Structure of the privacy notice under Articles 13–14 GDPR. The current text dates from 2018 and cites repealed laws: it must be rewritten by the client or their advisor.
Data controller
Who the controller is and how to contact them. [TO BE CONFIRMED, K1]
Data processed and purposes
Orders, shipping, invoicing, customer support, newsletter if any.
Legal bases
Contract, legal obligations, consent, legitimate interest: one for each purpose.
Recipients
Couriers, payment providers, hosting, any analytics tools.
Retention
How long the data in each category is kept.
Your rights
Access, rectification, erasure, restriction, portability, objection, complaint to the Garante (the Italian Data Protection Authority).