PRIVACY POLICY

Last updated: 5 October 2026

This Privacy Policy describes how OpenCartItalia, through the website opencartitalia.org, collects, uses, stores and protects the personal data of visitors, users and customers using the services available through the website.

Personal data are processed in accordance with Regulation (EU) 2016/679 ("GDPR"), applicable Italian data protection legislation and any other applicable data protection laws.

1. DATA CONTROLLER

The Data Controller is:

OpenCartItalia
OPENCARTITALIA
Registered address: Casorate Sempione (VA) 21011 Via Del Roncaccio 4/A
Italy

OpenCartItalia may also be contacted through the Contact Us page available on the website.

2. SCOPE OF THIS POLICY

This Policy applies to personal data processed through opencartitalia.org and its related services, including, by way of example:

  • website browsing;

  • registration and account management;

  • purchases of software modules, licences and services;

  • quotation requests;

  • technical support requests;

  • contact forms;

  • order and payment management;

  • billing and accounting;

  • digital product downloads;

  • software licence activation and verification;

  • product reviews;

  • customer service communications;

  • cookie preference management.

3. PERSONAL DATA WE PROCESS

Depending on the services used, OpenCartItalia may process the following categories of personal data.

3.1 Identification and contact data

This may include:

  • first name;

  • surname;

  • company name;

  • address;

  • city;

  • postcode;

  • province or region;

  • country;

  • email address;

  • telephone number;

  • any additional information voluntarily provided by the user.

3.2 Account information

When an account is created, we may process:

  • email address;

  • authentication credentials;

  • account identifier;

  • order history;

  • purchased products;

  • associated licences;

  • support requests;

  • account preferences.

Passwords are handled using the authentication mechanisms implemented by the platform and should never be sent to OpenCartItalia through email or contact forms.

3.3 Order and billing data

When a purchase is made, we may process:

  • identification information;

  • billing details;

  • company name;

  • VAT number;

  • Tax Identification Number where required;

  • billing address;

  • products and services purchased;

  • order value;

  • payment method;

  • payment status;

  • transaction identifiers;

  • administrative and tax documentation.

3.4 Payment information

Depending on the payment method selected, payments may be processed directly by external payment service providers.

OpenCartItalia may receive information including:

  • payment confirmation;

  • transaction status;

  • amount;

  • transaction identifier;

  • information required to manage refunds or disputes.

Where full payment card information is entered directly into the systems of the relevant payment provider, OpenCartItalia does not receive or store full card details.

3.5 Software licence and activation data

Certain products or modules distributed by OpenCartItalia may use remote licence management and verification systems.

In these circumstances, the following information may be processed:

  • licence key or identifier;

  • associated product or module;

  • domain on which the software is installed;

  • product version;

  • licence status;

  • verification date and time;

  • IP address and technical information required for communication;

  • information necessary to prevent unauthorised or abusive use of a licence.

Such information is used exclusively for licence management, verification, security and support purposes.

3.6 Contact form data

When users contact OpenCartItalia through the website, we may collect:

  • name;

  • email address;

  • subject;

  • message;

  • any other information voluntarily included in the request.

Users should avoid submitting sensitive or unnecessary personal information through the contact form.

3.7 Product reviews

Where users submit product reviews, we may process:

  • displayed name;

  • rating;

  • review text;

  • product reviewed;

  • technical information required to prevent spam and abuse.

3.8 Technical and browsing information

During normal use of the website, certain technical information may automatically be processed, including:

  • IP address;

  • date and time;

  • requested URL;

  • browser;

  • operating system;

  • device information;

  • language;

  • session information;

  • server logs;

  • technical information relating to errors and security.

Such information is primarily used to operate and protect the website, prevent abuse and diagnose technical issues.

3.9 Cookies and similar technologies

The website may use cookies and similar technologies.

Further information is provided in the Cookie Policy section below.

4. PURPOSES AND LEGAL BASES OF PROCESSING

A. Website operation

Personal data may be processed in order to provide:

  • website navigation;

  • shopping cart functions;

  • session management;

  • authentication;

  • language preferences;

  • website security;

  • cookie preference management.

Legal basis: performance of a service requested by the user and the legitimate interest of the Data Controller in ensuring the proper and secure operation of the website.

B. Account registration and management

To create and manage user accounts.

Legal basis: performance of a contract or pre-contractual measures requested by the data subject.

C. Order management

To:

  • process purchases;

  • supply digital products;

  • manage downloads;

  • manage licences;

  • provide customer support;

  • manage refunds and disputes.

Legal basis: performance of a contract.

D. Administrative, accounting and tax obligations

To comply with applicable accounting, tax, administrative and legal requirements.

Legal basis: compliance with a legal obligation.

E. Contact and quotation requests

To respond to requests submitted through the website, email or other customer-support channels.

Legal basis: pre-contractual measures requested by the data subject and, where appropriate, the legitimate interest of OpenCartItalia in responding to communications initiated by the user.

F. Technical support

To provide support relating to products, services, installations, configurations, licences and projects.

Legal basis: performance of a contract or pre-contractual measures.

G. Licence verification

To verify:

  • authenticity of a licence;

  • licence validity;

  • associated product;

  • authorised domain, where applicable;

  • compliance with applicable licence conditions.

Legal basis: performance of the contract and legitimate interest in protecting software against unauthorised use.

H. Security and abuse prevention

To:

  • secure the website;

  • prevent fraud;

  • prevent unauthorised access;

  • prevent misuse;

  • identify cyberattacks;

  • maintain appropriate technical security logs.

Legal basis: legitimate interest of the Data Controller.

I. Legal claims and protection of rights

Information may be used where necessary to establish, exercise or defend legal claims.

Legal basis: legitimate interest of the Data Controller in protecting its rights.

J. Analytics and measurement

Non-essential analytics technologies may only be used in accordance with applicable legislation and, where required, after obtaining the user's consent.

Legal basis: consent, unless the relevant technology may legally be treated as strictly necessary or equivalent to a technical tool under applicable legislation.

K. Marketing and profiling

Any technologies used for personalised advertising, profiling or remarketing are activated only after obtaining consent where consent is required by law.

Legal basis: consent.

5. WHETHER PROVIDING DATA IS MANDATORY

Information marked as required is necessary to provide the relevant service.

Failure to provide required information may make it impossible to:

  • create an account;

  • complete an order;

  • receive a product;

  • activate a licence;

  • receive support;

  • obtain a response to a request.

Providing information for optional analytics or marketing purposes is voluntary and refusing consent does not prevent the use of essential website functionality.

6. HOW WE PROCESS AND PROTECT DATA

Personal data are primarily processed using electronic and IT systems.

OpenCartItalia implements appropriate technical and organisational measures designed to protect personal data against:

  • unauthorised access;

  • loss;

  • destruction;

  • alteration;

  • unauthorised disclosure;

  • unlawful processing.

Access to personal data is limited to individuals who need such access for legitimate business purposes.

7. RECIPIENTS OF PERSONAL DATA

Where necessary, personal information may be disclosed to service providers supporting OpenCartItalia, including:

  • hosting and infrastructure providers;

  • cloud service providers;

  • email providers;

  • security providers;

  • payment service providers;

  • accounting and tax advisers;

  • legal advisers;

  • developers and technical maintenance providers;

  • analytics service providers, where authorised;

  • public authorities where disclosure is required by law.

Where required by the GDPR, these parties are appointed as Data Processors pursuant to Article 28 GDPR.

OpenCartItalia does not sell personal data to third parties.

8. THIRD-PARTY SERVICES

The website may integrate services supplied by third parties.

In particular, Google Tag Manager is used for technical tag management.

The presence of Google Tag Manager does not in itself mean that analytics or advertising cookies are active. Any non-essential service managed through the tag management system that involves tracking is subject to the user's preferences whenever consent is required.

The website may also use external providers for:

  • payments;

  • hosting;

  • email services;

  • security;

  • analytics;

  • spam prevention;

  • technical services.

Where applicable, an updated list of consent-based cookies and services is available through the Manage Cookies preference panel.

9. INTERNATIONAL DATA TRANSFERS

Some service providers used by OpenCartItalia may process personal data outside the European Economic Area.

Where this occurs, transfers will be carried out in accordance with Articles 44 and following of the GDPR using an appropriate legal transfer mechanism, which may include:

  • European Commission adequacy decisions;

  • Standard Contractual Clauses;

  • frameworks or mechanisms recognised under European data protection law;

  • other appropriate safeguards permitted under the GDPR.

10. DATA RETENTION

Personal data are retained only for as long as necessary for the purposes for which they were collected.

Indicatively:

Contact and quotation requests: up to 12 months after the request is completed, unless a contractual relationship is established.

Account data: for the duration of the account and thereafter for the period necessary to comply with legal obligations or handle disputes.

Orders and accounting/tax records: for the retention period required under applicable legislation, generally up to 10 years.

Licence information: for the duration of the licence and subsequently for the period necessary to provide support, ensure security, handle disputes and protect legal rights.

Technical and security logs: for a period proportionate to security and abuse-prevention requirements, with longer retention where necessary following an incident or investigation.

Reviews: while the review remains published or until a valid removal request is received, where applicable.

Consent-based processing: until consent is withdrawn or the relevant processing purpose is completed, subject to the need to retain evidence of consent where required.

11. AUTOMATED DECISION-MAKING

As part of the normal operation of the website, OpenCartItalia does not make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them, unless expressly stated in a separate notice.

12. DATA SUBJECT RIGHTS

Subject to the conditions set out in applicable legislation, data subjects may exercise the rights provided by Articles 15 to 22 GDPR, including:

  • right of access;

  • right to rectification;

  • right to erasure;

  • right to restriction of processing;

  • right to data portability;

  • right to object;

  • right to withdraw consent at any time;

  • right not to be subject, where applicable, to decisions based solely on automated processing.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Requests may be submitted to:

[PRIVACY EMAIL]

OpenCartItalia may request information necessary to verify the identity of the person submitting the request.

13. RIGHT TO LODGE A COMPLAINT

Data subjects who believe that their personal information has been processed in breach of applicable data protection law have the right to lodge a complaint with the:

Italian Data Protection Authority – Garante per la protezione dei dati personali

without prejudice to any other available administrative or judicial remedy.

14. CHILDREN'S DATA

OpenCartItalia services are primarily intended for businesses, professionals and adult users.

OpenCartItalia does not knowingly seek to collect personal data relating to children through the website.

Where unauthorised processing of a child's personal information is identified, appropriate steps will be taken to delete such information where required by law.

15. EXTERNAL LINKS

The website may contain links to third-party websites or services.

OpenCartItalia does not control how those third parties process personal information.

Users should review the privacy policies of third-party websites before using their services.

16. CHANGES TO THIS PRIVACY POLICY

OpenCartItalia may amend or update this Privacy Policy as a result of:

  • changes in applicable legislation;

  • introduction of new services;

  • technical changes to the website;

  • introduction of new service providers;

  • changes in processing activities.

The updated version will be published on the website together with the date of the latest revision.