Privacy Policy

1. Data controller

The data controller is Luca Messina, based in Rivalta di Torino (TO), Italy.

Codice Fiscale (Italian tax ID): MSSLCU87T09L219B.

For any request regarding the processing of personal data, you can write to: info@lucamessy.com.

2. Data we collect

When you use the site and complete a purchase, we collect the following categories of personal data:

• Identification and contact data: first and last name, email address, phone number.
• Shipping and billing data: address, city, postal code, country, tax/VAT number if required.
• Order data: artworks purchased, edition/serial number, amounts, purchase history.
• Payment data: card and payment details are collected and processed directly by our payment service provider, Stripe, Inc. Lucamessy does not receive or store full card data.
• Browsing data and technical cookies: IP address, browser and device type, pages visited, as described in the Cookies section.
• Communications: messages sent via the contact form or by email.

3. Purpose and legal basis of processing

• Order management and fulfilment, including production, shipping and after-sales support — legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Compliance with tax, accounting and legal obligations (e.g. invoicing) — legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Responding to contact and customer support requests — legal basis: performance of a contract / legitimate interest (Art. 6(1)(b) and 6(1)(f) GDPR).
• Sending marketing communications and newsletters — legal basis: user consent (Art. 6(1)(a) GDPR), revocable at any time.
• Fraud prevention and site security — legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR).
• Non-essential analytics or marketing cookies — legal basis: explicit consent given via the cookie banner.

4. Data retention

• Order, invoice and tax-related documentation: retained for 10 years, as required by Italian civil and tax law.
• Account data and purchase history: retained for the duration of the business relationship and for the period necessary to manage warranties or disputes.
• Data processed on the basis of consent (e.g. newsletter, non-essential cookies): retained until consent is withdrawn.
• Browsing data and technical logs: retained for a maximum of 12 months, unless needed for the investigation of unlawful acts.

5. Data recipients

Personal data may be shared with the following parties, strictly to the extent necessary to carry out the related activities:

• Stripe, Inc. — our online payment service provider, acting as processor or independent controller for payment data.
• Couriers and shipping carriers — for delivery of purchased artworks.
• Hosting and cloud infrastructure providers (e.g. Cloudflare) — to operate and secure the site.
• Google Ireland Limited — provider of Google Analytics, enabled only with analytics consent.
• Meta Platforms Ireland Limited — provider of Meta Pixel, enabled only with marketing consent.
• Tax and accounting advisors — to comply with legal obligations.
• Public authorities, where required by law.

6. International data transfers

Some providers (e.g. Stripe, Cloudflare) may process data outside the EU/EEA. In such cases, the transfer is based on Standard Contractual Clauses approved by the European Commission or other adequate safeguards under the GDPR (Arts. 44-49).

7. Your rights

As a data subject, you have the right to:

• Access your personal data (Art. 15 GDPR).
• Request rectification of inaccurate data (Art. 16 GDPR).
• Request erasure of your data, within the limits provided by law (Art. 17 GDPR).
• Request restriction of processing (Art. 18 GDPR).
• Request data portability (Art. 20 GDPR).
• Object to processing (Art. 21 GDPR).
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it), or your local supervisory authority.

8. Cookies

The site uses essential technologies required for the cart, session and core functionality, which do not require consent. Optional analytics and marketing categories remain disabled until you make a choice through the banner.

If you allow analytics, Google Analytics is used to understand statistically how the site is used. If you allow marketing, Meta Pixel, provided by Meta Platforms Ireland Limited, is used to measure advertising campaign effectiveness and understand visits and actions on the site following interactions with Meta ads.

Meta Pixel may communicate browser-generated technical and browsing information to Meta, such as IP address, browser or device type, online identifiers and pages visited. In this implementation Lucamessy does not enable Advanced Matching and does not send email addresses, names or other contact details through the Pixel.

You can accept all categories, choose analytics and marketing separately, or keep essential technologies only. You can change or withdraw consent at any time through “Manage cookie preferences” in the footer; the new choice prevents subsequent optional loading or events.

For more information about Meta's processing: https://www.facebook.com/privacy/policy/

9. Payments via Stripe

Payments made on the site are processed by our third-party provider, Stripe, Inc., which operates under the highest security standards (PCI-DSS). Lucamessy does not access or store full payment card data. For more information on how Stripe processes data, please refer to its privacy policy at stripe.com/privacy.

10. Data security

We adopt appropriate technical and organisational measures (encrypted HTTPS connections, restricted data access, GDPR-compliant providers) to protect personal data against unauthorised access, loss or destruction.

11. Changes to this notice

This notice may be updated from time to time. Material changes will be announced via a notice on the site. We encourage you to review this page periodically.

12. Contact

For any question regarding the processing of your personal data, you can contact the data controller at: info@lucamessy.com.