Privacy Policy
Last updated: 19 October 2026
This English version is provided for convenience. In case of discrepancies, the Italian version prevails.
This notice is provided pursuant to Articles 12 and 13 of Regulation (EU) 2016/679 (“GDPR”) to users of the website https://armivarie.it (the “Website”), operated by ARMIVARIE. It concerns browsing, information requests and the features of the Website. It does not replace any notices required for processing carried out in the course of in-store business, including processing required by public security regulations.
1. Data controller
Armivarie di Simoni Mirco (“ARMIVARIE”), VAT no. 04454390289.
Registered office: Via Gauslino 12, 35028 Piove di Sacco (PD), Italy · REA PD-390913.
Place of business (shop): Via Gelsi 14/A, 35028 Piove di Sacco (PD), Italy.
Email: armivarie@gmail.com · Telephone: +39 345 511 4310.
2. What data we process and why
| Processing | Data concerned | Purpose | Legal basis |
|---|---|---|---|
| Browsing the Website and the catalogue | IP address, HTTP requests, date and time, technical data about the device and browser, strictly necessary logs | Delivering the pages and ensuring their operation and continuity | Art. 6(1)(f) GDPR: legitimate interest in the operation and security of the service |
| Protecting the Website and preventing abuse | Error and security logs, unauthorised access attempts and technical signals | Detecting and countering abuse, intrusion attempts and anomalies | Art. 6(1)(f): legitimate interest in security; Art. 6(1)(c) for any specific obligations |
| Information requests by phone or email | Contact details provided, content of requests and correspondence | Replying to data subjects and, where requested, taking steps prior to entering into a contract | Art. 6(1)(b) for pre-contractual requests; Art. 6(1)(f) for general requests |
| Management of the admin area | Protected credentials (password stored only as a hash), session tokens, authentication attempts, administrative operations | Authenticating authorised operators and protecting management functions | Art. 6(1)(f): security and organisation |
| Counting catalogue views | The item viewed and a pseudonymous technical identifier calculated by the server from IP address and browser using a secret key; the identifier changes every day, is not stored on the user's device and is deleted within 48 hours. Only overall counts per item remain, which identify no one | Showing the number of views while avoiding counting the same visit more than once on the same day. Not used for profiling or combined with other data | Art. 6(1)(f): legitimate interest in essential, non-profiling catalogue statistics |
| Essential preferences | Age confirmation and the choice regarding the Google map, stored in the user's browser | Remembering the settings expressed and the consent or refusal | Art. 6(1)(f) for strictly necessary technical functions; Art. 6(1)(c) for evidence of the choice where required |
| Google map enabled by the user | Technical data sent by the browser to Google after the user voluntarily loads the map | Showing the shop location on Google Maps, on request only | Art. 6(1)(a): consent, given by loading the map or through “Cookie preferences”. Processing carried out by Google is governed by its own policies |
The Website has no customer accounts, cart, payments or document upload forms. No automated checks of licences for the purchase of firearms are carried out through the Website. Users are asked not to send identity documents, police licences or other sensitive documents by ordinary email unless an appropriate and secure procedure is subsequently indicated.
3. Whether providing data is mandatory
Simply browsing the Website involves the processing of the technical data needed for the connection. Sending an email or providing information by phone is voluntary; without the necessary data we will not be able to reply to or handle the request. Optional features that require consent remain disabled if no choice is made or consent is refused, without preventing access to the content of the Website.
4. Cookies and other storage tools
The Website uses only technical tools: a session cookie for the admin area only, and the browser's local storage to remember the age confirmation (30 days) and the choice regarding the Google map. The language depends on the page address and is not stored. The Google map, the only optional external service, is loaded only at the user's request. For the full list, please see the Cookie Policy, available from every page.
5. Recipients and providers
Data may be processed by authorised staff and collaborators and by providers of IT, hosting, security and maintenance services. Cloudflare services are planned for publishing the Website. Emails sent to armivarie@gmail.com are handled through Google's Gmail email service. The Google Maps map is made available only at the user's request. Fonts are hosted directly on the Website, without connections to external services.
Providers acting as data processors are bound by agreements pursuant to Article 28 GDPR, where necessary. Some parties may process data as independent controllers, as indicated in their respective notices. Data may be disclosed to public authorities where required by law.
6. Transfers to countries outside the EEA
The provision of digital services by international providers may involve access to or transfer of personal data outside the European Economic Area. Where this occurs, the controller verifies the legal basis for the transfer and the safeguards provided for in Chapter V GDPR (for example applicable adequacy decisions or standard contractual clauses with the necessary supplementary measures). Further information on the safeguards adopted can be requested using the controller's contact details.
7. Retention periods
Data are kept for as long as necessary for the purposes set out above, in line with data minimisation:
- Email requests: normally up to 12 months from the last interaction, unless a relationship continues, legal obligations apply or rights need to be protected.
- Application and security logs under ARMIVARIE's direct control: normally a maximum of 30 days, except in case of incidents and legal obligations.
- Records of admin area login attempts: a maximum of 30 days.
- Admin area sessions: until logout or expiry (12 hours); expired sessions are deleted.
- Identifiers used to count views: deleted within 48 hours; only aggregate counts remain.
- Age confirmation: 30 days on the user's device.
- Choice regarding the Google map: up to 12 months on the user's device, or until changed or withdrawn.
Backup copies of the Website, which may contain the data listed above, are kept in protected form for as long as necessary to ensure that the service can be restored. Any data relating to commercial relationships or public security obligations are governed by their own notices and retention periods.
8. Security
ARMIVARIE adopts technical and organisational measures proportionate to the risks, including protection of administrative access, control of privileges, use of encrypted connections, protection of authentication data, updates, backups and security checks. No transmission over the internet can be guaranteed to be entirely risk-free.
9. Rights of data subjects
In the cases and within the limits provided for by the GDPR, data subjects may request access, rectification, erasure, restriction of processing, objection to processing based on legitimate interest and data portability, where applicable. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of earlier processing; the choice regarding the Google map can be changed from the “Cookie preferences” link on every page. Requests can be sent to armivarie@gmail.com. The controller replies within the legal time limits, normally within one month, subject to justified extensions.
You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), and to bring proceedings before the competent courts.
10. Minors
The Website is intended for an adult audience and includes an age self-declaration screen. This screen does not carry out any documentary verification of identity or age. Anyone under 18 is asked not to use the catalogue reserved for adults.
11. Automated processing
No automated decisions, including profiling, producing legal or similarly significant effects on users within the meaning of Article 22 GDPR are made. The technical operation of the catalogue, filters and security does not in itself involve such decisions.
12. Updates
This notice may be updated to reflect changes in processing, providers or legislation. The current version, with its update date, is available on this page. Any substantial changes will be communicated by appropriate means.