Quali sono i rischi se il Tax Free viene gestito in modo sbagliato?
rischi-sanzioni-tax-free-italiaPRIVACY POLICY – STAMP GROUP
Last updated: 20 November 2026
1. Glossary & Definitions
2. Introduction and scope
This Policy explains how the STAMP Group processes personal data in relation to the Services. We apply the GDPR, the LOPDGDD and other applicable EU data-protection and e-privacy rules. Structure and scope. The Group is organised around three Services, each with its own controller towards you. This Policy is structured accordingly and identifies, for each Service, the entity that acts as data controller. Where several independent controllers are involved in a Service (as in Alternative Payments), we identify them (see Section 3 and Annex I). If you do not agree with this Policy, please do not use the Services. Where you use our Services while located in the People’s Republic of China, the PIPL also applies to that processing in addition to the GDPR (see Annex II).
3. Controller and contact details
The controller depends on the Service concerned:
Tax Free
Chinese Growth Suite
Alternative Payments
General contact
4. Categories of personal data we process
4.1. Data provided by users
4.2. Merchant data
4.3. Data obtained from third parties (Article 14 GDPR)
4.4. Automatically collected data and cookies.
4.5. Special-category data and Article 10 GDPR data.
5. PURPOSES AND LEGAL BASES OF PROCESSING
We process data for:
AML/CFT, Tax and customs compliance: STAMP Group is not an obligated subject under Law 10/2010. AML/CFT and KYC obligations in the payment flows lie with the licensed payment institution (Easy Payment and Finance, E.P., S.A.), which acts as independent controller for that purpose. STAMP/Starpay does not process Article 10 data for its own AML purpose; any KYC data it handles is processed on behalf of, or transmitted to, the payment institution. Tax and customs compliance by STAMP remains under Article 6(1)(c).
Where data are legally and contractually required, or necessary to provide the service, failure to provide them may prevent registration, the transaction, or the issuance of a Tax Free invoice.
6. RECIPIENTS AND PROCESSORS
7. INTERNATIONAL TRANSFERS
We use the European Commission’s SCCs when the recipient is in a third country without an adequacy decision and we implement supplementary measures where necessary. We conduct and document TIAs and periodic reviews.
United Kingdom: transfers rely on the European Commission’s adequacy decision for the UK (in force until 27 December 2031); no additional safeguards are required.
United States: where the provider is certified under the DPF, we rely on that certification; otherwise, we use SCCs plus additional measures.
China (PRC): as there is no adequacy decision, we use the European Commission’s SCCs together with supplementary technical and organisational measures for any transfer to the PRC, supported by a documented TIA. Only where SCCs cannot be used and a specific transfer is occasional and strictly necessary to perform a contract at your request may we exceptionally rely on Article 49(1)(b) GDPR, on a case-by-case basis. You may request a copy or summary of the transfer safeguards at dpo@askforstamp.com. We host the mini-programs on infrastructure located in the European Union (databases in the EU) and do not host personal information in China. Separately, where individuals access our Services while located in China, the PIPL applies to that processing; this is addressed in Annex II.
8. RETENTION PERIODS.
We retain data for as long as necessary for the purposes described, applying the following criteria: (i) for the duration of your relationship with us and the provision of the Services; (ii) thereafter, for the limitation periods applicable to potential legal or contractual claims; and (iii) for any longer period required by a specific legal obligation.
9. RIGHTS OF DATA SUBJECTS
You have the rights of access, rectification, erasure, restriction, portability and objection, and you may withdraw consent at any time without affecting the lawfulness of processing carried out beforehand. The rights relating to automated decision-making are described in Section 13.
To exercise these rights you may contact us at dpo@askforstamp.com or at the postal addresses set out in Sections 3 and 15. We will verify your identity before responding and will reply within one month of receipt; this period may be extended by up to two further months where the request is complex or where several requests have been received, in which case we will inform you of the extension and the reasons for it.
If you believe that the processing of your data does not comply with applicable law, you have the right to lodge a complaint with the competent supervisory authority (in Spain, the Spanish Data Protection Agency (AEPD, www.aepd.es)) without prejudice to any other administrative or judicial remedy.
10. INFORMATION SECURITY
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of individuals. These measures are designed to protect personal data against unauthorised or unlawful access, alteration, disclosure, loss or destruction, and to preserve its confidentiality, integrity and availability. We review and update them as necessary and require our processors to maintain an equivalent level of protection. In the event of a personal data breach, we will act in accordance with our incident-response procedures and notify the competent authorities and affected individuals where legally required.
11. COOKIES AND SIMILAR TECHNOLOGIES
We use cookies and similar technologies. Those that are not strictly necessary are used only with your prior consent, which you can give, refuse or withdraw at any time through our cookie banner and settings. Further details are set out in our Cookie Policy.
12. MINORS
The Services are not directed to individuals under 18. For Tax Free transactions involving minors travelling with an adult, the responsible adult must provide the minor’s data and confirm they have authority to do so.
13. AUTOMATED DECISION-MAKING AND PROFILING
We use automated systems for fraud prevention and transaction risk assessment, analysing signals such as device identifiers, IP reputation, transaction velocity, geolocation (where consented), chargeback history and merchant risk indicators. Where a decision is based solely on automated processing and produces legal effects concerning you or similarly significantly affects you (e.g. declining a transaction), we carry out that processing because it is necessary for entering into or performing a contract with you and/or to comply with a legal obligation to prevent fraud (Article 22(2)(a) and (b) GDPR). In those cases you have the right to obtain human intervention, to express your point of view and to contest the decision.
Separately, we carry out marketing segmentation to personalise content; this does not produce legal or similarly significant effects and, where it involves tracking technologies, is based on your consent.
14. CHANGES TO THIS POLICY
We may update this Policy to reflect legal, technical or operational changes. We will provide reasonable advance notice where changes are significant.
15. CONTACT
ANNEX I – Alternative Payments: roles and transparency
When you pay a participating merchant using a Chinese wallet (WeChat Pay, Alipay, Alipay+), the processing of your payment data involves the following parties and roles:
ANNEX II – Notice for users located in the People’s Republic of China (PIPL)
This Annex applies where you access and use our mini-programs or official accounts while you are physically located in the People’s Republic of China. Because we process the personal information of individuals in China in order to offer them our Services, the PIPL applies to this processing in addition to the GDPR.
Who is responsible. The controller is identified in Section 3 (Chinese Growth Suite): for our own mini-programs, Starpay Iberia, S.L.; for mini-programs operated on behalf of a merchant, the merchant is the controller and Starpay Iberia, S.L. acts as its processor.
Information. Before your personal information is collected, we provide a privacy notice in Chinese within the mini-program itself, explaining what data we collect and for what purposes.
Consent. We process your personal information on the basis of your consent. We obtain your separate consent where the PIPL requires it, in particular (i) to share your personal information with the merchant whose services or tickets you purchase (for example, a museum or a school) and (ii) to process your passport number, which the PIPL treats as sensitive personal information and which we only request where a merchant needs it.
Your rights. You may access, obtain a copy of, correct, supplement and delete your personal information, and withdraw your consent at any time without affecting processing carried out beforehand. You can exercise these rights in Chinese through the mini-program or by contacting dpo@askforstamp.com.
Representative in China. We will designate a dedicated contact or representative established in the People’s Republic of China responsible for personal-information protection and will report its name and contact details to the competent Chinese authority, as required by Article 53 PIPL. These details will be published here once the representative is designated.
Where your data is stored. We store your personal information on infrastructure located in the European Union (with databases in the EU). We do not host it in China.
Complaints. You may address any query or complaint to dpo@askforstamp.com or, once designated, to our representative in China, and you may also lodge a complaint with the competent authority. We will endeavour to resolve your request promptly.
End of document