Privacy Policy

Last updated: 13 October 2026

1. Data controller

The data controller is the company identified below, trading as Libreria Galleria Demetra. The bookshop is located at Via Fiori Oscuri, 3, 20121 Milano MI, Italy. For privacy enquiries, please write to libreria.galleria.demetra@gmail.com.

2. Data we process

Contact and valuation forms send your name, email address, optional telephone number, enquiry and, for valuations, photographs to the bookshop’s server. Enquiries are stored and accessible to the owner in the restricted area. Photographs are processed on your device and re-encoded on the server without GPS metadata, then kept in private storage. The form starts a necessary technical session to protect submissions; spam controls temporarily use an identifier derived from your IP address. The restricted area uses login details for authentication and password recovery. Telephone and email links open applications on your device.

3. Purposes and legal bases

Data received through forms and direct communications is processed to answer enquiries, provide information about works and handle pre-contractual matters. The legal basis is taking steps at the data subject’s request before entering into a contract or, where applicable, the legitimate interest in handling business communications and enquiries.

4. Google Analytics

Only after an explicit choice of the “Analytics” category does this website load Google Analytics 4 to measure pages visited and visit trends. The configuration sends the page URL without query parameters or fragments and the page title; it sends a referrer only when it comes from a page on this website and has no query parameters. It does not send form fields, names, email addresses, phone numbers, messages, or photographs, and does not record form-submission events. Google may process technical device and browser data, online identifiers, and usage data under its own terms and privacy information. Consent can be changed using the preferences icon; rejection or withdrawal prevents further transmissions from this website. The tag is authorized for the public release build; it remains off locally and in previews and loads only after Analytics is accepted. Google’s privacy policy.

5. Google Maps

The interactive map provided by Google Maps is not loaded on the first visit. It is activated only after an explicit choice by the user. Google may then process technical data and use its own tools under its privacy policy. You can browse without loading the map and change your choice using the Silktide Consent Manager preferences icon.

6. Retention and recipients

The management system currently applies no automatic expiry or deletion: enquiries, correspondence, notes and photographs remain in private storage until the controller takes action; archiving a case does not delete it. You can request access, rectification or erasure by writing to the address above. The controller will assess the request and any legal obligations or need to establish, exercise or defend legal claims. Before collecting enquiries through the public website, the controller must define and apply a retention criterion proportionate to the purposes and a deletion procedure; deletion is not automated in the panel. The Google Analytics property is currently set to retain event data for 2 months and user data for 14 months, resetting on new activity; these settings must be checked again before activation. The controller and technical providers actually involved in hosting and email may access the data; recipients and any processors must be confirmed against current contracts.

7. Your rights

Where provided by law, you may request access to your data, rectification, erasure, restriction of processing and data portability, and you may object to processing. You may also lodge a complaint with the Italian Data Protection Authority. Requests can be sent to libreria.galleria.demetra@gmail.com.

Information and contact details for the Authority are available at garanteprivacy.it.