Privacy Policy

Privacy Policy (Information on Personal Data Processing)

Effective Date: [1/11/2025]

1. Data Controller

The Data Controller (hereinafter, the "Controller") for personal data processing is:

  • Company Name: Ennequadro Design srl

  • VAT Number: IT10293001219

  • Registered Office: 80126 Napoli, Italy

  • Contact Email: hello@cardsattack.com

2. Data Collected, Purposes, and Legal Basis for Processing

The Controller collects and processes your data for the following purposes, based on the relevant legal bases provided by the General Data Protection Regulation (GDPR - EU Regulation 2016/679):

Data Category

Purpose of Processing

Legal Basis (Art. 6 GDPR)

Retention Period

Personal & Contact Data (Name, Surname, Address, Email, Phone)

Execution of Sales Contract: Managing orders, invoicing, shipping, and pre/post-sales assistance.

Art. 6.1.b) Performance of a contract.

10 years (legal fiscal obligation).

Navigation Data (IP Address, time of visit, pages viewed, browser, device)

Technical Operation and Security: Ensuring the functioning of the PrestaShop website and preventing cyber fraud.

Art. 6.1.f) Legitimate interest of the Controller (security and site maintenance).

Short term, except for investigations.

Account Registration Data (Login Credentials)

User Account Management: Allowing the user to access the reserved area and track orders.

Art. 6.1.b) Pre-contractual measures or contract performance.

Until the user requests cancellation.

Navigation Data via Google Analytics (See Sec. 7)

Aggregated and Anonymized Statistical Analysis: Monitoring website traffic and behavior to optimize the e-commerce (if anonymized).

Art. 6.1.a) User Consent (via Cookie Banner).

See Google/Cookie Policy information.

3. Processing Methods and Nature of Provision

  • Processing Methods: Data processing is carried out using paper and electronic means, with logic strictly related to the stated purposes and with adequate technical and organizational security measures (such as SSL encryption for transmission).

  • Nature of Provision: The provision of data for Contractual Purposes (orders and shipping) is mandatory. Without this data, the Controller cannot provide the e-commerce service. The provision of data for Non-Essential Statistical Purposes (Google Analytics) is optional and subject to your explicit consent.

4. Payment Data

Ennequadro Design srl (CardsAttack) does not directly manage or store any data related to your credit card, debit card, or payment details. All sensitive payment data is encrypted and managed exclusively by our certified partners (e.g., NEXI, Alma), acting as autonomous data controllers or data processors for payment data.

5. Data Recipients and Transfer

Your personal data may be communicated to:

  1. Internal Parties: Employees and collaborators of the Controller, authorized and instructed to process the data.

  2. External Data Processors (Art. 28 GDPR): Essential service companies (e.g., PrestaShop for hosting and platform management, couriers for shipping, accounting/tax service providers). These entities are formally appointed by the Controller and bound to comply with the GDPR.

  3. Autonomous Third Parties: Google LLC for the Google Analytics service.

    • Extra-EU Transfer: Any data transfers outside the European Union (e.g., to Google) occur only in the presence of adequate safeguards under Articles 44 et seq. of the GDPR (e.g., through the adoption of Standard Contractual Clauses or similar compliance tools).

6. The E-commerce Platform (PrestaShop)

Our e-commerce is hosted on the PrestaShop platform. PrestaShop, as a Content Management System (CMS), processes the data necessary for the store's operation (orders, user accounts, cart management, etc.). The Controller ensures that the platform configuration adheres to the principles of Privacy by Design and Privacy by Default.

7. Google Analytics

We use Google Analytics to analyze user interaction with the site.

  • Consent Requirement: The use of Google Analytics, as a non-essential analysis/profiling tool, is subject to your explicit consent, which is collected via a Cookie Banner compliant with European regulations.

  • Anonymization: Google Analytics is configured for IP address anonymization (_anonymizeIp) to minimize the collection of personal data.

8. Data Subject Rights

As a "Data Subject," you have the right to exercise, at any time, the rights provided by Articles 15-22 of the GDPR, by sending a communication to the Controller's email address: hello@cardsattack.com.

You have the following rights:

  • Right of Access (Art. 15);

  • Right to Rectification (Art. 16);

  • Right to Erasure ("Right to be Forgotten") (Art. 17);

  • Right to Restriction of Processing (Art. 18);

  • Right to Data Portability (Art. 20);

  • Right to Object (Art. 21).

You also have the right to lodge a complaint with the Supervisory Authority for Personal Data Protection (www.garanteprivacy.it for the Italian DPA), if you believe that the processing violates the GDPR.