Privacy Policy

1. Data controller

The data controller is AdoptItaly s.r.l., with registered office in [REGISTERED OFFICE — TO BE FILLED], Terni (Italy), registered with the Terni Business Register, Tax ID / VAT [TO BE FILLED].

For any request concerning the processing of personal data you can write to: info@adoptitaly.com.

2. Personal data processed

Depending on the services used, AdoptItaly may process the following categories of data:

• Account data: first name, last name, email, password (encrypted) or social login identifiers (Google, Facebook, Apple), preferred language.
• Adoption data: adopted trees, name given to the tree, update history, generated certificates.
• Purchase and billing data: orders, amounts, tax data for invoicing, payment outcomes. Full payment card data is NOT processed by AdoptItaly: it is handled directly by Stripe.
• Shipping data: delivery address for physical products included in offers (e.g. oil, fruit).
• Newsletter data: email address, subscription status (with double opt-in confirmation), communication preferences.
• Gifting data: gift recipient's email and name, giver's personalized message.
• B2B/corporate form data: business contact details for partnership requests.
• Browsing data and cookies: see the dedicated Cookie Policy published on the website.
• Communications with support: content of requests sent to customer service.

Data of farmers (partner farms) is processed according to a dedicated privacy notice, available on the "Farmer Privacy Notice" page.

3. Purposes and legal bases

Personal data is processed for the following purposes:

• Service provision (art. 6.1.b GDPR — performance of the contract): management of the account, adoptions, payments, shipments, certificates, tree updates (including the personalized emails signed by Lia), gift redemption and customer support.
• Legal obligations (art. 6.1.c GDPR): invoicing, accounting and tax compliance, responses to requests from authorities.
• Newsletter and promotional communications (art. 6.1.a GDPR — consent): sending of the newsletter after double opt-in subscription; consent can be withdrawn at any time via the unsubscribe link in every email.
• Security and fraud prevention (art. 6.1.f GDPR — legitimate interest): protection of the platform, accounts and transactions.
• Aggregate statistical analysis (subject to analytics cookie consent): service improvement. See the Cookie Policy.

4. Use of artificial intelligence systems

AdoptItaly uses artificial intelligence systems to support the drafting of content (for example the personalized tree updates signed by Lia and newsletter drafts), the organization of information and, in the future, customer assistance. All AI-generated content intended for users is subject to human review before sending or publication.

Where such systems process personal data (for example the adopter's name or the tree's name to personalize an update), AdoptItaly applies the principles of data minimization, purpose limitation, security and transparency. AI systems are not used to make automated decisions producing legal or similarly significant effects on users (art. 22 GDPR): refunds, complaints, tree replacements, economic conditions, farmer approval and validation of CO₂ data are always assessed by members of the team.

AdoptItaly relies on selected AI service providers whose contractual terms exclude the use of data processed on behalf of AdoptItaly to train their models. AdoptItaly does not use users' personal data to train its own or third-party AI models, unless the user gives explicit consent or another legal basis is indicated in this notice.

More information is available on the "How we use AI" page published on the website.

5. Recipients of the data

Data may be disclosed to the following categories of recipients, acting as data processors or independent controllers:

• Infrastructure and hosting providers (platform servers and database).
• Stripe — payment processing (independent controller for payment data).
• Resend — sending of transactional emails and newsletters.
• Sanity — management and delivery of images and media content.
• Google (Tag Manager / Analytics 4) — statistical analysis, only subject to cookie consent.
• Artificial intelligence service providers — drafting of content, within the limits described in section 4.
• Couriers and logistics partners — delivery of physical products.
• Consultants and professionals (accountants, lawyers) and competent authorities, where necessary.

6. Transfers outside the EU

Some providers (for example cloud, email or AI service providers) may process data in countries outside the EU, in particular in the United States. In such cases the transfer takes place on the basis of adequacy decisions of the European Commission (including the EU-US Data Privacy Framework, for participating providers) or Standard Contractual Clauses (SCC) supplemented, where necessary, by additional measures.

7. Retention periods

• Account data: for the entire duration of the account and up to 12 months from the deletion request, unless further retention obligations apply.
• Contractual, accounting and tax data: 10 years from the end of the relationship, pursuant to civil and tax law.
• Newsletter data: until consent is withdrawn (unsubscribe) or the service is discontinued.
• Communications with support: for the time necessary to handle the request and for any defensive needs.
• Browsing data and cookies: according to the terms indicated in the Cookie Policy.

8. Rights of the data subject

Pursuant to articles 15-22 GDPR, users have the right to: access their data, rectify it, erase it, restrict its processing, object to processing, receive their data in a structured format (portability) and withdraw any consent given at any time, without affecting the lawfulness of processing prior to withdrawal.

Requests can be sent to info@adoptitaly.com. Users also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali — www.garanteprivacy.it).

9. Minors

AdoptItaly services are intended for adults. AdoptItaly does not knowingly collect personal data of persons under 18; should such data be detected, it will be deleted.

10. Updates to this notice

AdoptItaly may update this notice at any time. Changes will be published on this page with an indication of the date of the last update. In the event of substantial changes, registered users will be informed by email or through a notice on the platform.