Privacy Notice on the Processing of Personal Data

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) — Last updated: 20/06/2026

1. Data Controller

2. Types of data processed and methods of collection

2.1 Data provided directly by the user

• Personal and contact details: first name, surname, email address, telephone number, delivery and billing addresses;
• Login details: customer account credentials (email and encrypted password);
• Order details: products purchased, quantities, delivery preferences;
• Quotation details: for the Wine category, details entered in the quotation request form;
• Returns/withdrawals details: details entered during the digital withdrawal procedure;
• Payment data: card details do not pass through the Data Controller’s servers but are managed directly by Stripe.

2.2 Data collected automatically

• The device’s IP address;
• Browser type and operating system;
• Pages visited and duration of the visit;
• Date and time of access.

This data is collected via cookies and analytics tools (see Article 6 and Cookie Policy).

3. Purposes and legal bases for processing

The Data Controller does not process data on the basis of consent for the purposes of direct marketing or profiling. Should any marketing activities (e.g. newsletters) be introduced in the future, the user will be informed and consent will be obtained separately.

4. Data retention periods

• Order and invoicing data: 10 years from the end of the financial year;
• Customer account data: until the account is deleted, or for a maximum of 3 years from the last login;
• Data relating to non-converted quote requests: 12 months from the request;
• Data relating to returns/cancellations: 2 years from the conclusion of the case;
• Browsing data and technical logs: 12 months from collection;
• Analytical cookies (GA4): in accordance with the settings configured in Google Analytics (see Cookie Policy).

5. Recipients and disclosure of data

Personal data is not sold or transferred to third parties for commercial purposes. It may be disclosed to the following categories of recipients:

• Couriers and freight forwarders (GLS, BRT) — for the delivery of orders;
• Sendcloud — for the management and tracking of shipments;
• Stripe — for the processing of card payments;
• Ergonet — the Website’s hosting provider;
• Google Ireland Ltd / Google LLC — for Google Analytics 4 and Tag Manager;
• Accountant/tax adviser — for accounting and tax compliance;
• Public authorities — upon request and within the limits provided for by law.

6. Google Analytics 4 and Google Tag Manager

The Website uses Google Analytics 4 (GA4) and Google Tag Manager, services provided by Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4). GA4 collects anonymous and aggregated data on users’ browsing behaviour.

Transfer outside the EU: Google LLC is based in the USA. The transfer is governed by the Standard Contractual Clauses (SCCs) approved by the European Commission. Google’s privacy policy.

The Data Controller has configured GA4 with IP anonymisation and a retention period set to the minimum permitted. Users may object via the browser add-on available at tools.google.com/dlpage/gaoptout.

7. Data Processors (Article 28 of the GDPR)

Ergonet (Hosting)

Provider of hosting and infrastructure services for the Website. Registered office: Italy — www.ergonet.it

Stripe (Payments)

Processing of card payments. Contractual entity: Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Card details do not pass through the Data Controller’s servers. Transfer outside the EU covered by SCCs. Stripe Privacy Policy.

Sendcloud (Shipping)

Platform for managing and tracking shipments. Registered office: Sendcloud B.V., Eindhoven, Netherlands (EU). Sendcloud Privacy Policy.

Google Ireland Ltd / Google LLC (Analytics and Tag Manager)

See Article 6. Google Privacy Policy.

Sourcebuster (Order source attribution)

WooCommerce plugin to track the traffic source of orders. It collects anonymous session data via cookies (sbjs_*) without storing any personally identifiable information. sourcebustejs.com

8. Data subject rights

Pursuant to Articles 15–22 of the GDPR, you have the right to:

• Access (Art. 15): to obtain confirmation of the processing and receive a copy thereof;
• Rectification (Art. 16): to have inaccurate data corrected;
• Erasure (Art. 17): to have one’s data erased (‘right to be forgotten’);
• Restriction (Art. 18): to have the processing restricted;
• Portability (Art. 20): to receive one’s data in a structured and machine-readable format;
• Objection (Art. 21): to object to processing based on legitimate interests;
• Withdrawal of consent: to withdraw any consent given at any time.

To exercise your rights:

• Email: info@aziendalevigne.com
• Certified email (PEC): aziendalevigne@pec.it
• Mail: AZ. AGR. Le Vigne di Pettini Andrea, Località Podere Le Vigne, 39 – 58033 Montenero d’Orcia (GR)

The Data Controller will respond within 30 days of receipt, unless a justified extension of up to a further 60 days is granted.

9. Right to lodge a complaint

You have the right to lodge a complaint with the Data Protection Authority:

• Website: www.garanteprivacy.it
• Email: garante@gpdp.it
• Certified email (PEC): protocollo@pec.gpdp.it

10. Cookies

The Website uses technical and analytical cookies. For further details, please refer to the Cookie Policy.

11. Data security

The Data Controller implements appropriate technical and organisational measures to protect personal data from unauthorised access, in accordance with Article 32 of the GDPR. Data transmitted during purchases is protected by an encrypted connection (HTTPS/TLS protocol).

12. Changes to this Policy

The Data Controller reserves the right to update this Policy in the event of regulatory, technological or operational changes. The updated version will always be available on this page, indicating the date of the last update.