal bases

Article 13(1)(c) and (d) of the Regulation.

  • Managing your account and your orders, from registration to delivery, including assistance on an order: performance of the contract or of pre-contractual steps you asked for (Article 6(1)(b)).
  • Issuing and keeping invoices, transmitting them to the Italian exchange system (Sistema di Interscambio) where the law requires it, and keeping the accounting records: compliance with a legal obligation (Article 6(1)(c)).
  • Sending you service e-mails (address confirmation, password reset, order confirmations and updates): performance of the contract (Article 6(1)(b)). We send no commercial communications without your consent (Article 6(1)(a)), which we do not ask for today.
  • Protecting the site and the accounts (request limits, blocking of anomalous sign-ins, technical logs, error correction): the controller's legitimate interest in keeping the service secure and working (Article 6(1)(f)). The interest is balanced by the fact that technical data serve only this purpose and are kept for a short time.
  • Recording the order in your property file, if you connected your property management system: performance of the contract with your organization, which asked for the connection (Article 6(1)(b)).

Recipients

Article 13(1)(e) of the Regulation. Your data are processed on our behalf, under a contract within the meaning of Article 28 of the Regulation, by providers that perform a technical service for us (processors):

  • Neon, LLC (Databricks, Inc.) for the database;
  • Vercel Inc. for hosting the site and running its code;
  • Plus Five Five, Inc. (Resend) for sending the service e-mails;
  • Scaleway SAS for storing files (invoices, product images);
  • Functional Software, Inc. (Sentry) for recording software errors;
  • Upstash, Inc. (QStash) for queuing deferred work;
  • {{OWNER: SDI intermediary, decision C}} for transmitting electronic invoices to the Sistema di Interscambio.

The following receive your data as independent controllers, limited to what they need:

  • the carriers entrusted with delivery, for name, address and contact details;
  • the Sistema di Interscambio of the Italian Revenue Agency and, through it, the tax administration, for invoices;
  • the property management system connected by your organization, which receives, on its request, the orders, their amounts and the invoices to record them in the property file. That system is the independent controller of the file; its notice is its own;
  • the authorities entitled by law.

We do not sell your data and do not pass them to others for purposes of their own.

Transfers outside the European Union

Article 13(1)(f) of the Regulation. Some of the providers listed are companies seated in the United States. Where the processing takes place, provider by provider: Vercel runs the code in Frankfurt, with builds and logs in the United States; Neon keeps the database on AWS eu-central-1 (Frankfurt); Plus Five Five (Resend) sends the e-mails from eu-west-1 (Ireland), with account data and logs in the United States; Functional Software (Sentry) receives the events in Frankfurt, with account and audit logs in the United States; Upstash operates in a European region, with account data in the United States; Scaleway stores the files in the European Union (Paris and Amsterdam), with no transfer at all. For the US providers the transfer rests on the adequacy decision on the EU-US Data Privacy Framework (Article 45), where the provider is certified, and as a fallback on the standard contractual clauses adopted by the European Commission with Implementing Decision (EU) 2021/914 (Article 46). You can ask for a copy by writing to info@domusdesk.com.

Retention

Article 13(2)(a) of the Regulation.

  • Account: for as long as the account exists. If you ask for deletion, the account is removed by the first nightly job that follows, subject to the next point.
  • Orders and invoices: for the term the tax and civil law impose for invoices and accounting records, [LAWYER: retention term and provision, from the texts stored in laws/it/: Civil Code art. 2220, D.P.R. 600/1973 art. 22, D.P.R. 633/1972 art. 39], counted from the year of issue. After the term they are deleted. We tell you so when you ask for the deletion of your account: we do not do it silently.
  • Service e-mails: the record of the sending and its outcome stays with the sending provider for the time it states in its own terms.
  • Technical data: the providers' technical logs (hosting, database, queue, errors) follow the terms each of them states.
  • Carts not tied to an account: thirty days from the last change.

Your rights

Article 13(2)(b) and (c) of the Regulation. You have the right to ask us for access to your data (Article 15), their rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), portability of the data you gave us (Article 20), and to object to processing based on legitimate interest (Article 21). Should a processing in future rest on your consent, you could withdraw it at any time without affecting the lawfulness of the processing already carried out.

Write to info@domusdesk.com or to the certified e-mail address pellegrini.lelio@pec.it. We answer within one month of the request (Article 12(3)). Name, language and password you change yourself in "Your account".

Complaint

Article 13(2)(d) of the Regulation. If you consider that the processing infringes the Regulation, you may lodge a complaint with a supervisory authority (Article 77 of the Regulation). In Italy this is the Garante per la protezione dei dati personali (Articles 141 and 142 of Legislative Decree no. 196 of 30 June 2003), which publishes the complaint form on its site: www.garanteprivacy.it. You may also turn to the authority of the Member State where you live or work.

Data you must provide

Article 13(2)(e) of the Regulation. E-mail, name and password are needed to open the account; addresses and invoicing details are needed to conclude an order and issue the invoice the law requires of us. Without them we cannot open the account or accept the order. The VAT number is needed only if you declare that you buy as a business.

Automated decisions

Article 13(2)(f) of the Regulation. We take no decision based solely on automated processing that produces legal effects on you, and we do no profiling. Request limits and security blocks are technical measures that do not assess the person.

Cookies and similar technologies

The site uses only the cookies needed to keep you signed in and to remember the language you chose. It uses no profiling cookies and no third-party tracking tools. These cookies need no consent (Article 122 of Legislative Decree no. 196 of 30 June 2003).

Changes to this notice

When what we do with your data changes, we update this page and its date at the top. If the change concerns a processing that already involves you, we tell you before it takes effect (Article 13(3)).