Privacy policy

This notice explains what personal data the website www.maribluesrl.it collects, why, for how long and what rights you have, as required by the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR). It also applies to the Italian version of the site.

Data controller

The data controller for the data collected through this site is Mari Blue S.r.l., single-member company, Via Scordato 19, 90011 Bagheria (PA), Italy, VAT no. and tax code 06555860821.

• Privacy email: maribluesrl@gmail.com
• Phone: +39 091 956255

What data we process, why and for how long

We process only the data you give us through the site's forms and the technical data needed to run it securely. The site does not use analytics, advertising or profiling.

1. Requests from the Contact form

• Data: name, email, phone (optional), company (if you are writing as a company), the type of request and the message.
• Purpose: to reply to your request and, if you ask, to prepare a quote or an offer for you.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR); for general requests, our legitimate interest in replying to people who write to us (Art. 6(1)(f)).
• Retention: 24 months from the last exchange; if the request becomes a business relationship, the data follow the rules in point 3.

2. Site account and B2B area

• Data: first name, last name, email, password (stored encrypted; we cannot see it), language; for companies also company name, VAT number, type of business, phone, city and country.
• Purpose: to create and manage the account; for companies, to check that they are trade professionals and to give access to the B2B area with the price list and order requests. Approval is given by a person in our sales office, not by an automated system.
• Legal basis: performance of the account service contract and of pre-contractual measures (Art. 6(1)(b) GDPR).
• Retention: as long as the account is active. You can delete it whenever you like from My account → Privacy.

3. B2B order requests and business relationships

• Data: account data, products and quantities, delivery address, requested date, notes.
• Purpose: to assess and confirm the request, and to organise delivery and invoicing.
• Legal basis: performance of the contract and of pre-contractual measures (Art. 6(1)(b) GDPR); for invoices and accounting records, legal obligation (Art. 6(1)(c)).
• Retention: unconfirmed requests for 24 months; confirmed orders, invoices and accounting records for 10 years, as required by law (Art. 2220 of the Italian Civil Code).

4. News and offers by email (only with your consent)

• Data: the name and email of your account.
• Purpose: to send you occasional news about Mari Blue products and offers.
• Legal basis: your consent (Art. 6(1)(a) GDPR), which you can give or withdraw at any time from My account → Privacy or with the link at the bottom of every email. Your account works the same without consent.
• Retention: until you withdraw consent or delete the account.

5. Security and spam protection

• Data: IP address, technical information about the browser, date and time of requests, outcome of form submissions.
• Purpose: to block spam and abusive access to the contact, registration and login forms, limit repeated submissions, and understand and fix errors on the site.
• Legal basis: legitimate interest in protecting the site and its users (Art. 6(1)(f) GDPR).
• How: we use Cloudflare Turnstile, an anti-spam check that does not use advertising cookies and usually does not ask you to solve image puzzles. The submission limit keeps only an unreadable fingerprint (hash) of the IP address, for one hour. The site's technical log does not contain the text of messages or email addresses in plain text.
• Retention: the site's technical log, 90 days at most; server logs, according to the hosting provider.

6. Cookie consent

We record your cookie choice (with date and time) to remember it and to be able to prove consent, using the CookieYes service. Legal basis: legal obligation and legitimate interest (Art. 6(1)(c) and 6(1)(f) GDPR). Details in the Cookie policy.

Cookies

The site uses technical cookies, which it needs to work. All the details, and how to change your choices, are in the Cookie policy.

Required and optional data

Required fields in the forms are marked. Without this data we cannot reply to you, create the account or assess the B2B request. Optional fields (for example the phone number) are only used to contact you more easily. Consent to news by email is always optional.

Who we share data with

The data are processed by authorised and trained staff of Mari Blue S.r.l. (sales office and administration). We do not sell or transfer the data to third parties for marketing purposes.

To run the site we use the following providers, appointed as data processors (Art. 28 GDPR):

• Rockethosting, Italy: hosts the site and the database, and provides the domain's email.
• Cloudflare, Inc., USA: Turnstile anti-spam check.
• CookieYes Limited, United Kingdom: cookie consent management.
• savorita.eu: technical maintenance, with access to the data only when needed.

For confirmed orders, the necessary data may be disclosed to couriers, banks and tax advisers, who process them as independent controllers, and to the authorities when required by law.

You can ask for the up-to-date list of processors by writing to the privacy email.

Transfers outside the European Union

Some providers are based outside the EU:

• Cloudflare, Inc. (USA): the transfer is based on the EU–US Data Privacy Framework, in which Cloudflare participates, and on the European Commission's standard contractual clauses.
• CookieYes Limited (United Kingdom): the United Kingdom is covered by an adequacy decision of the European Commission.

How we protect the data

The site uses an encrypted connection (HTTPS). Passwords are stored encrypted. Messages and order requests are not public and are seen only by authorised people. The technical log is kept in a protected folder on the server.

Automated decisions

We do not take decisions based solely on automated processing and we do not carry out profiling. Approval of B2B accounts is decided by a person.

Your rights

At any time you can ask Mari Blue S.r.l.:

• to know whether we process your data and to receive a copy (access, Art. 15 GDPR);
• to correct or complete them (rectification, Art. 16);
• to erase them (Art. 17), except those we must keep by law;
• to restrict their processing (Art. 18);
• to receive them in a machine-readable format or to have them transmitted to another controller (portability, Art. 20);
• to object to processing based on our legitimate interest (Art. 21);
• to withdraw your consent, without affecting processing carried out before (Art. 7(3)).

If you have an account, you can do this yourself in My account → Privacy: edit your data, withdraw consent to news, download a copy of your data or delete the account (we will send you an email to confirm). Otherwise write to maribluesrl@gmail.com. We reply within one month.

If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it) or with the authority of the EU country where you live or work.

Minors

The site and the B2B area are intended for adults and trade professionals. We do not knowingly collect data from children under 14. If you think a minor has sent us their data, write to us and we will delete it.

Links to other sites and social networks

The site does not embed maps, videos or social media buttons that collect data. Links to Google Maps, Facebook and WhatsApp open those services only when you click them: from that moment their privacy policies apply.

Changes to this notice

We may update this notice, for example when we open online sales. The date of the last update is at the top of the page; we will notify account holders of significant changes.