How we protect your data

1. Data Controller

The data controller for personal data collected through this site is:

Veritable AG
via Carlo Maderno 9, 6900 Lugano, Switzerland
Responsible: Marco Silvio Jäggi
redazione@emozioni.ch

2. Data collected and purposes

Account and personal area

At registration we collect first name, last name and email address to authenticate access to the reader area. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Subscriptions, purchases, shipping and billing

To process a subscription, a purchase or a shipping request we collect, depending on the service chosen:

• first and last name;
• email address;
• phone number, when provided;
• shipping address;
• billing address;
• “Private” or “Business” indication;
• company name, when the purchase is made by a business;
• VAT number, tax code or other tax identifier, when provided or required for the commercial document;
• products purchased, amount, currency, payment status and order identifiers;
• data needed to generate and retain invoices, receipts and credit notes.

This data is used to conclude and perform the contract, deliver the products, handle support, generate commercial documents and comply with accounting and legal obligations.

Legal bases: performance of a contract, compliance with legal obligations and, for fraud prevention and payment security, legitimate interest.

Payments and billing

Card payments are processed via Stripe. Emozioni does not receive or store the full card number, the CVC code or other complete payment-instrument data.

To process the payment, prevent fraud and send the payment receipt, we may transmit to Stripe:

• name or company name;
• email address;
• billing address and, where necessary, shipping address;
• the business tax identifier, when provided;
• order description, amount, currency and payment status;
• internal identifiers needed to reconcile order, customer and payment.

Stripe also processes technical and anti-fraud data according to its own terms and privacy policy.

Donations

To process a donation we collect first name, last name, email and amount for the purposes of processing the contribution, confirming the donation, accounting records and compliance with applicable legal obligations. Legal basis: performance of a contract.

Newsletter

Newsletter signup requires an email address and explicit consent, and is completed via a confirmation email sent to the address provided (double opt-in): the subscription becomes active only after confirmation. You can unsubscribe at any time via the link in any email or by writing to redazione@emozioni.ch. Legal basis: consent (Art. 6(1)(a) GDPR). Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Contact form

The contact form collects first name, email and message text, used solely to respond to the request. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Server technical logs

Servers record the requested route, HTTP method, browser user-agent and estimated response size for technical diagnostics and performance monitoring. Logs contain no user identifiers and are retained by the hosting provider (Vercel) for a limited period, according to the applicable configuration. Legal basis: legitimate interest (operational security).

3. Cookies and local storage

We do not use advertising cookies, profiling cookies, or cross-site tracking technologies. No cookie-based tools such as Google Analytics, Meta Pixel or Hotjar are present.

To measure site traffic in aggregate we use Umami, a privacy-respecting analytics tool: it sets no cookies, builds no individual profiles, and does not track users across sites. Visits are counted using an anonymous identifier that is derived and rotated daily; the IP address is used only transiently for that calculation and is not stored. The service is provided by Umami Cloud (see the “Third-party service providers” section). Legal basis: legitimate interest in understanding aggregate use of the site.

The site uses only the following strictly necessary technical cookies:

The site uses localStorage solely for a local technical preference (remembering that the announcement banner was dismissed). It is not used for tracking or profiling, and no data is transmitted to third parties. The site does not use sessionStorage or any other form of client-side storage.

Stripe may set its own technical cookies (e.g. __stripe_mid, __stripe_sid) within its payment iframe for fraud prevention. These cookies are governed by Stripe's privacy policy.

4. Third-party service providers (data processors)

Personal data may be transferred to the following providers acting as data processors on behalf of Emozioni:

Address autocomplete queries are forwarded to Geoapify through a server-side proxy. Your IP address is never transmitted to Geoapify.

5. International data transfers

Some providers or sub-processors may process personal data outside Switzerland, the European Economic Area or the United Kingdom. In such cases Veritable AG uses the safeguards provided by applicable law, including adequacy decisions, Standard Contractual Clauses, Swiss addenda, the Data Privacy Framework where applicable, or other adequate contractual and technical measures. Up-to-date information on transfers is available in the terms and DPAs of the respective providers.

6. Data retention

Deleting the account does not delete data that Veritable AG must retain for accounting, tax, anti-fraud obligations or for handling disputes.

7. Your rights

Under GDPR (Arts. 15-22) and the Swiss nFADP, you have the right to:

• Access — obtain confirmation of processing and receive a copy (Art. 15 GDPR)
• Rectification — have inaccurate or incomplete data corrected (Art. 16)
• Erasure — request deletion within the limits of the law (Art. 17)
• Restriction — limit processing in certain circumstances (Art. 18)
• Portability — receive your data in a structured, machine-readable format (Art. 20)
• Objection — object to processing based on legitimate interest (Art. 21)
• Withdraw consent — at any time for consent-based processing, without retroactive effect

To exercise these rights write to redazione@emozioni.ch. We respond without undue delay and within the deadlines provided by applicable law.

Deleting the account does not automatically remove invoices and accounting documents subject to mandatory retention.

You also have the right to lodge a complaint with the competent supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the data protection authority in your country of residence.

8. Security

We implement the following technical and organisational security measures:

• Encrypted transmission via HTTPS with HSTS (2 years)
• Role-based access control (principle of least privilege)
• No payment data stored on our servers: payments are processed exclusively by Stripe in a PCI-DSS certified environment
• Content Security Policy with nonce to prevent XSS attacks

9. Changes to this policy

This policy may be updated to reflect changes to our services or applicable law. Significant changes will be communicated to registered users by email. The “Last updated” date at the top of the page indicates the current version.

For any questions, write to redazione@emozioni.ch.