Privacy Notice

Version v1. General notice for the Gateway (payments.dreamersware.com) and for the processing operations common to the orders of all DreamersWare sites/brands. It is rendered in HTML and hosted on the gateway, linked from the Sites' footers. For cookies, see the separate Cookie Policy (/legal/en/cookie-policy). Individual Sites may have site-specific supplementary notices (see section 1).

This document is a courtesy translation of the Italian original, provided for convenience. Only the Italian version (/legal/privacy) is authentic and legally binding; in the event of any discrepancy, the Italian text prevails. The contractual relationship is governed by Italian law.

Data Controller: DreamersWare S.r.l.s. — Registered office: Via Carlo Porta 2, 21052 Busto Arsizio (VA), Italy — registered with the Varese Companies Register, tax code and registration no. 04151010123 — R.E.A. VA-405537 — share capital €1,200.00 fully paid up — VAT no. IT04151010123. Privacy contact: policy@dreamersware.com (subject line "Exercise of privacy rights"). Support: help@dreamersware.com.

1. Scope

This notice covers: (a) browsing on the DreamersWare sites; (b) the order and payment process handled by the gateway payments.dreamersware.com on behalf of all the Sites; (c) the order confirmation on a durable medium and the record of the acceptances, declarations and other contractual statements made at checkout. It covers the processing operations common to all the Sites; individual Sites may provide specific, supplementary privacy notices, made available by the Site itself (e.g. save-me.ai: heir contacts / digital legacy, use of AI platforms including outside the EU). For cookies, please refer to the Cookie Policy (/legal/en/cookie-policy).

2. Categories of data processed

2.1 Browsing data (unchanged from the existing notice) — IP address, date/time, URL/method/HTTP status, user-agent, recorded in the server logs for security purposes and aggregate statistics.

2.2 Order and payment data:

• the customer's email address (mandatory, used to send the order confirmation on a durable medium);
• order details: products, amounts, currency, commercial category, duration/renewal, Site of origin;
• payment data: handled by the provider Banca Sella / Fabrick; DreamersWare does not store full payment-instrument details, but receives the transaction outcomes and references;
• for business customers: company name, VAT number or tax code, contact person.

2.3 Record of the acceptances, declarations and other contractual statements made at checkout: these are contractual statements (acceptance of the Terms, declarations and acknowledgements under the Italian Consumer Code (Codice del Consumo), e.g. the loss of the right of withdrawal or the B2B declaration), not consents within the meaning of Articles 6(1)(a) / 7 GDPR. For evidentiary purposes, the following are recorded at the time of purchase: the text of the clause accepted, its version, the language, the server-side timestamp and — where transmitted by the Site of origin — the user's IP address, user-agent and checkout session identifier.

2.4 Confirmation on a durable medium: the order document in PDF (with an integrity seal) sent by email and retained as evidence of the transaction and of the contractual acceptances/declarations.

3. Provision of data

Provision of the data needed for technical browsing, order handling, payment, sending the order confirmation and tax/accounting compliance is necessary to conclude and perform the contract. Failure to provide the mandatory data may prevent completion of the order, payment, delivery of the service/product or the requested support. Provision of any non-essential data is optional; failure to provide it does not affect the purchase, unless such data are needed for a specific request made by the data subject.

4. Purposes and legal bases

5. Retention period

• Browsing logs: max 7 days (unless an incident is under investigation); security tracking data: max 180 days (unchanged).
• Order data, order confirmations and tax-relevant documentation are normally retained for 10 years (Article 2220 of the Italian Civil Code (Codice Civile)).
• The records of contractual acceptances and declarations are retained for as long as necessary to prove compliance with information obligations, to handle disputes and to establish, exercise or defend legal claims.
• The associated technical elements (IP address, user-agent and session identifier) are retained in full only where necessary for those purposes and, where possible, minimised, pseudonymised or aggregated.
• Support emails: for as long as needed to handle the request and for 24 months thereafter for evidentiary purposes.

6. Recipients and data processors

• Hetzner Online GmbH (hosting, Germany) — processor under Article 28 GDPR;
• Banca Sella / Fabrick, as payment service provider, processes the data needed to execute the transaction in accordance with its own privacy notice and, for the processing carried out in the context of payment services, may act as an independent controller or in the different role provided for by the applicable contractual arrangements;
• the email/SMTP service provider used to send confirmations and receipts on a durable medium;
• tax, accounting, legal and technical advisers, where necessary for administrative, tax or accounting compliance, support, security or the protection of legal rights;
• competent authorities, upon request, for legal compliance.

7. Transfers outside the EU

Gateway data are processed on the Controller's servers in Germany (EU). The Gateway does not transfer personal data to countries outside the EEA. Any site-specific processing that involves the use of non-EU platforms or providers (e.g. AI services) is governed by the supplementary notices of the Site concerned (see section 1).

8. Automated decision-making and profiling

No profiling is carried out. The gateway applies automated rules to determine which contractual acceptances/declarations are required and the eligibility for withdrawal based on the product category, but the relevant decisions (e.g. the outcome of a withdrawal or refund request) involve the intervention and manual assessment of an operator: there is therefore no decision based solely on automated processing within the meaning of Article 22 GDPR.

The Gateway does not use artificial-intelligence systems within the meaning of Regulation (EU) 2024/1689 (the "AI Act") to process personal data: the logic applied is deterministic and verifiable. Individual DreamersWare Sites may instead use AI functions in their own services (e.g. save-me.ai): the related processing, including any third-party AI platforms, is described in the Site-specific privacy notices of the Site concerned (see Sections 1 and 7).

9. Data subject rights

You have the rights set out in Articles 15–22 GDPR (access, rectification, erasure, restriction, portability, objection, not to be subject to solely automated decisions), which you can exercise by writing to policy@dreamersware.com; we reply within 30 days. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it). Statutory retention obligations (e.g. accounting) remain unaffected and may limit erasure.

10. Changes

This notice may be updated; material changes are highlighted on the page together with the relevant date.