- We use data to make purchases, room try-ons, and accounts work — we do not sell it or use it for advertising without your consent.
- We send the room photo for the trial to the Nexys Server only to generate the image; we delete it from the server after 24 hours at the latest, unless you save the trial yourself.
- The seller from whom you buy receives your name, address, and phone number only when they accept the order — solely for delivery.
- You have all rights under the General Data Protection Regulation (GDPR) — copy, rectification, erasure, and others: Your data.
Who processes your data
The data controller for furnituria.co is Nexys Srl, Galleria Arrigo Protti 2, 34121 Trieste, Italia, P. IVA 01447020320, Codice univoco (SDI) N92GLON (hereinafter: "we"). For all data-related questions, write to [email protected].
furnituria.co is an online platform: showrooms, workshops, and manufacturers (sellers) sell on it. When you buy, you enter into a purchase agreement with the seller. For data received for delivery, invoices, and complaints, the seller is an independent controller and is responsible for them under GDPR. Partners who sell on their own website ("Buy from seller") process data according to their privacy policy.
What data we process
| Category | Data | Source |
|---|---|---|
| Account | first and last name, email, phone, delivery addresses, password (encrypted only) | from you |
| Orders | products, prices, payment method, delivery address, shipment number and status, delivery confirmation | from you, the seller, and the courier |
| Try in room | room photo, selected products and style, generated image | from you |
| Wishlist and notifications | selected products; email for price or stock notifications; phone notification subscription | from you |
| Communication | contact form messages, reviews and accompanying photos, content reports, data requests | from you |
| Acceptance of terms | time, IP address, browser, language, text of the field you checked, and version of accepted documents | automatically, when you check acceptance |
| Newsletter | email, name (if you enter it), time and method of giving consent | from you |
| Country and language | country determined by IP address or your choice, selected language | automatically or by you |
| Technical data | truncated IP address fingerprint (for abuse protection), device and browser type, server logs, cookies (see Cookie Policy) | automatski |
| Sellers and partners | company and contact person data, VAT and registration number, IBAN, WhatsApp number, team members, sales and commission | from the seller |
We do not request or process special categories of data (health, religious beliefs, etc.). We do not make decisions about you solely by automated means, nor do we profile you for advertising.
Why and on what basis
| Purpose | Legal basis (GDPR, Art. 6 para. 1) |
|---|---|
| Account, order, delivery, payment, room try-on you initiate, notifications you request | performance of a contract and actions at your request (point b) |
| Invoices, complaints, withdrawal from contract, retention of business documentation, seller data and handling of content reports | legal obligation (point c) — EU and Italian consumer protection, accounting and tax regulations, Digital Services Act (Regulation (EU) 2022/2065) |
| Newsletter, analytical cookies, phone notifications | your consent (point a) — you can withdraw it at any time |
| Website security, prevention of fraud and abuse, display of offers for your country, confirmation of order delivery, service improvement | legitimate interest (point f) — you can object |
| Proof that the terms have been accepted (protection against disputes and defense of legal claims) | legitimate interest (point f) |
Room try-on and artificial intelligence
When you start a trial, we send the room photo and the selected products to the Nexys Server, which creates an image with the product in your room. To create the image, the server uses an external AI processor, which processes the photo as our processor, under a data processing agreement.
- The photo and generated image are automatically deleted from our server no later than 24 hours.
- If you save the try-on in "My Try-ons", we store it until you delete it or request account deletion.
- Please do not photograph people, documents, apartment numbers, or other identifiable information.
- The image is generated by artificial intelligence and serves as an illustration: colors, scale, and appearance may differ from the actual product.
- Offer after trial — only if you enable it yourself on the trial result: we store your email address and products from the trial to send you the seller's offer (personal discount code). If you are not logged in, you first confirm your address via email. The seller does not see your address — they only see how many customers are waiting for an offer; we send the email, at most one offer per product per month, and you can unsubscribe in every email.
- "Ask the household" — when you share a saved trial, anyone with the link can see the trial image, products, votes, and comments. You can turn off the link whenever you want; the votes are then deleted as well.
- Room layout from photo — the photo is sent to the Nexys Server (which uses an external AI processor for this) only to estimate dimensions, doors, and windows and is deleted immediately; we do not store it and it is not linked to your account. The layout you arrange is saved only in your browser.
- 3D floor plan — the floor plan you upload is processed on the Nexys Server to identify rooms and create a 3D view; to create the view, the server uses an external AI processor as our data processor. The floor plan and 3D view are stored in your account until you delete them (a maximum of 20 recent ones); working copies are deleted from the server after 24 hours. Sellers cannot see your plan — they only see that a 3D plan with their products has been created (in the token history), without any of your personal data.
- “Ask us” Assistant — the question you type is sent to the Nexys Server (which uses an external AI processor for this) along with parts of our site pages and product data to generate a short answer. We do not send your name, account, address, or orders. We store questions without an IP address and without a link to your account (at most the last 300) to improve answers, and we reuse the same answer for the same question for up to 7 days. Do not enter personal data in the question.
- Insights for sellers — the seller sees in aggregate what kind of spaces their products are being tried in (room type, style, colors, approximate size) and what room sizes customers are looking for, without the photo and without any data that could identify the customer.
To whom we give data
- To the seller from whom you buy — name, address, phone, and order items, only when they accept the order, solely for delivery, invoicing, and complaints.
- To the courier service chosen by the seller (e.g., DHL, UPS, FedEx) — recipient data required for delivery and, for cash on delivery, the amount to be collected.
- Delivery partner with assembly/placement — only if you select "Delivery with placement" in the cart via our platform partner: when the seller accepts the order, the partner receives your name, address, and phone number for delivery, your order note, and the list of items, so they can pick up the goods from the seller and deliver them with placement. The partner uses this data only for that delivery.
- External AI processor (via Nexys Server) — the photo for the room trial, the photo for the room layout, and the floor plan for the 3D apartment plan, as described above, and the text of the question you ask the “Ask us” assistant.
- To the hosting provider — Contabo GmbH, Germany; the server is in the European Union. Emails are sent by our server.
- Cloudflare (Cloudflare, Inc.) — the site operates via the Cloudflare network for protection and speed, and when you start a room trial or 3D plan, Cloudflare Turnstile checks that the trial is not being run by an automated program. In doing so, it processes your IP address and technical browser data, without tracking cookies or advertising; the legal basis is our legitimate interest in protecting the site from abuse. Cloudflare may process this data outside the EU, subject to standard contractual clauses and the EU-U.S. Data Privacy Framework.
- WhatsApp (Meta) — only if you click 'Video call' or 'Send message' to the seller yourself; the conversation takes place on WhatsApp, according to their policy. We only record that contact has been established, without content.
- To partners — when you go to the seller's website through us, we only forward an anonymous visit ID so that the sale can be attributed to the platform; they do not receive your personal data from us.
- To authorities — only when required by law.
We do not sell or rent data.
Transfer of data outside the European Union
We store data on a server in Germany (EU). The external AI processor may also process this data in the USA; such transfer is based on the European Commission's adequacy decision (EU–US Data Privacy Framework) and standard contractual clauses. You can request a copy of these safeguards at [email protected].
How long we store data
| Data | Deadline |
|---|---|
| Photo and room try-on image | up to 24 hours; saved try-ons until you delete them |
| Account | until you delete it or request its deletion |
| Orders and invoices | as required by accounting and tax regulations (in Italy 10 years), then deleted or anonymized |
| Newsletter and price/stock notifications | until unsubscribed (link is in every email) |
| Request for offer after trial | 60 days from request; the unsubscribe is remembered for a year so we don't send you offers |
| Shared trial ("Ask the household"), votes and comments | until you turn off the link or delete the trial |
| Contact form messages, content reports, and requests | as long as necessary for a response, up to 2 years |
| Cookie consent log | 3 years (proof of consent) |
| Proof of acceptance of terms | 10 years from acceptance (statute of limitations for claims) |
| Server and attack protection logs | briefly, within regular log rotation |
Your rights
Under GDPR (Art. 15–22), you have the right to:
- obtain a copy of your data and information on how we process it;
- request the correction of inaccurate or completion of incomplete data;
- request deletion ('right to be forgotten'), except for data we are legally obliged to retain;
- request restriction of processing;
- receive data in a machine-readable format (data portability);
- lodge an objection to processing based on legitimate interest;
- withdraw consent at any time (newsletter, cookies, notifications), without affecting prior processing.
Send your request via the Your data page or to [email protected]. We respond without delay, and no later than one month; in complex cases, the deadline may be extended by two more months, of which we will inform you. The procedure is free of charge. If you believe that the processing is unlawful, you have the right to lodge a complaint with: Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, Italy) or the data protection supervisory authority in the EU member state where you live, work, or where the infringement occurred (list of authorities).
How we protect data
- All traffic is encrypted (HTTPS); passwords are stored only in encrypted form.
- The site operates on a separate part of the server, with restricted access, attack protection, and regular backups.
- The seller sees customer data only when they accept an order; seller team members see only what they are authorized for.
- Only authorized persons have access to administration.
Minors
The site is not intended for persons under 16 years of age, and only adults can make purchases. If we learn that we have collected data from a minor without parental consent, we will delete it.
Policy changes
We change the policy when the site's operation or regulations change. The effective date is at the top of the page; we notify users with an account of significant changes via email.