PRIVACY POLICY – EU/EEA

PRIVACY POLICY – EU/EEA

Last updated: 25 August 2026

1. Who We Are

This Privacy Policy explains how personal data is processed when you visit or purchase from Puzzle3D.co.

The Data Controller is:

MEDDYS SNC
Via Bologna 10
25073 Bovezzo (BS)
Italy

Website: Puzzle3D.co
Email: support@puzzle3d.co
Telephone: +39 371 5394 647

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), applicable Italian data-protection legislation and other applicable European privacy laws.

2. Principles We Follow

When processing personal data, we seek to comply with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

We collect only personal data that is reasonably necessary for the purposes described in this Privacy Policy and retain it only for as long as required for those purposes or by applicable law.

3. Personal Data We May Collect

Depending on how you use Puzzle3D.co, we may process the following categories of personal data:

  • first and last name;
  • billing and shipping address;
  • email address;
  • telephone number;
  • customer account information;
  • order and purchase history;
  • invoicing and tax information;
  • payment-related transaction information;
  • IP address;
  • browser, device and technical information;
  • cookie identifiers and similar online identifiers;
  • website usage information;
  • communications sent to Customer Support;
  • newsletter subscription preferences;
  • fraud-prevention and security information.

We do not normally receive or store complete payment-card details when payments are processed by external payment providers.

4. Orders and Purchases

When you place an order, we process the information necessary to:

  • process and confirm your purchase;
  • receive or verify payment;
  • prepare and ship your order;
  • provide tracking information;
  • issue invoices and other accounting documentation;
  • process returns, refunds and warranty requests;
  • provide customer support.

The data may include your name, billing and delivery address, email address, telephone number, order details, transaction details and relevant tax information.

Legal basis: performance of a contract or steps taken at your request before entering into a contract, and compliance with applicable legal obligations.

We retain transaction and accounting information for the periods required by applicable tax, accounting and commercial legislation.

5. Payments

Payments may be processed through third-party payment service providers.

Depending on the selected payment method, the payment provider may process information such as your name, transaction amount, payment method, billing information, fraud-prevention information and technical data.

Where payment processing is handled directly by a third-party provider, that provider may act as an independent controller or processor for certain activities under its own privacy policy.

Legal basis: performance of the purchase contract, compliance with legal obligations and, where applicable, legitimate interests in fraud prevention and transaction security.

6. Customer Accounts

If you create a customer account, we may process:

  • your name;
  • email address;
  • username;
  • password in protected or hashed form;
  • address information;
  • order history;
  • account preferences.

We use this information to create and maintain your account, allow you to access previous orders and simplify future purchases.

Legal basis: performance of a contract or provision of services requested by you.

Account information is retained while the account remains active and afterwards only for as long as reasonably necessary or legally required.

7. Customer Support and Communications

When you contact us by email, telephone, website form or another communication channel, we may process:

  • your name;
  • contact details;
  • order number;
  • correspondence;
  • information you voluntarily provide in connection with your request.

We use this information to answer questions, resolve problems and provide after-sales support.

Legal basis: performance of a contract, steps taken at your request, or our legitimate interest in providing customer service and managing business communications.

Support correspondence may be retained for a reasonable period after the matter has been resolved and longer where required for legal or contractual purposes.

8. Newsletter and Marketing

If you voluntarily subscribe to our newsletter, we may process your email address, name where supplied, subscription status and information required to manage your marketing preferences.

We use this information to send newsletters, offers, product announcements and other promotional communications.

Legal basis: your consent, where consent is required.

You may withdraw your consent at any time by using the unsubscribe link contained in marketing emails or by contacting us.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. The GDPR specifically gives individuals the right to withdraw consent.

We may retain limited information about an unsubscribe request to ensure that your marketing preference continues to be respected.

9. Website Analytics

We may use analytics tools to understand how visitors interact with Puzzle3D.co, improve site performance, identify technical problems and understand general usage trends.

Depending on the configuration and your cookie choices, analytics data may include:

  • IP address or truncated IP information;
  • device and browser type;
  • pages viewed;
  • approximate location derived from IP address;
  • referral source;
  • interaction and navigation information;
  • cookie or similar identifiers.

Where analytics technologies require consent under applicable law, they are activated only after the required consent has been obtained.

For details about the technologies currently used on Puzzle3D.co, please refer to our Cookie Policy.

10. Advertising and Remarketing

If advertising or remarketing technologies are used on Puzzle3D.co, they may process online identifiers and information about interactions with the website.

Such technologies may be used to measure advertising effectiveness or display advertising based on previous interactions with the website.

Where required by law, advertising and remarketing cookies or similar technologies are activated only after you have provided consent.

You can change or withdraw your cookie preferences using the cookie controls available on the website.

11. Cookies and Similar Technologies

Puzzle3D.co uses cookies and similar technologies for purposes such as:

  • essential website functionality;
  • shopping cart and checkout functionality;
  • security;
  • account sessions;
  • preferences;
  • analytics;
  • advertising, where enabled and consented to.

Strictly necessary cookies may be used without consent where permitted by law because they are necessary to provide the website or service requested by the user.

Non-essential cookies are managed in accordance with applicable consent requirements.

Please see our Cookie Policy for additional information, including the cookies and services currently used.

12. Shipping and Logistics Providers

To deliver purchases, we may share the information necessary for delivery with shipping and logistics providers.

This can include:

  • recipient name;
  • shipping address;
  • telephone number;
  • email address;
  • shipment and tracking information.

The information is shared only to the extent required to fulfil and manage delivery.

Legal basis: performance of the purchase contract.

13. Service Providers and Recipients

We may share personal data with service providers where necessary for operating Puzzle3D.co and providing our services.

Depending on the services currently used, recipients may include:

  • web-hosting and infrastructure providers;
  • ecommerce and website technology providers;
  • payment processors;
  • shipping and logistics companies;
  • email and transactional-mail providers;
  • newsletter platforms;
  • analytics providers;
  • security and fraud-prevention providers;
  • accountants, tax advisers and professional advisers;
  • public authorities where disclosure is legally required.

Service providers acting as processors are required, where applicable, to process personal data only on documented instructions and to provide appropriate safeguards.

14. International Data Transfers

Some service providers may process personal data outside the European Economic Area.

Where personal data is transferred to a country outside the EEA that does not benefit from an adequacy decision, we use an appropriate transfer mechanism where required, such as Standard Contractual Clauses adopted by the European Commission or another legally recognised safeguard.

Where applicable, you may contact us for additional information concerning the safeguards used for international transfers.

15. Legal Obligations

We may process and retain certain personal data where necessary to comply with legal obligations, including:

  • taxation;
  • accounting;
  • invoicing;
  • consumer-protection obligations;
  • fraud prevention;
  • compliance with lawful requests from public authorities;
  • establishment, exercise or defence of legal claims.

Legal basis: compliance with a legal obligation and, where appropriate, legitimate interests in establishing or defending legal rights.

16. Fraud Prevention and Website Security

We may process technical, account and transaction information to protect:

  • customer accounts;
  • payment transactions;
  • our website;
  • our infrastructure;
  • our business against fraud, misuse, cyberattacks or unauthorised access.

Legal basis: our legitimate interests in maintaining the security and integrity of our systems and services, provided those interests do not override the fundamental rights and freedoms of individuals.

Legitimate interest is one of the processing bases expressly recognised under the GDPR, subject to the required balancing of interests.

17. Data Retention

We do not use one universal retention period for all personal data.

Instead, personal data is retained according to the purpose for which it was collected and applicable legal requirements.

For example:

  • order, invoicing and accounting information is retained for the period required by applicable law;
  • account information is generally retained while an account remains active and for an appropriate period afterwards;
  • customer-support communications are retained for as long as reasonably necessary to handle the request and related legal requirements;
  • newsletter information is retained until consent is withdrawn or the subscription otherwise ends, subject to limited suppression records;
  • security logs are retained only for a period proportionate to security and fraud-prevention needs;
  • cookie and analytics data is retained according to the durations disclosed in the Cookie Policy and the relevant service configuration.

The GDPR requires personal data not to be kept longer than necessary for the purpose for which it was collected.

18. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against:

  • unauthorised access;
  • unlawful processing;
  • accidental loss;
  • destruction;
  • alteration;
  • disclosure.

Access to personal data is limited to persons and service providers who require it for legitimate business or legal purposes.

No internet-based system can guarantee absolute security, but we regularly assess appropriate measures in relation to the nature and risks of the processing.

19. Third-Party Websites

Puzzle3D.co may contain links to websites operated by third parties.

This Privacy Policy does not apply to independently operated third-party websites.

We recommend reviewing the privacy policy of any external website before providing personal information.

20. Automated Decision-Making

We do not intend to make decisions producing legal or similarly significant effects on customers solely through automated processing unless such processing is specifically disclosed and permitted by applicable law.

Fraud-prevention or payment providers may use automated systems as part of their own services. Where appropriate, their privacy information should be consulted for further details.

21. Your GDPR Rights

Subject to the conditions and exceptions provided by applicable law, you may have the right to:

  • obtain confirmation as to whether we process your personal data;
  • access your personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of personal data;
  • request restriction of processing;
  • object to certain processing;
  • receive certain personal data in a portable format;
  • withdraw consent where processing is based on consent;
  • lodge a complaint with a competent supervisory authority.

These rights are established under the GDPR and are also described by the Italian Data Protection Authority.

The right to deletion is not absolute. For example, we may be required to retain invoices, accounting records or other information because of legal obligations.

22. How to Exercise Your Rights

You may exercise your privacy rights by contacting:

support@puzzle3d.co

Please describe the request clearly and provide sufficient information for us to identify the relevant data.

We may request appropriate information to verify your identity before completing a request, where necessary to prevent unauthorised disclosure or deletion of personal data.

Under the GDPR, requests should generally be answered within one month, although this period may be extended in particularly complex cases in accordance with the Regulation.

23. Right to Object to Direct Marketing

You have the right to object at any time to the processing of your personal data for direct-marketing purposes.

Where you object to direct marketing, we will stop processing your personal data for that purpose.

You can also unsubscribe from marketing emails using the unsubscribe link included in each marketing communication.

24. Complaints

If you believe that your personal data has been processed in violation of applicable data-protection legislation, you may lodge a complaint with the competent supervisory authority.

For Italy, the supervisory authority is:

Garante per la protezione dei dati personali

The Italian Garante confirms that individuals may submit complaints concerning alleged violations of data-protection law.

You may also have the right to contact the supervisory authority in the EU/EEA country where you habitually reside or work.

25. Children

Puzzle3D.co sells products that may be suitable for children, but the online store is intended to be used for purchases by adults.

We do not knowingly seek to collect personal data directly from children for the purpose of creating customer accounts or making purchases without the involvement of an adult legally authorised to do so.

If you believe that a child has provided personal information to us improperly, please contact us.

26. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

  • our services;
  • the technologies used on the website;
  • service providers;
  • legal requirements;
  • our data-processing practices.

The current version will be published on Puzzle3D.co with the latest revision date.

Where a change materially affects processing based on consent, we will obtain new consent where required by applicable law.

27. Contact Details

For privacy-related questions or requests, please contact:

MEDDYS SNC
Via Bologna 10
25073 Bovezzo (BS)
Italy

Website: Puzzle3D.co
Email: support@puzzle3d.co
Telephone: +39 371 5394 647