This page explains what personal data we collect, why, how long we keep it and who we share it with. It is the notice required by Articles 13 and 14 of Regulation (EU) 2016/679 (the «GDPR») and by the Italian data protection code (Legislative Decree 196/2003 as amended by Legislative Decree 101/2018).
1. Who handles your data
The data controller is MasterTuning S.R.L., registered office at Via di Salsola 141, 71121 Foggia (FG), Italia, VAT and tax number IT04469680716, entered in the Register of Companies of Foggia under REA no. FG-330298.
For anything concerning your data you can write to [email protected], to our certified email address (PEC) [email protected], or call 0881 045777.
We have not appointed a Data Protection Officer: none of the cases that make one mandatory under Article 37 of the GDPR applies to us. Requests therefore go to the address above, which is monitored.
2. What we collect, what for, and on what legal basis
We do not collect data «in general»: every piece of information that reaches us serves a specific purpose and has a specific legal basis. The full list follows.
a) If you buy from the shop
Data: first and last name, company name if you buy as a business, billing and delivery address, email address, telephone number, and the tax details an Italian invoice requires (tax code, VAT number, SDI recipient code or certified email address). To these are added the contents of the order, the amount, the payment method chosen and the status of the shipment.
Why: to conclude the contract, ship the goods, issue the invoice, handle the right of withdrawal and the guarantee, and to answer you if something goes wrong.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) for the sale and the delivery; legal obligation (Art. 6(1)(c)) for invoicing and accounting records.
Is it compulsory? Yes, this data is necessary: without it we cannot accept the order or issue the invoice.
b) If you write to us through the contact form or ask for a quote
Data: name, email address, telephone number, town and province, company if any, and the text of your message with the vehicle details you give us. We also record your IP address and the moment you ticked the consent box, because that is the proof that the message was sent deliberately.
Why: to answer you, prepare your quote and get back to you about that enquiry.
Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
Is it compulsory? The fields marked in the form, yes; the others, no. If you do not tell us the vehicle model the answer will be more general, but the form will still be sent.
c) If you register an account
Data: email address, password (which we store only in encrypted form and cannot read), and the billing details you choose to save so as not to retype them with every purchase.
Why: to give you access to your own area, to the history of your orders and to pre-filled details at the checkout.
Legal basis: performance of the service contract (Art. 6(1)(b) GDPR).
A note for existing customers: if you had an account on our previous website, your details and your orders have been transferred to the new one. Same controller, same purpose, same legal basis: it is not a disclosure to a third party, it is the same relationship continuing on different software.
d) If you apply to become an installer
Data: the workshop's details and the contact details of the person writing.
Why: to assess the application and get back to you.
Legal basis: steps taken at your request prior to a contract (Art. 6(1)(b) GDPR).
e) Security of the site and of the forms
Data: IP address, browser type, date and time of requests; for public forms, the result of the Cloudflare Turnstile anti-abuse check.
Why: to prevent automated submissions, password-guessing attempts and attacks on the site.
Legal basis: our legitimate interest in protecting the service and those who use it (Art. 6(1)(f) GDPR). The interest is ours but it is yours as well: without these checks your inbox would receive anyone's message and your account would be easier to break into.
f) Statistics and advertising
Data: pages visited, where you came from, device, and identifiers assigned by the Google, Meta and TikTok services.
Why: to count visits, understand which pages are actually useful and measure the results of our advertising, including the possibility of showing you our ads again on other sites.
Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian privacy code), collected through the banner on your first visit and revocable at any time. Until you choose, none of these services is loaded: your browser does not contact them at all. Every detail, service by service, is in the Cookie policy.
g) The record of your cookie choice
Data: the categories you accepted or refused, the version of the notice that was in front of you, the date, the page you chose from, the language, your IP address and your browser.
Why: Article 7(1) of the GDPR requires us to be able to demonstrate that consent was given. This record serves only that purpose and is not used to profile you.
Legal basis: legal obligation (Art. 6(1)(c) GDPR) in connection with Art. 7(1).
3. What we do not do
- We do not send promotional emails. The site only sends emails connected to an order (confirmation, payment received, shipment) and the one for resetting your password. There is no newsletter and no list of addresses we write to.
- We do not sell or hand over your data to anyone. The parties listed in section 5 process it on our behalf, or because the law requires it, not for their own purposes.
- We do not take automated decisions producing legal effects concerning you within the meaning of Art. 22 GDPR. The advertising profiling described in 2(f) happens only with your consent, decides nothing about you and can be withdrawn.
- We do not process special categories of data (health, opinions, beliefs, biometric data) and we do not ask you for any. If you write such data to us of your own accord, we delete it.
- We do not address children under 16. The shop sells professional equipment and vehicle components. If we find we have collected the data of a child under 16 without the consent of the person holding parental responsibility, we delete it.
4. How long we keep data
- Orders, invoices and accounting records: 10 years from registration. This is not our choice: Article 2220 of the Italian Civil Code and tax law require it.
- Form enquiries: 24 months from the last contact. After that they are deleted, because a three-year-old request for a quote is of no use to anyone.
- Account: as long as you want it. It is deleted when you ask us to. The data of orders already placed stays for the 10 years above, because that we cannot delete.
- Record of the cookie choice: 5 years. The choice itself lasts 180 days and then the question is asked again; the record lasts longer because it is the proof of consent.
- Browsing sessions: 120 minutes of inactivity, then they expire.
- Server technical logs: as long as needed for security and fault diagnosis, and in any case no longer than 12 months.
Beyond these periods data is deleted or anonymised, unless it is needed to defend ourselves in proceedings already under way: in that case it is kept until they end.
5. Who we share data with
Your data is accessible to our authorised employees and collaborators, who are instructed and bound to confidentiality. Outside the company, data reaches only those who provide a necessary service, appointed as processors under Article 28 of the GDPR, or those with their own legal entitlement:
- Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen (Germany) — Falkenstein data centre, Germany — the machines on which the site and the database live, and on which backups are kept.
- Stripe Payments Europe, Ltd. (Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — for card and PayPal payments. Your card details never pass through this site and we never see them: they are collected directly by the payment provider on its own systems. These parties also process data as independent controllers, for the anti-money-laundering and fraud-prevention obligations that apply to them.
- Cloudflare, Inc. — for the anti-abuse check on forms (Turnstile) and for the domain's DNS service.
- Google Ireland Limited, Meta Platforms Ireland Limited and TikTok Technology Limited — for statistics and advertising, only if you have given consent. For those purposes they act as independent or joint controllers under the terms of their own services.
- OpenStreetMap Foundation — the maps on the contact page and the installer list load their map images from its servers, which therefore receive your IP address. We say so because it happens even without consent: the map is part of the function you asked for by opening that page.
- The courier handling the delivery, which receives your name, address and telephone number in order to deliver the parcel.
- Tax and accounting advisers, auditors and lawyers, within the limits of their respective engagements.
- The supplier that develops and maintains the site, for technical work, with access limited to what is needed and for as long as it is needed.
- Public authorities, where required by law or by an order of an authority.
6. Does data leave the European Union?
The site, the database and the backups are in Germany, and therefore inside the European Union.
Some of the services listed above belong to groups based in the United States and may transfer data there: this is the case for Cloudflare, Google, Meta, TikTok and, within the Stripe group, Stripe, Inc. Those transfers take place on the basis of the European Commission's adequacy decision of 10 July 2023 for organisations certified under the EU-U.S. Data Privacy Framework, or of the standard contractual clauses adopted by the Commission (Art. 46(2)(c) GDPR), together with the supplementary measures provided by the supplier.
If you want to avoid the transfers connected with statistics and advertising altogether, simply refuse those two categories in the banner: the services concerned are then not loaded at all.
7. Your rights
In relation to data concerning you, you may exercise, free of charge, the rights set out in Articles 15 to 22 of the GDPR:
- Access (Art. 15): to know what data we hold and obtain a copy of it.
- Rectification (Art. 16): to correct data that is wrong or incomplete. You can correct your billing details yourself from your own area, without asking anyone.
- Erasure (Art. 17): to have yourself deleted, to the extent that the law does not oblige us to keep the data (invoices, for example, stay).
- Restriction (Art. 18): to ask us to freeze processing while a dispute is clarified.
- Portability (Art. 20): to receive, in a machine-readable format, the data you provided to us on the basis of the contract or of consent.
- Objection (Art. 21): to object to processing based on our legitimate interest.
- Withdrawal of consent (Art. 7(3)): to withdraw at any time the consent given for statistics and advertising, without having to give a reason and without this making what was done before unlawful. For cookies, reopen the choices panel from the link at the bottom of the Cookie policy.
How to do it: write to [email protected] stating what you are asking for. We reply within one month; if the request is complex the period may be extended by two months, and in that case we tell you within the first month and explain why. To avoid handing one person's data to another, we may ask you for something that confirms your identity: we ask for the bare minimum and do not keep the document.
If you believe the processing infringes the law, you may lodge a complaint with the supervisory authority: Garante per la protezione dei dati personali (Italian data protection authority), Piazza Venezia 11, 00187 Rome, Italy — www.garanteprivacy.it. The judicial remedy remains open to you in any case.
8. If this notice changes
If we change the way we handle data, we update this page and change the date at the bottom. When the change concerns trackers, the version of the cookie notice changes too: in that case the choice you had made lapses and the banner asks you again what you prefer, because consent given on a different text is not consent on this one.
9. The other pages to read alongside this one
- Cookie policy — the list of cookies and trackers, one by one, with names and durations.
- Terms and conditions of sale — how a purchase is concluded.
- Legal notice — the company's details and the mandatory e-commerce information.
Last updated: 1 October 2026.