Privacy and cookies

Notice under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Last updated: 1 November 2026. The Italian version prevails.

1. Data controller

Pasticceria Rosá di De La Rosa Rachel, VAT no. 14348180960, Via IV Giugno 25, 20013 Magenta (MI), Italy.
Contact: WhatsApp +39 375 126 5018 · email delarosarachel95@gmail.com.

2. What data we process and why

a) Browsing data

When you visit the website, the server that hosts it automatically records some technical data (IP address, date and time, page requested, browser type). It is used only to run the website and protect it from abuse. Legal basis: our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR). We do not use it to identify you or for marketing.

b) Data you send us for an order or a quote

The order form sends nothing to our server: it builds a message in your browser with what you typed (name, type of cake, occasion, date, number of people, message and idea) and opens WhatsApp. If you send it, we receive that message and your phone number, plus any reference photos you choose to share.

We use them to reply, prepare a quote, and handle the order and pickup. Legal basis: steps taken at your request before entering into a contract, and the contract itself (Art. 6(1)(b) GDPR) and, for tax documents, a legal obligation (Art. 6(1)(c) GDPR).

c) Allergies and intolerances

If you tell us about an allergy or intolerance, we use it only to make your cake safely. As it is health-related data, we process it on the basis of your explicit consent, given by telling us (Art. 9(2)(a) GDPR), and we use it for nothing else.

3. Providing your data

Writing to us is optional. Without some details (for example the date and number of people), though, we cannot prepare a quote.

4. Who receives the data

• Hosting provider (Hostinger International Ltd, Cyprus, EU): hosts the website and keeps browsing data as a data processor.
• Website technical support (AGC Web Studio): may access the website only for maintenance, as a data processor.
• WhatsApp (WhatsApp Ireland Ltd, Meta group): when you write to us, WhatsApp processes data as an independent controller under its own privacy policy. Meta may transfer data to the United States under the EU-US Data Privacy Framework.
• Accountant or tax advisor, only for the order's accounting documents.

We never sell or pass on your data and we do not use it for advertising.

5. How long we keep it

• Messages and order details: for as long as needed to handle the request and any order, and no longer than 12 months after the last contact, unless you ask us to delete them sooner.
• Tax documents: 10 years, as required by law (Art. 2220 of the Italian Civil Code).
• Browsing data: for the technical period set by the hosting provider.

6. Your rights

At any time you can ask to access, correct or delete your data, restrict its use, receive it in a readable format, or object to processing based on legitimate interest (Articles 15-22 GDPR). If you gave consent, you can withdraw it whenever you like. Just write to us using the contacts in section 1.

If you believe your data is not being handled correctly, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali.

We make no automated decisions and do no profiling.

7. Cookies

This website sets no cookies, technical or profiling, and uses no analytics tools (such as Google Analytics) or advertising pixels. Fonts are loaded from our own server, not from external services.

That is why we show no banner: under the Italian Data Protection Authority's cookie guidelines (10 June 2021), consent is only needed for non-technical cookies and trackers. If we ever add any, we will ask you first, with the option to refuse.

Links to Instagram, WhatsApp and Google Maps take you to external websites with their own privacy and cookie rules.