Privacy Policy

Last updated: 9 November 2026

This notice explains how we process the personal data of people who visit newgardenmac.com, create an account, buy or write to us. We review it whenever our services change.

1. Data controller

Newgarden S.a.s. di Prini Lorenzo & C., Via Vallicella 145, 45036 Ficarolo (RO), Italy, VAT and tax no. 01248760298. For any question about your data: info@newgardensas.it.

2. What data we process and why

Customer account

Data: first name, last name, email, password (encrypted), date of birth and gender if you provide them, addresses, order history.
Legal basis: contract (Art. 6(1)(b) GDPR).
How long: as long as the account is active; you can ask us to close it at any time. Order data is kept for tax obligations.

Orders, payment, delivery and invoicing

Data: account data or data entered as a guest, delivery and billing addresses, phone, VAT number, SDI code or PEC for Italian e-invoices, products bought, amounts, payment result.
Legal basis: contract (Art. 6(1)(b)) and tax and accounting obligations (Art. 6(1)(c)).
How long: tax and accounting documents for 10 years (Art. 2220 Italian Civil Code); the rest for the legal warranty period and any disputes.

Support, warranty and returns

Data: order data, description of the problem, photos or documents you send us.
Legal basis: contract (Art. 6(1)(b)) and consumer law obligations (Art. 6(1)(c)).
How long: for the duration of the case and of the legal warranty.

Messages

Data: when you write to us on WhatsApp, Messenger, Instagram, by email or through the contact form: the name and identifier you use on the service, the text, attachments, date and time (details in section 6).
Legal basis: pre-contractual measures and contract (Art. 6(1)(b)) and our legitimate interest in answering requests (Art. 6(1)(f)).
How long: 12 months from the last message.

Data: email address.
Legal basis: consent (Art. 6(1)(a)), which you can withdraw with the link at the bottom of every email.
How long: until you unsubscribe.

Back-in-stock alert

Data: email address and product, if you ask to be notified when it is available again.
Legal basis: your request (Art. 6(1)(b)).
How long: until the alert is sent.

Product reviews

Data: the name you choose to show, text and rating.
Legal basis: consent (Art. 6(1)(a)), given by publishing it.
How long: as long as the review stays published; you can ask us to remove it.

Share with a friend

Data: your and the recipient’s name and email address, used only to send that message.
Legal basis: your request (Art. 6(1)(b)).
How long: not kept after sending.

Site security

Data: IP address, date and time, pages requested, browser type, in the server’s technical logs.
Legal basis: legitimate interest in protecting the site and customers from abuse and fraud (Art. 6(1)(f)).
How long: for the time strictly needed for security.

Statistics and advertising

Data: browsing data collected with Google Analytics and Google Ads cookies.
Legal basis: consent (Art. 6(1)(a)), given and withdrawn from the cookie banner.
How long: see the cookie policy.

Data marked as required in forms is needed to carry out the order or to reply: without it we cannot do so. We do not take automated decisions or carry out profiling with legal effects on you.

3. Payments

Card details never pass through our systems: you enter them directly on the secure pages of the payment provider you choose among those available in the shop (PayPal and cards through PrestaShop Checkout, Satispay, Alma and HeyLight for instalments). Each provider processes your data as an independent controller under its own privacy notice; for instalments Alma and HeyLight may check your creditworthiness. With a bank transfer we only receive the details shown on the credit.

4. Who we share data with

Only those we need for the purposes above. The following process data on our behalf, as processors:

Hetzner Online GmbH (Germany), which hosts the site;
our email provider and the management software we use for orders and stock;
WA Smart and Keplero AI S.r.l., for messages (section 6);
tax and accounting advisers.

The following receive data as independent controllers:

the couriers who deliver the order (name, address, phone);
payment providers (section 3);
the Italian Revenue Agency, through the Exchange System, for e-invoices;
Google Ireland Ltd for Google Analytics and Google Ads, only with your consent;
Google, if you choose to sign in with your Google account or to fill in your address with Google Maps suggestions;
Meta Platforms Ireland Ltd for WhatsApp, Messenger and Instagram;
public authorities, when required by law.

We do not sell or give your data to others for their advertising.

5. Transfers outside the European Union

Some providers (for example Google, Meta, PayPal) may process data in the United States or other countries outside the EU. This only happens with the safeguards of Articles 44-49 GDPR: an adequacy decision, such as the EU-U.S. Data Privacy Framework, or the European Commission’s standard contractual clauses.

6. Messages on WhatsApp, Messenger, Instagram and email

When you write to us on WhatsApp, on Messenger (Facebook Page “NewgardenStore”), on Instagram (@newgardensas), by email or through the site’s contact form, we receive and keep the name you have on the service and your identifier (phone number for WhatsApp, Page or profile identifier for Messenger and Instagram, email address), the text of the messages, attachments, date and time and any order references.

We use them only to reply and to assist you before and after your purchase. We do not use them for advertising and do not give them to third parties. Only our authorised staff read them; WA Smart (WhatsApp messaging platform) and Keplero AI S.r.l. (automatic assistant that may reply on our behalf) help us manage them as processors. Meta Platforms Ireland Ltd processes data of its own services as an independent controller.

We keep conversations for 12 months from the last message, unless the law requires otherwise. To have them deleted earlier write to assistenza@newgardensas.it or send us “Delete my data” on the channel you used: we delete them within 30 days and confirm it. Deleting messages in the app does not delete them from our systems.

7. Cookies

Which cookies we use, what they are for and how long they last is explained in the cookie policy. You can change your choices at any time with the cookie preferences button.

8. Security

We process data with IT tools and organisational measures suitable to prevent unauthorised access, loss, alteration or disclosure: encrypted connection (HTTPS), encrypted passwords, access to systems limited to authorised staff.

9. Your rights

At any time you can ask us for:

access to your data and a copy (Art. 15 GDPR);
rectification of inaccurate or incomplete data (Art. 16);
erasure, when we no longer have to keep the data by law (Art. 17);
restriction of processing (Art. 18);
portability, i.e. the data you gave us in a machine-readable format (Art. 20);
to object to processing based on legitimate interest and, always, to marketing (Art. 21);
to withdraw your consent, without affecting processing already carried out (Art. 7(3)).

Write to info@newgardensas.it. We reply within one month (three in complex cases, letting you know within the first); the request is free. We may ask you to confirm your identity. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the authority of your country.

10. Minors

The shop is aimed at adults. We do not knowingly collect data of children under 14.

11. Changes

If we change this notice we publish the new version here, with the date of the last update at the top.