Privacy Policy

The data controller is Azienda Agricola Cester Alberto, with registered office at Via della Vittoria 34, 31043 Fontanelle (TV), Italy, VAT 04752650269.

For any communication regarding the protection of personal data, you may contact the controller at the following details:

• Email: info@casa-dei-nonni.it
• Phone: 348 1074182

In relation to the purposes set out in this policy, the controller collects and processes the following categories of personal data:

• Identity and contact data: first name, last name, email address, phone number.
• Shipping data: delivery address (street, number, city, postcode, county, country).
• Browsing data: IP address, browser type, pages visited, access times, recorded in aggregate form by the server's technical logs for operational and security purposes.
• Communications: content of messages sent via the contact form or by email.

No credit card or other payment instrument data is collected: such operations are handled directly by PCI DSS certified payment providers.

Personal data is processed for the following purposes:

• Order fulfilment: management of the purchase, payment processing, preparation and shipment of products, sending confirmations and order status updates.
• Customer support: responding to information requests, handling complaints and returns.
• Marketing communications: sending newsletters, special offers and product updates, subject to the explicit consent of the data subject.
• Legal obligations: retention of accounting and tax records as required by applicable law.
• Website security: fraud prevention and protection against unauthorised access through technical monitoring tools.

The processing of personal data is based on the following legal grounds, pursuant to Art. 6 of Regulation (EU) 2016/679:

• Performance of a contract (Art. 6(1)(b)): for processing necessary to fulfil orders and manage the sales relationship.
• Consent (Art. 6(1)(a)): for sending marketing communications and newsletters, revocable at any time.
• Legal obligation (Art. 6(1)(c)): for the retention of accounting and tax records.
• Legitimate interest (Art. 6(1)(f)): for website security activities and fraud prevention.

Personal data is retained only for the time strictly necessary to achieve the purposes for which it was collected, in compliance with the principles of data minimisation and storage limitation.

• Order-related data: retained for 10 years in compliance with Italian tax and accounting obligations.
• Support contact data: retained for 24 months from the closure of the request.
• Marketing communications data: retained until the data subject withdraws consent.
• Browsing data: retained in aggregate form for the time technically necessary for the operation and security of the site.

Once the retention period has expired, data will be permanently deleted or anonymised.

Pursuant to Articles 15-22 of Regulation (EU) 2016/679, the data subject has the right to:

• Access (Art. 15): obtain confirmation of processing and a copy of their personal data.
• Rectification (Art. 16): obtain the correction of inaccurate or incomplete data.
• Erasure (Art. 17): request the deletion of data in the circumstances provided for by law ("right to erasure").
• Restriction (Art. 18): obtain the restriction of processing in certain cases.
• Portability (Art. 20): receive their data in a structured, commonly used format.
• Objection (Art. 21): object to processing based on legitimate interest or for direct marketing purposes.
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, the data subject may send a written request to info@casa-dei-nonni.it. The controller will respond within 30 days of receipt. It is also possible to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

To provide the service, the data controller relies on certain third-party providers that process personal data on its behalf, appointed as data processors pursuant to Article 28 of Regulation (EU) 2016/679. Data is never transferred or sold to third parties for their own independent purposes. The main processors are:

• Vercel Inc.: website hosting and delivery.
• Supabase: database and management of accounts and orders.
• Stripe Payments Europe: secure processing of card payments.
• Sendcloud: management of shipping, labels and tracking.
• Resend: delivery of transactional emails (order confirmations, shipping).
• Aruba S.p.A.: domain registration and email service.

Some of these providers may also process data outside the European Union, in particular in the United States. In such cases, transfers take place only where adequate safeguards are in place under Articles 44 et seq. of the Regulation, such as the Standard Contractual Clauses approved by the European Commission or adherence to a recognised adequacy framework (EU-US Data Privacy Framework). Data may also be disclosed to public authorities where required by law.

The website uses only strictly necessary technical cookies for the operation of the platform. No profiling or third-party cookies are used for advertising purposes without the user's consent.

The types of cookies used include:

• Session cookies: shopping cart management and authentication. They expire at the end of the browser session.
• Preference cookies: storage of language and display settings selected by the user.
• Consent cookie: stores the choice made on the cookie banner.

Users may manage or disable cookies through their browser settings. Disabling technical cookies may impair the proper functioning of the website.

To exercise the rights set out in this policy or for any request regarding the processing of personal data, you may contact the controller:

• By email: info@casa-dei-nonni.it
• By phone: 348 1074182
• By post: Azienda Agricola Cester Alberto, Via della Vittoria 34, 31043 Fontanelle (TV), Italy