Last updated: 22 August 2026
This Privacy Policy explains how personal data is collected and processed when you visit activitybookshop.com (the “Website”), purchase a digital product, access the audio library, contact us, request a quotation for a printed book or subscribe to our newsletter.
1. Data Controller
The Data Controller is:
WebImmagine di De Prisco Maria Daniela
Via Dario Scaglione 4
12051 Alba (CN), Italy
VAT No. IT03841410040
Email: support@activitybookshop.com
No Data Protection Officer has been appointed, as the conditions requiring such an appointment do not currently apply.
2. Personal Data We Collect
Depending on how you use the Website, we may process the following categories of personal data:
- Purchase and fulfilment data: email address, country or billing information supplied during checkout, product purchased, amount paid, payment status, Stripe transaction or Checkout Session identifiers, order date, download activity and related technical logs.
- Payment data: payment card details and other payment credentials are collected and processed directly by Stripe. We do not receive or store your complete card details.
- Audio-library access data: email address, purchase verification data, access tokens, authentication attempts and technical logs necessary to provide and protect access to the audio content included with the product.
- Contact and quotation data: name, email address, requested format (A4 or US), the contents of your message, form-submission date and technical information associated with the submission, and any other information you choose to provide when requesting general information or a quotation for a printed book.
- Newsletter data: email address, subscription source and date, confirmation date, subscription status, proof of consent and, where recorded, IP address and technical information associated with the subscription. For newsletters sent after confirmation, we may also process delivery information and, where enabled and permitted, email opens and link clicks.
- Website and device data: IP address, browser and device information, operating system, approximate location, pages viewed, interactions with the Website, referral source, cookie identifiers and similar online identifiers.
- Cookie-consent data: consent choices, consent identifier, date and time of consent and information necessary to document, manage or withdraw your choices through Cookiebot.
Please do not include sensitive personal data or information about children in free-text messages unless it is strictly necessary and specifically requested by us.
3. Purposes, Legal Bases and Retention Periods
3.1 Purchases, payments and digital-product delivery
We process purchase and fulfilment data to:
- manage checkout and verify payment;
- deliver the purchased PDF and send the related access or download email;
- provide access to the audio library included with the product;
- provide customer support and handle technical issues, refunds, disputes or complaints;
- comply with accounting, tax and other legal obligations.
The legal bases are the performance of a contract or steps taken at your request before entering into a contract (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c) GDPR), and our legitimate interest in preventing fraud, securing our services and establishing or defending legal claims (Article 6(1)(f) GDPR).
Order, invoice and accounting information is retained for the period required by Italian law, normally 10 years. Technical download and access logs are retained only for the time reasonably necessary to provide the service, investigate misuse or resolve disputes, and in any event no longer than 24 months, unless longer retention is required in connection with a legal claim or security incident.
3.2 General enquiries and printed-book quotation requests
When you use the contact form, we process your name, email address, requested format (A4 or US), message and any information you voluntarily provide in order to:
- answer general enquiries;
- understand your requirements;
- prepare and manage a quotation for a printed book;
- continue the related correspondence.
The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). For purely general enquiries that do not concern a possible contract, the legal basis is our legitimate interest in responding to communications addressed to us (Article 6(1)(f) GDPR).
General enquiries are normally retained for up to 12 months after the last relevant communication. Quotation requests and related correspondence are normally retained for up to 24 months after the last communication, unless a contract is concluded or longer retention is necessary for legal or administrative reasons.
Submitting the data marked as required in the form is necessary for us to respond. If you do not provide it, we may be unable to process your request. Providing any additional information is optional.
Contact and quotation forms are created using Convert Forms, a Joomla extension installed on the Website. Depending on the applicable form settings, submissions may be stored in the Website’s Joomla database on our hosting infrastructure and sent to the email address designated to manage the request. Convert Forms is used as locally installed software and does not, merely through this use, operate as an external mailing-list platform.
3.3 Newsletter
If you separately choose to subscribe, we process your email address and the related subscription data to send newsletters containing news, product updates, educational content and promotional offers from Activity Book Shop.
The legal basis is your consent (Article 6(1)(a) GDPR). Newsletter consent is optional, separate from purchases and contact requests, and is not a condition for receiving a quotation, purchasing a product or accessing purchased content.
You can withdraw your consent at any time by clicking the unsubscribe link included in every newsletter or by writing to support@activitybookshop.com. Withdrawal does not affect the lawfulness of processing carried out before it.
Newsletter data is processed until you unsubscribe or withdraw your consent. After that, the data is deleted or anonymised, except for the minimal information that may be retained where necessary to document consent, honour your opt-out, prevent further unsolicited messages, or establish or defend legal claims.
The newsletter subscription form is created using Convert Forms, a Joomla extension installed on the Website. When the form is submitted, the email address and related subscription information are transferred within the Website to AcyMailing, a Joomla newsletter-management extension installed on the Website.
We use a double opt-in process. After submitting the form, you receive a confirmation email from AcyMailing and your subscription becomes active only after you click the confirmation link. AcyMailing records the subscription and confirmation status so that we can manage the mailing list and document consent.
Subscriber data is stored in the Website’s Joomla database on hosting infrastructure provided by Ergonet S.r.l.. Newsletter and confirmation emails are initially sent through the email infrastructure associated with our hosting service. Convert Forms and AcyMailing are locally installed software components; their respective vendors do not receive subscriber data merely because these extensions are used. If we later appoint a separate external email-delivery provider, this Privacy Policy will be updated before that provider is used.
Where newsletter delivery, open or click information is processed, we use it to monitor technical delivery and evaluate or improve our communications. Individual-level tracking is used only where permitted by applicable law and, where required, on the basis of consent. You may prevent the loading of remote images through your email-client settings; however, link clicks may still be recorded when tracked links are used.
3.4 Website analytics and advertising measurement
With your consent, we use Google Analytics 4 to understand how visitors use the Website and Google Ads technologies to measure advertising performance and conversions. These services may process online identifiers, cookie identifiers, IP and device information, browsing events, referral information and interactions with the Website.
The legal basis is your consent (Article 6(1)(a) GDPR). Analytics and advertising cookies or similar technologies are managed through Cookiebot by Usercentrics and are not activated before consent, except where a limited cookieless function is permitted by applicable law and configured accordingly. You may refuse or withdraw your consent at any time through the Website’s cookie settings, without affecting access to its essential functions.
User-level and event data in Google Analytics is retained for 14 months, subject to the specific retention rules applied by Google. Data processed independently by Google is retained according to Google’s own policies. Further information is available in Google’s Privacy Policy and its business data privacy information.
Detailed information about cookies, their duration and how to change your choices is provided in our Cookie Policy and through the Cookiebot preference panel.
3.5 Cookie-consent management
We use Cookiebot by Usercentrics to collect, store and manage your cookie-consent choices and to demonstrate compliance with applicable consent requirements.
The processing of consent information is based on compliance with our legal obligations (Article 6(1)(c) GDPR) and our legitimate interest in documenting and managing users’ privacy choices (Article 6(1)(f) GDPR). Consent records are retained only for as long as necessary to demonstrate compliance and according to the applicable legal limitation periods and Cookiebot settings.
3.6 Website security, fraud prevention and legal claims
We may process technical logs, IP addresses, transaction information and communications to maintain the security of the Website, prevent fraud and misuse, enforce our terms, and establish, exercise or defend legal claims.
The legal basis is our legitimate interest in protecting our Website, business and users (Article 6(1)(f) GDPR), as well as compliance with legal obligations where applicable (Article 6(1)(c) GDPR). Such information is retained only for as long as reasonably necessary for these purposes, unless an incident, dispute or legal obligation requires longer retention.
4. Cookies and Similar Technologies
The Website uses technical cookies necessary for its operation and, subject to your consent, preference, analytics and advertising cookies, including technologies associated with Google Analytics 4 and Google Ads.
When you first visit the Website, Cookiebot allows you to accept or reject non-essential cookies and manage your preferences by category. Refusing non-essential cookies does not prevent you from purchasing products, sending a contact request or accessing purchased content. You can change or withdraw your choices at any time through the cookie-preference control available on the Website.
For the complete and dynamically updated list of cookies and trackers detected on the Website, please see our Cookie Policy.
5. Recipients and Service Providers
Personal data may be accessed or processed, only where necessary, by:
- authorised persons working for or with the Data Controller;
- Ergonet S.r.l., for website hosting, database infrastructure and the email-delivery services associated with our hosting plan;
- website maintenance, security and IT service providers;
- Stripe, for checkout, payment processing, fraud prevention and related services;
- Cookiebot/Usercentrics, for cookie scanning and consent management;
- Google, in connection with Google Analytics 4 and Google Ads, where you have consented;
- professional advisers, accountants, insurers, banks, public authorities or courts where required by law or necessary to protect our rights.
Service providers acting on our behalf are appointed as processors where required by Article 28 GDPR and may process data only under our instructions and for the agreed purposes. Some providers may also act as independent controllers for specific processing activities, as explained in their own privacy notices.
Stripe processes payment information under its own privacy documentation. Please see Stripe’s Privacy Policy and Stripe Privacy Center.
We do not sell your personal data.
6. International Data Transfers
Some service providers, including Stripe, Cookiebot/Usercentrics and Google, may process data from countries outside the European Economic Area (“EEA”), including the United States.
Where personal data is transferred outside the EEA, we rely on safeguards recognised under applicable data-protection law, such as an adequacy decision, participation in an applicable Data Privacy Framework where valid, or the European Commission’s Standard Contractual Clauses, together with supplementary measures where required.
You may contact us at support@activitybookshop.com for further information about the safeguards applicable to a specific transfer.
7. Data Security
We adopt appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. However, no online transmission or storage system can be guaranteed to be completely secure.
8. Children’s Privacy
Our products may be used by children under the supervision of a parent, guardian or educator, but the Website, checkout, contact form, newsletter and audio-library access are intended for adults. We do not knowingly request or collect personal data directly from children.
If you believe that a child has provided personal data to us without appropriate authorisation, please contact support@activitybookshop.com so that we can assess the situation and, where appropriate, delete the data.
9. Your Data-Protection Rights
Subject to the conditions provided by applicable law, you may request:
- access to your personal data and a copy of it;
- correction of inaccurate or incomplete data;
- deletion of your data;
- restriction of processing;
- portability of data processed by automated means on the basis of consent or a contract;
- objection to processing based on legitimate interests;
- withdrawal of consent at any time, without affecting prior lawful processing.
You also have the right to object at any time to processing for direct-marketing purposes.
To exercise your rights, contact support@activitybookshop.com. We may request information necessary to verify your identity and will respond within the time limits established by applicable law.
You also have the right to lodge a complaint with the Garante per la protezione dei dati personali, the Italian supervisory authority, through www.garanteprivacy.it, or with the competent supervisory authority in the country where you live or work or where you believe an infringement occurred.
10. Automated Decision-Making
We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
11. Third-Party Links
The Website may contain links to third-party websites or services. Their processing of personal data is governed by their own privacy policies, and we are not responsible for their privacy practices.
12. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to the Website, our services or applicable legal requirements. The current version will always be published on this page, together with the date of the latest update. Where changes materially affect processing based on consent, we will request a new consent where required.
13. Contact
For questions about this Privacy Policy or the processing of your personal data, please contact:
WebImmagine di De Prisco Maria Daniela
Email: support@activitybookshop.com