Privacy Policy

What personal data we collect, why we use it, who we share it with and what your rights are.

This page covers the iocollezionista.com website, the purchases you make from us and our newsletter. We have tried to keep it simple. If anything is unclear, please write to us.

Who we are and how to contact us

The data controller is Filatelia Luciano Bellasio, Via Armando Diaz 23, 22100 Como, Italy, VAT number 00730170131.

For any question about your data, email us at info@iocollezionista.com or write to the address above.

What data we collect

• When you place an order: your first and last name, shipping and billing address, email, phone number, the items you buy, the amount and the payment method. If you enter them, also your company name, VAT number or tax code and your order note.
• If you create an account: the same data, your password (which we store in protected form that even we cannot read) and your order history.
• When you write to us through the contact form or by email: your name, email, phone number if you give it, and your message.
• If you sign up for the newsletter: your email, your first name if you give it, and when and where you signed up.
• When you browse the website: technical data such as your IP address, browser and device type, the pages you visit, date and time. Some of this data goes through the cookies described further down.

Your card details never reach us: you type them straight into the fields of Stripe, the service that handles card payments. We do not see them and we do not store them.

Why we use your data and on what legal basis

• Orders, payments, shipping, returns and customer service. We need this data to perform our sales contract with you (Article 6(1)(b) of Regulation (EU) 2016/679, the GDPR). Without it we cannot ship your order.
• Accounting and tax obligations. Invoices, ledgers and accounting records are required by law (Article 6(1)(c) GDPR).
• Answering your messages. If you ask us something before buying, the basis is the contract (Article 6(1)(b) GDPR); otherwise it is our legitimate interest in replying to the people who write to us (Article 6(1)(f) GDPR).
• Newsletter with news and offers. Only people who have signed up receive it: the basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
• Website statistics. To understand which pages and items people are interested in and to improve the shop. With Umami, which uses no cookies and does not store your IP address, we count visits on the basis of our legitimate interest (Article 6(1)(f) GDPR). We also use Google Analytics, on the basis of the same legitimate interest: you can stop it as explained below, in the part about cookies.
• The newsletter sign-up window. To offer you the newsletter with its discount, on the basis of our legitimate interest (Article 6(1)(f) GDPR).
• Advertising on Google. We show our products in Google Shopping ads. If you accept advertising cookies in the cookie banner, Google Ads tells us which orders come from the ads and can show you our products again. The basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time from “Cookie preferences” at the bottom of the page.
• Basket reminders. If you start an order without completing it and you subscribe to our newsletter or have bought from us before, we send you a few emails to remind you, sometimes with a personal discount code valid for a few days. The basis is your newsletter consent or, if you have bought from us, our legitimate interest in offering you similar products (Article 130(4) of the Italian Privacy Code). To stop them, just reply NO to one of these emails.
• Security. To protect the website from spam and automated access, and card payments from fraud. The basis is our legitimate interest (Article 6(1)(f) GDPR).
• Defending our rights in case of a dispute (Article 6(1)(f) GDPR).

We do not sell your data to anyone. We do not make decisions based solely on automated processing.

The newsletter

We only send you the newsletter if you have signed up: through the form at the bottom of our pages, the sign-up window, the sign-up page, the box in the order form or your account.

Subscribed addresses are managed with Brevo, which sends the newsletter for us. Until October 2026 the sign-up form at the bottom of our pages went through Mailchimp, another newsletter service: the addresses collected in that period are also in Mailchimp's list.

If you sign up through our sign-up window, you get the discount code straight away, on screen and by email. We record the date and time of your consent, the text you agreed to and the type of page and device you signed up from, so that we can prove we have your consent.

To unsubscribe, use the link at the bottom of every newsletter or write to us.

Who we share your data with

Your data is used by us, the people who run the shop. We only share it with those we need to deliver your order and to run the website:

• Shipping: Poste Italiane and, for parcels sent abroad, the postal service and customs of the destination country. They receive your delivery details.
• Payments: Stripe for cards, Apple Pay and Google Pay; PayPal if you choose PayPal; our bank for bank transfers. Stripe and PayPal also receive the data they use to check for fraud.
• Email: Brevo (Sendinblue SAS, France) sends the shop's emails, such as order confirmations and shipping notices, and the newsletter. Mailchimp (United States) keeps in its own list the addresses that signed up through the old form at the bottom of our pages. Our mailbox info@iocollezionista.com is run by Google.
• Hosting: the website and its data are on a server run by Hetzner Online GmbH in Germany.
• Statistics: Google, for Google Analytics 4; Umami, a statistics program that runs on our own server in Germany. Requests to Umami go through the Cloudflare network.
• Bot protection: Google reCAPTCHA on the contact, login and registration forms.
• Advertising: Google Ireland Limited, for Google Shopping ads and, only if you accept advertising cookies, to measure their results.
• eBay: if you buy one of our lots on eBay, eBay passes us the data we need to ship it, and we handle it like any other order. eBay's own privacy notice covers what eBay does.
• People who help us: those who provide technical support for the website and who help us with our accounts, only as far as their work requires.
• Public authorities, when the law requires it.

Stripe, PayPal, Google and eBay also use some data for their own purposes, for example fraud prevention or improving their services. For that part their own privacy notices apply.

Data outside the European Union

Google, Stripe, PayPal, Mailchimp and Cloudflare are United States companies or belong to United States groups, so some data may reach the United States. In these cases the transfer relies on the EU-US Data Privacy Framework, for the companies that take part in it, or on the standard contractual clauses approved by the European Commission.

If you ask us to ship outside the European Union, your delivery details necessarily reach the postal service and customs of the destination country: this is needed to deliver your order.

How long we keep your data

• Orders, invoices and accounting records: 10 years, as Italian law requires (Article 2220 of the Italian Civil Code).
• Account: until you ask us to close it. Order data stays for the 10 years required by law.
• Unfinished orders: if you start an order and do not complete it, the data you entered stays stored in the shop's cart. We delete it automatically 12 months after the cart was last changed; if you want us to delete it sooner, write to us.
• Newsletter: until you unsubscribe. After that we keep your address marked as "unsubscribed", so that we do not write to you again.
• Messages: for as long as we need to reply and follow up on your request.
• Server technical logs: they hold the IP address, date and time, page requested and browser, and they are deleted automatically after 90 days.
• Google Analytics statistics: for the retention period set in our Google Analytics account, which for this type of account is 14 months at most.
• All other data: for as long as needed for the purpose we collected it for.

Your rights

You can ask us at any time to:

• tell you what data we hold about you and give you a copy;
• correct or complete it;
• delete it, when the law does not require us to keep it;
• restrict its use;
• give it to you in a machine-readable format, so you can take it elsewhere;
• stop using it where we rely on our legitimate interest;
• withdraw the consent you have given us for the newsletter or for advertising cookies. Withdrawal applies from then on and does not make what we did before it unlawful.

Just email info@iocollezionista.com. We will reply within one month.

If you think we are not handling your data properly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the supervisory authority of the European country where you live or work.

Cookies and similar tools

Cookies are small files that a website saves in your browser. Some services store similar information in your browser's storage. Here is what iocollezionista.com uses.

Technical cookies and statistics are set when you visit the website. Google’s advertising cookies are set only if you accept them in the cookie banner, and you can change your mind at any time from “Cookie preferences” at the bottom of the page. Further down you can also find how to block cookies in your browser.

Technical cookies, strictly necessary

They make the shop work, for example by remembering your cart and your account login. They are not used to track you and they do not need your consent.

• om_frontend: your shop session (cart and login). It lasts one hour after the last page you open.
• external_no_cache: a technical setting of the shop that stops you being shown stored copies of pages that contain your own data, such as your cart. It lasts one hour.
• ioc_consent: remembers your choice in the cookie banner. It lasts 6 months.
• Card payments: on the checkout page Stripe uses its own cookies (__stripe_mid, __stripe_sid and others on the domains of Stripe and of its hCaptcha bot check) for payment security and fraud prevention. They last from 30 minutes to 2 years. If your device offers Google Pay, Google may use its own cookies too.
• Bot protection: on the contact, login and registration forms Google reCAPTCHA may read or set its own cookies to tell people apart from automated programs.

Statistics

• Google Analytics 4 (_ga, _ga_HXXJ1WSX60, up to 2 years): it counts visits and shows us how the website is used. On our website we have switched off the advertising features of Google Analytics (Google Signals and ad personalisation).
• Umami: statistics that use no cookies and do not store your IP address, which is why we do not ask for consent. It runs on our own server in Germany.

Newsletter and marketing

• Our newsletter sign-up window: ioc_nl_vid (1 year, a random code that lets us count anonymously how often the window is seen), ioc_nl_cap (14 days, so the window is not shown to you too often) and ioc_nl_done (1 year, after you have signed up), plus some information in your browser's storage for the same purposes. These are our own cookies: they stay on our website and are not used to track you.

Advertising, only with your consent

• Google Ads (_gcl_au, 90 days, and Google cookies on its own domains): tells us when an order comes from one of our ads and lets Google show you our products again. Without your consent these cookies are not saved: Google only receives technical signals without cookies, for example that a visit or an order took place, and uses them in aggregate to estimate the results of the ads.

Video

The YouTube video on our About us page only loads if you start it. From then on YouTube's rules apply, which means Google's.

How to manage cookies

You can delete and block cookies in your browser settings. If you block technical cookies, the cart and the account login will not work.

To stop being counted by Google Analytics you can also install Google's add-on that switches it off in your browser: tools.google.com/dlpage/gaoptout.

Changes to this privacy policy

If the way we use data changes, we will update this page and the date below. If a change affects your newsletter consent, we will ask for it again.

Last updated: 18 October 2026