This policy describes the procedures followed by Pasticceria Confetteria Cova S.r.l. (hereinafter "Cova" or the "Controller" or the “Company”) in relation to the processing of personal data collected through the website (hereinafter the "Website").

Unless otherwise stated, this policy also applies as an information notice - in accordance with art. 13 of Regulation (EU) no. 2016/679 (hereinafter the "GDPR") - rendered to those who interact with the Website (hereinafter the "User").

Information on the processing of detailed personal data is provided, where necessary, in the pages relating to the individual services offered through the Website. Such information is aimed at defining the limits and methods of processing the personal data of each service, on the basis of which the User can freely express his consent, where necessary, and possibly authorize the collection of data and their subsequent processing.


The Data Controller is Cova, with registered office in Via Pietro Cossa 2, 20122 Milano (MI), tel. +39 0276002750, e-mail The updated list of any data processors is available at the registered office of the Controller.


They may be collected and processed through the Website:


Cookies are small text files that websites you visit send to your terminal, where they are stored, and then retransmit to the same websites the next time you visit. Cookies allow websites to function properly and efficiently to improve your experience by allowing the website to store information in the memory of your computer or other devices.

The Website uses technical cookies. Such cookies, due to the technical nature, do not require the prior consent of the User to be installed and used.

In particular, the cookies used on the Website are traceable to the following subcategories:

The third party cookies installed on the Website are listed below. For each of them, there is a link to the relative information notice on the processing of personal data carried out and the methods for deactivation of any cookies used. With regard to third party cookies, the Controller is only obliged to insert the link to the third party's website in this policy. On the other hand, the latter is required to provide information and indicate how to consent to and/or deactivate cookies.

Cookies may be disabled by the User by checking and/or changing their browser settings based on the instructions made available by their providers to the links listed below.


Personal data collected through the Website will be processed:

  1. for the management of requests for information submitted by the User;
  2. for sending commercial communications about products and services, by e-mail, text message, mms, fax or the like and/or by postal service or operator telephone calls;
  3. to carry out profiling activities with a view to carrying out the activities referred to in letter b);
  4. for the sharing and/or communication of data to Cova's business partners - for the sending by the latter of commercial communications on their own products and services;
  5. for the performance of sales agreement to which the User is a party or for taking pre-contractual measures at his request;
  6. for the performance of legal obligations, including any administrative or accounting activities, in connection with the sale;
  7. in the context of the communication of data between the Company and parent, subsidiary or affiliated companies, for administrative and accounting purposes, or related to activities of an organizational nature - including those functional to the fulfilment of contractual and pre-contractual, administrative, financial and accounting obligations;
  8. for the sending of communications aimed at the promotion and/or direct sale of products or services similar to those you have already purchased (so-called "soft spamming"), without prejudice to your right to object at any time.

The processing of personal data for the purposes under a) does not require the consent of the User as the processing is necessary to meet specific requests of the subject concerned under art. 6, par. 1, lett. b) of the GDPR. The processing of personal data for the purposes under b), c) and d) requires the consent of the User pursuant to art. 6, par. 1, lett. a) of the GDPR.

The processing of personal data for the purposes under e) does not require the consent of the User as the processing is necessary for the fulfillment of specific contractual obligations, pursuant to art. 6, par. 1, let. b) of the GDPR. The processing of personal data for the purposes under f) does not require the consent of the User as it is necessary to comply with the legal obligations to which the Controller is subject, under art. 6, par. 1, let. c) of the GDPR. The processing of personal data for the purposes sub g) and h) does not require your consent as it is necessary for the pursuit of the legitimate interests of the Controller, pursuant to art. 6, par. 1, let. f) of the GDPR.


The Data may be communicated and/or transferred to the Controller's commercial partners located in countries outside the European Union that may not guarantee an adequate level of protection. In particular, the transfer may be made to the following countries, on the basis of the conditions of legitimacy indicated in relation to each of them:


The provision of personal data for the purposes under a), b), c) and d) is optional and failure to provide them shall result, as a consequence, the only impossibility for the Data Controller to manage and process requests or to send commercial communications on products and services of the same or to carry out the activities specified.

The provision of personal data for the purposes under e) and f) is necessary to fulfill the legal and contractual obligations on the part of the subject concerned and the Controller. The provision of personal data for the purposes under g) is necessary for the pursuit of the legitimate interests of the Company indicated above. In all these cases, failure to provide the data shall make it impossible for the Company to respond to your purchase request and manage your contractual relationship.


Personal data may be made accessible, brought to the attention of or communicated to the following subjects, who will be appointed by, depending on the case, as processors or subprocessors:

In any case, personal data will not be disclosed.


The data shall be stored for a maximum period of time equal to the period of prescription of the rights that can be activated by the Controller, as applicable from time to time. In the case of processing for marketing purposes, the data shall be stored for a maximum period of 24 months; for profiling purposes, the data shall be stored for a maximum period of 12 months.


Concerned subjects are entitled to the rights set out in art. 15 to 20 of the GDPR. By way of example, any concerned subject may:

  1. obtain confirmation as to whether or not personal data relating to him are being processed;
  2. where processing is ongoing, to obtain access to personal data and information relating to the processing and to request a copy of the personal data;
  3. rectify inaccurate personal data and integrate incomplete personal data;
  4. to obtain, where one of the conditions laid down in art. 17 of GDPR are satisfied, the deletion of personal data concerning him;
  5. to obtain, in the cases provided for in art. 18 of the GDPR, the restriction of processing;
  6. receive their personal data in a structured format that is commonly used and machine-readable, and request their transmission to another controller if technically feasible.

Every concerned subject has the right to object at any time to the processing of his/her personal data carried out in order to pursue a legitimate interest of the Controller. In the event of objection, personal data will no longer be processed, unless there are legitimate reasons to carry out the processing that prevail over the interests, rights and freedoms of the concerned subject or for ascertaining, exercising or defending a right in court.


In the event that consent is required for the processing of personal data, each interested party may, at any time, revoke the consent already given, without prejudice to the lawfulness of the processing based on consent given before the revocation. Consent can be revoked by writing an email to


With reference to the processing of personal data for the purposes under lett. b), d) and h) each concerned subject may revoke at any time any consent given or object their processing, by writing an email to Objection to the processing exercised through these methods also extends to the sending of commercial communications by postal service or telephone calls with an operator, without prejudice to the possibility of exercising this right in part, objecting for example only the processing carried out through automated communication systems.


In addition, any concerned subject may lodge a complaint with the Italian Data Protection Authority in the event that he/she believes that his/her rights under the GDPR have been violated, in accordance with the procedures indicated on the Italian Data Protection Authority’s website accessible at:


This Privacy Policy will be subject to updates. The Controller therefore invites Users who wish to know how personal data collected through the Website will be processed to periodically visit this page.

Having read and understood the information notice on the processing of my personal data:

This website uses both its own and third party cookies to enhance your browsing experience. By closing this banner of clicking “I agree”, you consent to the use of cookies. If you want more information or if you want to refuse the consent to all or some cookies, click here. Close/accept.