Privacy Policy

Last updated: 12 November 2026

This Privacy Policy explains how personal data is collected and used when you visit cookie-tin.pagesandplans.com (the “Website”) or buy our digital products. The Website is part of Hearth & Tin, a brand of Roberto Monti. We are based in Italy, so we apply the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Italian data protection law to every customer, wherever they live, together with the privacy laws that apply where you live, such as Canada’s PIPEDA, the Australian Privacy Act 1988 and the New Zealand Privacy Act 2020.

1. Who is responsible for your data

The data controller is Roberto Monti, a sole trader based in Italy, VAT number (Partita IVA) IT04215771207 (“we”, “us”).

Contact: info@traditionalitalianrecipes.food. We have not appointed a Data Protection Officer (DPO), as it is not required for our activity. Please send any privacy request to this email address.

2. What we sell

Through the Website we sell the digital cookbook “Grandma’s Christmas Cookie Tin” and optional digital add-ons (for example the printable “Cookie Swap & Gift Tin Kit” and the keepsake journal “Grandma’s Story & Recipes”, personalised or ready-made). All products are PDF downloads, delivered by an email link after payment. Prices are in US dollars.

3. Data we collect

Identity and contact data: your name and email address.
Billing data: billing country and address, as far as the checkout requires.
Order data: the products you bought, order date and payment status.
Personalisation details: the wording you type so that we can personalise a journal or gift certificate, for example what your family calls your grandmother, her first name, the names of the people giving the gift and your dedication. Please enter only details you are happy to see printed in the file.
Technical and usage data: IP address, device and browser data, cookie and visitor identifiers, the pages you visit and the links or buttons you click, and the advertising campaign that brought you to the Website.
Anonymous interaction data: where you click on a page and how far you scroll, recorded without your name, email, IP address or any visitor identifier, so we can see which parts of our pages are useful (a “heatmap”).
Communications: messages you send us, for example for customer support.

We never see or store your full card details. Payments are handled by Stripe.

4. Why we use your data and on what legal basis

To process your order, create your personalised files, deliver them and provide support – performance of the contract (Art. 6(1)(b) GDPR).
To keep invoices and accounting records – compliance with legal obligations (Art. 6(1)(c) GDPR).
To measure and improve the Website, including the anonymous heatmap, and to prevent fraud and abuse – our legitimate interest in running a secure and useful shop (Art. 6(1)(f) GDPR).
To measure and personalise advertising with the Meta Pixel and Conversions API – your consent where the law requires it (Art. 6(1)(a) GDPR).
To send you marketing emails – only with your consent. Every email has an unsubscribe link.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing done before.

5. Who receives your data

We share data only with service providers that help us run the shop, acting as processors or independent controllers:

Pages and Plans: the platform that hosts the Website, checkout, order management and our contact database. It runs on Vercel (hosting) and Supabase (database and storage). The personalised journal is made from the details you enter by our own file generator on the same platform.
Brevo (France): delivery of order and marketing emails.
Stripe: payment processing. They act under their own privacy policies, and we only receive confirmation of payment and limited order details.
Meta Platforms: Meta Pixel and Conversions API for advertising measurement and retargeting.
Google Fonts: the Website may load fonts from Google, which can involve your IP address being sent to Google.
Our accountants and advisers, public authorities or courts, where the law requires it.

We do not sell your personal data for money, and we do not use personalisation details for advertising.

6. International transfers

We are based in Italy, in the European Union. Some of our providers (such as Meta, Stripe, Google, Vercel and Supabase) may process data in the United States or other countries outside the country where you live. Where GDPR applies, we rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information at info@traditionalitalianrecipes.food.

7. How long we keep your data

Order and invoicing data: 10 years, as required by Italian accounting and tax law.
Personalisation details: kept with your order so we can re-create or correct your file, and deleted on request.
Marketing data: until you unsubscribe or withdraw consent.
Anonymous heatmap data: up to 12 months.
Support messages: as long as needed to handle your request and for a reasonable time afterwards.
Cookies: for the periods listed in our Cookie Policy.

8. Your rights

You have the right to:

access your personal data and receive a copy;
have inaccurate data corrected (rectification);
have your data erased, where the law allows;
restrict the processing of your data;
receive your data in a portable format (portability);
object to processing based on legitimate interest, and to direct marketing at any time;
withdraw your consent at any time.

To use these rights, email info@traditionalitalianrecipes.food. We reply within one month. We may ask you to confirm your identity. Some data, such as invoices, must be kept by law, so we may not be able to erase it before the retention period ends.

9. Your country

Canada, Australia and New Zealand: you can ask for access to and correction of your personal information, and you can complain to your local privacy regulator: the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner. We would appreciate the chance to help you first.

Everyone: you have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the data protection authority of the country where you live or work. We apply the standards described in this policy to all customers.

10. Security

We use reputable providers and reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS). No online service is completely secure, but we work to keep your data safe.

11. Children

The Website is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version. If we make important changes, we will tell you on the Website or by email where appropriate.

13. Contact

Questions about privacy? Write to info@traditionalitalianrecipes.food.

Roberto Monti, sole trader, Italy · VAT no. IT04215771207 · info@traditionalitalianrecipes.food