Personal Data Privacy Notice

This notice covers www.carlocestra.com and its digital store at www.carlocestra.com/3dmodels_store/. It is prepared under Articles 12 and 13 of Regulation (EU) 2016/679 (GDPR).

1. Data controller

Cestra Carlo – Carlo Cestra Digital Productions
Italian VAT number: 17544781002
Privacy contact: info@carlocestra.com
Registered office: Via Mediana 51, 00079 Rocca Priora (RM), Italia

2. Categories of personal data

• Technical access and security data, such as IP address, request date and time, browser information and server logs, subject to the hosting configuration.
• Information supplied during purchases and support requests: name, email, billing details where necessary, purchased items, amounts, order references and communications.
• Payment status and transaction identifiers received through PayPal; the store does not directly request full payment-card details.
• Messages voluntarily sent by email or through external social platforms.

3. Purposes and legal bases

• Cart, orders, payment, digital delivery, download recovery and support: performance of a contract or pre-contractual steps (GDPR Art. 6(1)(b)).
• Invoicing, tax records and statutory requirements: legal obligation (Art. 6(1)(c)).
• Security, abuse prevention and protection of legal rights: the controller’s legitimate interests (Art. 6(1)(f)), subject to the applicable balancing assessment.
• Responding to information or quotation requests sent by email or social media: pre-contractual steps at the requester’s initiative (Art. 6(1)(b)), where applicable.

A purchase or contact request does not automatically subscribe the person to a newsletter. Any marketing activity will require appropriate information and a valid legal basis.

4. Whether providing data is necessary

Data necessary to process orders and meet legal obligations must be provided to complete a purchase. Sending messages or inquiries is optional, but a contact address is needed to reply.

5. Recipients and service providers

Data may be processed as necessary by the Aruba hosting and email provider, payment provider PayPal, and professionals engaged for administrative or tax obligations. Providers process data according to their applicable roles and arrangements.

Links to Facebook, LinkedIn, YouTube, Vimeo and Instagram lead to external services that process data under their own privacy notices. A simple link does not itself imply data collection through an embedded social widget.

6. International transfers

Some providers, including PayPal and external services users may choose to visit, may process or transfer data outside the European Economic Area. Such processing is subject to the safeguards applicable to the respective providers, such as adequacy decisions or standard contractual clauses where relevant. For information about safeguards relating to processing controlled by the website operator, please contact the email address above.

7. Retention

Order and invoice records are retained for periods required by applicable tax and accounting laws. Support inquiries and contacts are kept only as long as needed to handle them and protect legal rights where necessary. Technical sessions are maintained for as long as needed for service operation and security; logs and backups are kept according to hosting settings and security needs. Purchase and download-access information may be retained to provide support and allow customers to recover purchased products, subject to necessity and applicable limitation periods.

8. Cookies and external content

The store uses a strictly necessary session cookie named store_live for the cart, language preferences, security and purchasing functions. The main website is not intended to use Google Analytics following removal of its code from the pages reviewed. Strictly necessary technical cookies do not require prior consent. On product pages, YouTube video previews are displayed without contacting YouTube: the external service is contacted only after the visitor explicitly presses the button to load a video, including in the enlarged gallery and when navigating with arrows. At that point YouTube may receive technical browsing data and use its own technologies under its privacy notice.

If profiling or other non-essential tracking technologies are present, the applicable information and consent mechanisms must be implemented before they are used.

9. Your rights

Where provided by the GDPR, individuals may request access, rectification, erasure, restriction, data portability and object to processing based on legitimate interests. Requests may be sent to info@carlocestra.com. Individuals may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

10. Automated decisions and updates

The store does not use solely automated decision-making producing legal or similarly significant effects on customers. This notice will be updated if processing activities change.

Last updated: 29 October 2026