Last updated: 15 October 2026
This Privacy Policy explains how T.M. Tutto Militare di Santucci Alessandro & C. S.a.s. processes the personal data of people who visit militaria.tuttomilitare.it (our international shop), register on it or buy from it. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018). Because we are established in Italy, the GDPR protects your data wherever you live.
1. Data controller
T.M. Tutto Militare di Santucci Alessandro & C. S.a.s.
Via Aquileia 18, 33100 Udine (UD), Italy
VAT no. IT01647130309
Email: info@tuttomilitare.it · Certified email (PEC): postacertificata@pec.tuttomilitare.com · Phone: +39 0432 295279
We have not appointed a Data Protection Officer, as we are not required to (Art. 37 GDPR). For any privacy question please use the contacts above.
2. What data we process
- Identification and contact data: first and last name, email, phone number, shipping and billing addresses, company name and tax or VAT number when needed for the invoice.
- Account data: login credentials (the password is stored encrypted), date of birth if you choose to give it, preferences and wish list.
- Order data: products bought, amounts, payment method chosen, shipping, returns and withdrawals. We never receive your full card details: they are handled directly by the payment provider.
- Eligibility documents: for some restricted items we may ask for a document proving that you may buy them (see section 4).
- Communications: messages and attachments sent through the contact form, by email or by phone; reviews and comments you publish on the site.
- Browsing data: IP address, browser and device type, pages visited, date and time of requests, collected automatically by the server and, only with your consent, by statistics tools (see the Cookie Policy).
We do not ask for, and do not process, special categories of data (Art. 9 GDPR) such as health data or political opinions. Please do not send them to us.
3. Why we process your data, on what legal basis and for how long
| Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|
| Running and securing the website: serving pages, preventing abuse, cyber attacks and fraud (server logs, reCAPTCHA anti-spam on forms). | Our legitimate interest in the security of the site (point f). | As long as needed for security, following the automatic rotation of server logs; longer only to investigate an offence. |
| Account registration and management. | Performance of a contract or of steps taken at your request before entering into it (point b). | For as long as you keep the account; you can ask for its deletion at any time. |
| Order management: contract, payment, international shipping, after-sales support. | Performance of the contract (point b). | For the duration of the relationship, then as in the next row. |
| Tax and accounting obligations: invoices, ledgers, export documents. | Legal obligation under Italian law (point c). | 10 years (Art. 2220 of the Italian Civil Code and tax rules). |
| Eligibility checks for restricted items (section 4). | Steps taken at your request before the contract (point b) and our legitimate interest in selling these items only to people entitled to buy them under the applicable laws (point f). | The document: for the time of the check and in any case no longer than 12 months after the outcome. Only the outcome is then kept with your account. |
| Customer support: replies to requests sent through the contact form, by email or by phone. | Pre-contractual steps or performance of the contract (point b); legitimate interest in answering general requests (point f). | Up to 24 months after the last contact, unless needed for an order or to protect a right. |
| Withdrawal, returns and legal guarantee. | Legal obligation (consumer protection law) (point c) and performance of the contract (point b). | Together with the order data (10 years). |
| Reviews: reviews and comments you publish on the site; an optional invitation to review your purchase on Trustpilot. | The service you ask for (point b) for reviews on the site; our legitimate interest in collecting verified reviews (point f) for the Trustpilot invitation, which you can object to at any time. | As long as the review is published or until you ask for its removal. |
| Visit statistics with Google Analytics. | Your consent, given through the cookie banner (point a), which you can withdraw at any time. | See the Cookie Policy; statistical data are kept by Google for the period set in the Analytics property. |
| Social media content (Facebook page box). | Your consent, given through the cookie banner (point a). | See the Cookie Policy. |
| Protection of our rights: complaints, disputes and legal proceedings. | Our legitimate interest in defending ourselves (point f). | For the duration of the dispute and until rights are time-barred. |
No marketing. We do not send newsletters or promotional messages, and we do not sell or share your data with third parties for their own marketing. If we ever wish to do so, we will ask for your specific and separate consent.
When the periods above expire, data are deleted or anonymised. Backup copies are overwritten on a rolling basis.
4. Restricted items: eligibility checks
Some items (for example military insignia, badges and uniform accessories) may only be sold to people entitled to them under the laws of Italy or of the destination country. For these items we may ask you for a document proving your eligibility (for example a service identity card or a certificate of service).
- What to send: a document showing your name, your service or organisation and, if relevant to the item, your rank is enough. You may black out any data that is not needed (for example document number, tax code, photo if not needed, address).
- Who sees it: only Tutto Militare staff authorised to carry out the check. The document is not shared with third parties, unless required by a judicial or police authority.
- How we decide: the check is done by a person, not by an automated system. If the outcome is negative you can ask why and send a different document.
- If you prefer not to provide it: you can still use the site and buy all items that are not restricted.
5. Mandatory and optional data
Data marked as mandatory in the forms are needed to create the account, conclude and perform the order or answer your request: without them we cannot do so. Other data (for example the date of birth) are optional and leaving them out has no consequence.
6. Who receives your data
Your data are processed by our authorised and instructed staff. They may also be received, only as far as necessary, by:
- providers processing them on our behalf as processors (Art. 28 GDPR): OVH SAS (France), which hosts the website on its servers; Evo Sistemi di Cirone Simone (Corciano, Italy), which develops and maintains the website and its backups; Google, for the email service we use to send order emails and, only with your consent, for statistics (Google Analytics); Google for the reCAPTCHA anti-spam protection;
- couriers for delivery (DHL International), which receive the recipient's name, address, phone number and email, together with the information needed for customs;
- payment providers, acting as independent controllers: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), the card payment service Sinergia PayWay, the bank for bank transfers, the courier for cash on delivery;
- Trustpilot A/S (Denmark), for the optional invitation to review your purchase (name, email, order number);
- Meta Platforms Ireland Ltd., only if you accept third-party cookies, for the Facebook page box;
- accountants and advisers for accounting, tax and legal obligations;
- public authorities, including customs authorities, where required by law.
Your data are not disclosed to the public, except reviews and comments you choose to publish. The up-to-date list of our processors is available on request.
7. Transfers outside the European Union
Your data are mainly processed in the European Union. Some providers (Google LLC and Meta Platforms Inc.) may process them in the United States: they participate in the EU-U.S. Data Privacy Framework, which the European Commission found adequate on 10 July 2023 (Art. 45 GDPR). When you order a delivery to a country outside the EU, the data needed for delivery and customs clearance are sent to the courier and to the authorities of that country, because this is necessary to perform the contract you asked for (Art. 49(1)(b) GDPR). The level of data protection in the destination country may differ from that of the EU.
8. How we protect your data
We use appropriate technical and organisational measures (Art. 32 GDPR): encrypted connection (HTTPS), access to the back office restricted to authorised staff, encrypted customer passwords, regular backups, server updates and protection.
9. Your rights
At any time you can ask us (Articles 15-22 GDPR):
- access to your data and a copy of it;
- rectification of inaccurate or incomplete data;
- erasure, where applicable (we must still keep tax records);
- restriction of processing;
- portability of the data you gave us;
- to object to processing based on legitimate interest (for example the Trustpilot invitation);
- to withdraw your consent to cookies, without affecting processing already carried out: just use the cookie icon at the bottom left of every page.
You can edit your profile and ask for the deletion of your account from the My account page, or write to info@tuttomilitare.it or to our certified email postacertificata@pec.tuttomilitare.com. We reply without undue delay and in any case within one month.
10. Complaints
If you believe that the processing of your data infringes the GDPR you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, Italy · www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.
11. Minors
The website and its services are intended for adults. We do not knowingly collect data from people under 18: if we find that we have, we delete it.
12. Automated decisions
We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
13. Cookies
For cookies and other tracking tools used by the website please read the Cookie Policy.
14. Changes
We may update this policy, for example because of changes in the law or in the services we use. The version in force is always published on this page, with the date of the last update at the top.