PRIVACY POLICY

Information on the processing of personal data of users of the e-commerce platform shop.fluidsystem.com

This notice describes how the personal data of users who make purchases or interact with the e-commerce platform shop.fluidsystem.com are processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree No. 196/2003, as subsequently amended (the “Privacy Code”).

Sales contracts concluded through the platform are governed by the relevant General Terms and Conditions of Sale, with which this notice is coordinated.

1. Data Controller

FLUID SYSTEM S.r.l. – Via Roma, 155/bis, 31020 Villorba (TV), Italy.
VAT No./Tax Code IT01715430268 – Treviso REA No. 163726.
Tel. +39 0422 444220 – Email: info@fluidsystem.com (hereinafter the “Data Controller”).

2. Categories of personal data processed

The e-commerce platform may process the following categories of personal data:

• identification data: first name, surname, company name;
• contact data: email address, telephone number;
• billing and shipping data: address, postcode, city, province, country, tax code/VAT number, recipient code/PEC certified email address for electronic invoicing;
• order data: products purchased, amounts, purchase history, order-related communications;
• payment data: managed through authorised external providers; the Data Controller does not have access to full payment instrument details (e.g. the full card number) and receives only information on the outcome of the transaction;
• browsing data: IP address, user agent, system logs;
• data relating to any user account: login credentials, stored securely, and order history, where the platform provides for the creation of a user account;
• data collected through cookies and similar technologies, as described in the Cookie Policy.

3. Purposes of processing, legal bases and nature of provision

a) Management of orders and online sales
Registration and management of orders; management of payments; shipment of products; administrative, accounting and tax management; management of returns, after-sales service and warranty claims.
Legal basis: performance of the contract or pre-contractual measures (Article 6(1)(b) GDPR) and compliance with legal, accounting and tax obligations (Article 6(1)(c) GDPR).
Nature of provision: provision of the data required to conclude and perform the contract is mandatory; failure to provide such data will make it impossible to process the order.

b) Management of contact requests
Responding to requests submitted through forms or by email.
Legal basis: steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR) and/or legitimate interest in responding to requests (Article 6(1)(f) GDPR).

c) Marketing activities
Sending commercial communications relating to the Data Controller’s products, services and promotions.
Legal basis: the data subject’s consent (Article 6(1)(a) GDPR), which may be withdrawn at any time. Provision is optional.

d) Statistical analysis of traffic
Compilation of statistics on use of the platform through Google Analytics, Microsoft Clarity (with masking of data entered in fields) and the platform’s order attribution function, which records the source of the visit, activated with prior consent.
Legal basis: consent (Article 6(1)(a) GDPR and Article 122 of the Privacy Code).

e) Platform security and prevention of abuse
Protection of forms and systems against automated access and fraudulent use (Google reCAPTCHA in contact forms and anti-fraud checks carried out by the payment provider, including through the hCaptcha service integrated into the payment form), and ensuring IT security.
Legal basis: the Data Controller’s legitimate interest (Article 6(1)(f) GDPR). Where such tools involve storing information on or accessing information on the user’s device through cookies or similar technologies that are not strictly necessary, activation is subject to consent collected through the consent management platform, as described in the Cookie Policy.

f) Online advertising and campaign measurement
Measurement of the effectiveness of advertising campaigns (conversions) and display, on third-party websites and platforms, of advertisements aligned with interests shown during browsing (remarketing), using Google tools (Google Ads), Meta (Meta Pixel) and LinkedIn (Insight Tag), activated only after consent has been collected through the cookie banner.
Legal basis: the data subject’s consent (Article 6(1)(a) GDPR and Article 122 of the Privacy Code).
Nature of provision: optional; refusal to give consent does not affect browsing or the handling of requests.

4. Methods of processing

Processing is carried out using IT and electronic systems and, to a limited extent, on paper, in accordance with procedures related to the stated purposes and using appropriate technical and organisational measures pursuant to Articles 5(1)(f) and 32 of the GDPR.

5. Payment services and related privacy roles

Payments may be made by card (through the Stripe provider) or by bank transfer.

Processing of payment data

For electronic payments, payment instrument data are collected and processed directly by Stripe Payments Europe, Ltd. / Stripe, Inc. in a secure environment. In relation to such data, the payment provider acts as an independent Data Controller for the purposes of executing the payment transaction, preventing fraud and complying with its regulatory obligations, in accordance with its own privacy policy. As part of its anti-fraud checks, the payment provider may also use the hCaptcha service integrated into the payment form.

The website Data Controller does not have access to the full payment instrument details and receives from the provider only the information required to verify the outcome of the transaction and manage the order, invoicing, refunds and warranty. In relation to this latter information, the website Data Controller acts as Data Controller.

6. Other third-party services and tools

E-commerce platform
The platform uses dedicated software to manage orders and online sales; the data entered are used to manage the sale and the related obligations.

Google Analytics and Google Tag Manager
The platform may use Google Analytics for aggregated statistics on website use and Google Tag Manager for tag management. They are activated with prior consent through the cookie banner.

Microsoft Clarity
The website may use Microsoft Clarity to analyse users’ interactions with pages (clicks, scrolling, heatmaps and session recordings), with data entered in fields masked. It is activated only with prior consent.

Advertising tools (Google Ads, Meta Pixel, LinkedIn Insight Tag)
The website may use these tools to measure campaign effectiveness and display relevant advertisements on the respective providers’ platforms. They are activated only with prior consent.

Google Maps
The Contact page may display a Google Maps map, loaded only with prior consent.

Google reCAPTCHA
The platform uses Google reCAPTCHA to protect contact forms against automated access.

Technical service providers (hosting, IT) and certain tools act as Data Processors pursuant to Article 28 of the GDPR; other providers act as independent Data Controllers for their own purposes, as described in their respective privacy notices (in particular the payment provider, Google services relating to reCAPTCHA and Maps and, for their own purposes following data collection, the providers of advertising tools). For the collection and transmission of data through Meta and LinkedIn advertising tools, the Data Controller and the relevant provider act as joint controllers pursuant to Article 26 of the GDPR, within the limits set out in the provider’s applicable agreements. An up-to-date list of Data Processors is available on request.

7. Recipients of personal data

Personal data may be processed by or disclosed to: authorised and instructed internal personnel (Article 29 GDPR); technical service providers and third-party platforms acting as Data Processors; couriers and carriers for shipping; professionals and consultants (e.g. for accounting and tax obligations); payment providers and banks; competent authorities where required by law. Personal data are not disseminated.

8. Transfers of personal data to third countries

Some services (in particular those provided by the payment provider and by Google, Microsoft, Meta and LinkedIn) may involve transfers of personal data to third countries, including the United States of America. Such transfers are carried out in accordance with Chapter V of the GDPR on the basis of the adequacy decision relating to the EU-U.S. Data Privacy Framework (where the provider participates in it) and/or Standard Contractual Clauses (SCCs), supplemented where necessary by additional safeguards. The data subject may obtain a copy of the safeguards adopted by contacting the Data Controller.

9. Retention period

Personal data are retained for the period necessary for the relevant purposes and legal obligations, according to the following criteria for each category:

• data relating to orders, invoicing and accounting: 10 years, in compliance with civil-law and tax obligations (Article 2220 of the Italian Civil Code and applicable tax legislation);
• data relating to payment outcomes: for the period necessary to manage the order, invoicing, refunds and any disputes, within the applicable accounting retention periods;
• data relating to support, returns and warranties: for the warranty period set out in the Terms and Conditions and thereafter within the applicable limitation periods for the establishment, exercise or defence of legal claims;
• data relating to any user account: for the lifetime of the account and, following deletion, for the technical period required to remove it;
• data processed for marketing purposes: until consent is withdrawn and, if it is not withdrawn, for no longer than 24 months from the last contact, after which consent is reviewed/renewed;
• browsing data and technical logs: for the period technically necessary and, as a rule, no longer than 12 months, unless a different period is required by law or for security or the investigation of unlawful activity;
• data collected through cookies: for the period indicated in the Cookie Policy.

10. Data subject rights

The data subject may exercise the rights set out in Articles 15-22 of the GDPR: access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests and withdrawal of consent (without affecting the lawfulness of processing carried out before withdrawal).

Requests may be sent to info@fluidsystem.com. The Data Controller will respond within the time limits laid down in Article 12 of the GDPR, normally within one month, which may be extended by two months in particularly complex cases.

The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it) or with the competent supervisory authority, and to bring proceedings before the competent court.

11. No automated decision-making

The Data Controller does not use the platform to carry out automated decision-making, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them within the meaning of Article 22 of the GDPR.

12. Cookies and preference management

The platform uses cookies and similar technologies. Full details are available in the Cookie Policy, which forms an integral part of this notice. Consent is managed through the CookieYes platform, which allows users to accept or reject categories of cookies and change their preferences at any time.

13. Changes to this Privacy Policy

The Data Controller reserves the right to update this Privacy Policy to reflect regulatory, organisational or technological changes. Updated versions will be published on this page together with the date of the latest update.

Last updated: October 2026.