This page is a translation. In case of discrepancy, the Italian version prevails. Read the Italian version
This notice describes the processing of personal data of users of the nosurprice.net website (“Site”) and its related services, pursuant to art. 13 of Regulation (EU) 2016/679 (“GDPR”) and of D.Lgs. 196/2003 as amended by D.Lgs. 101/2018.
1. Data controller
- GALAXY PICTURES
- Registered office: Via Tiziano Vecellio 6, 20822 Seveso (MB)
- VAT No.: 10285550967
- Email: admin@nosurprice.net
- PEC: contimichelegavina@legalmail.it
(No Data Protection Officer / DPO has been appointed.)
2. Types of data collected
a) Data provided voluntarily by the user
- Account: first name, last name, email, username, password (stored in encrypted form).
- Orders and billing: address, tax code / VAT number, SdI recipient code or PEC for e-invoicing, purchase details.
- Domains and hosting: domain name and registrant data required by the Registry/Registrar, technical service data.
- Support: content of tickets, emails and chat conversations (with an operator or an AI assistant).
b) Data collected automatically
- IP address, browser and device (user agent), pages visited, date/time, selected language, server technical logs.
c) Cookies (see § 9).
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account, order fulfillment, provisioning and supply of hosting and domains | Performance of the contract (art. 6.1.b) |
| E-invoicing (SdI), tax and accounting obligations | Legal obligation (art. 6.1.c) |
| Customer support (tickets, email, chat, AI assistant) | Performance of the contract / legitimate interest (art. 6.1.b/f) |
| Automatic translation of chat messages | Performance of the service (art. 6.1.b) |
| Site security, fraud and abuse prevention | Legitimate interest (art. 6.1.f) |
4. Processing methods and security
Data is processed using IT tools, adopting adequate technical and organizational measures: password encryption, HTTPS/TLS connections, access control, backups, service segregation. The Site is hosted on infrastructure located in the European Union.
5. Recipients and external processors
Data may be disclosed to parties acting as Data Processors (art. 28 GDPR):
- Infrastructure and hosting: Servers located within the European Union. Technical management of customers’ web spaces is carried out through the Plesk panel, installed on the same infrastructure as the Controller.
- Domain name registration: the accredited Registrar through which we carry out the registration, and the Registry responsible for the requested extension (for example Registro .it, EURid for .eu, Verisign for .com). The registrant’s data is communicated to the Registrar and the Registry because registration is by its nature public and mandatory.
- Payment systems: Stripe (cards, Apple Pay, Google Pay and Link), according to the method chosen at checkout. If you choose Amazon Pay, offered through Stripe, your data is also processed by Amazon Payments Europe S.C.A. as an independent controller. If you choose the Klarna installment payment, offered through Stripe, your data is also processed by Klarna Bank AB as an independent controller, which may carry out a creditworthiness assessment under its own notice. Card details never pass through or are stored by the Controller: they are collected directly by the payment processor.
- E-invoicing: invoices are transmitted to the Sistema di Interscambio (SdI) through the intermediary Openapi S.r.l., which acts as Data Processor solely for the transmission and storage of tax documents.
- PEC: communications by certified email use the Aruba PEC S.p.A. service (legalmail.it domain).
- Email: transactional communications and email support are handled on the Controller’s infrastructure.
- Bot protection: the Site uses Cloudflare Turnstile to distinguish people from automated systems on public forms. The service processes the IP address and certain technical browser characteristics, without advertising profiling.
- Approximate geolocation: to offer the correct currency, language and VAT rate, the IP address is checked against the MaxMind GeoLite2 database, which is downloaded and queried on our own servers: the user’s IP is not sent to MaxMind.
- Chat AI assistant: depending on the configuration, the text of messages sent to the assistant is transmitted to one of the following providers to generate the reply — Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini) or xAI (Grok). We recommend not entering sensitive or confidential data in chat.
- Automatic chat translation: message text may be transmitted, in real time, to DeepL, Google Cloud Translation or Microsoft Azure Translator, depending on the provider configured.
Important: automatic translation of Site content (pages, articles, products) is performed by a translation engine hosted on our own servers (self-hosted, LibreTranslate): this content is not sent to third-party translation services.
Data may also be disclosed to public authorities where required by law.
6. Transfer of data outside the EU
Some providers may process data outside the European Economic Area: in particular the AI assistants, Google’s and Microsoft’s translation services, Cloudflare and the payment processors (Stripe, Klarna and Amazon Pay). In such cases the transfer takes place on the basis of safeguards adequate under arts. 44 et seq. of the GDPR — European Commission adequacy decisions, including the EU-US Data Privacy Framework, or Standard Contractual Clauses (SCC).
Openapi, Aruba PEC and DeepL process data within the European Union. The geolocation database is queried locally and involves no transfer.
7. Retention period
- Account data: for the duration of the relationship and until the account is deleted.
- Order and billing data: 10 years, for tax and accounting obligations.
- Tickets, emails and chat conversations: for as long as needed, plus 24 months after.
- Technical logs: 12 months.
8. Rights of the data subject
The user may exercise at any time the rights under arts. 15–22 GDPR: access, rectification, erasure, restriction, objection, portability and withdrawal of consent (without prejudice to processing carried out prior to withdrawal).
To exercise them: admin@nosurprice.net. The user also has the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority) (www.garanteprivacy.it).
9. Cookies
The Site exclusively uses technical cookies (necessary), which do not require consent:
- session and authentication management;
- WooCommerce cart and checkout;
- selected language (nosurprice_lang);
- light/dark theme preference;
- Cloudflare Turnstile anti-bot verification token, lasting only for the session.
The Site does not use third-party analytics, advertising or profiling cookies.
10. Minors
The Site and the services are not directed at minors under 16. We do not knowingly collect data from minors without the consent of whoever exercises parental responsibility.
11. Changes
The Controller reserves the right to amend this notice; changes will be published on this page along with the relevant update date.
12. Contact
For any request regarding data processing: admin@nosurprice.net.
Last updated: 09/01/2026