Versione italiana · Terms of sale · Online withdrawal

Notice under Article 13 of Regulation (EU) 2016/679 (GDPR) – last updated: November 2026

1. Controller and contact details

The controller of personal data collected through vinorosso.love is Azienda Agricola Attanasio, Via Bologna 1, 73041 Carmiano (LE), Italy, VAT No. IT03154580751, e-invoicing recipient code (SDI) M5UXCR1.

For any privacy request, email cantinaattanasio@yahoo.it.

2. Data we process

• Browsing data needed to deliver pages and protect the website, such as IP address and technical server logs.
• Order data: name, billing and delivery addresses, email, telephone, products purchased and payment data. Purchases are made as a guest: accounts cannot be created at checkout.
• Form data: contact form (name, email, message), custom gift requests, product enquiries and Corso Olmo holiday home booking, with the fields shown in each form.
• Data you send us by email or telephone.

Card payments are handled through PayPal: the website neither receives nor stores your card details.

3. Purposes and legal bases

• Handling orders, deliveries, returns, complaints and bookings, and replying to requests for quotes or information on products and gifts in view of a purchase: performance of a contract or pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Complying with legal obligations, such as tax and accounting rules: legal obligation (Art. 6(1)(c)).
• Replying to general enquiries you send us voluntarily and protecting the website against spam, abuse and attacks: the controller’s legitimate interests (Art. 6(1)(f)). You may object at any time, where provided by the GDPR, by writing to the privacy contact.
• Sending you marketing communications (newsletter): only with your specific consent, separate from any purchase or form submission, which you may withdraw at any time (Art. 6(1)(a)). Consent is optional: if you do not give it, you still receive the service requested.

Spam protection: to protect our forms, the website checks submission frequency and characteristics. Suspected abusive submissions may be blocked and logged with the sender’s name, email and message for review by authorised staff. The log keeps at most the latest 100 entries and in any case no longer than 12 months.

4. Required information

Required fields are marked in each form and at checkout. Without them we cannot reply to your request or fulfil your order. Optional information may be omitted.

5. Recipients

Your data are accessed by staff authorised by the controller and by the providers needed to run the website and the service. Contracts with providers are entered into directly by the controller.

• Website hosting and technical management: KinGart di Visconti Marco and IONOS, as processors.
• Payments: PayPal, including card payments, which processes payment data as an independent controller under its own privacy notice.
• Shipping: Packlink PRO and the carrier TNT, for delivery and for collecting returns.
• Security and spam protection: Google reCAPTCHA and Imunify.
• Fonts: Google Fonts, which receives the visitor’s IP address in order to display the website fonts.

Data may also be disclosed to authorities and advisers, such as tax and legal advisers, where necessary to comply with legal obligations or protect the controller’s rights. We do not sell your data to third parties.

6. Transfers outside the European Economic Area

Some providers, in particular Google and PayPal, may also process data outside the European Economic Area, for example in the United States. In such cases the transfer is based on the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework), for participating companies, or on the standard contractual clauses approved by the European Commission. You may request information on the safeguards applied by writing to the privacy contact.

7. How long we keep your data

• Enquiries, messages and form data: 24 months from the last contact.
• Spam log: at most the latest 100 entries and in any case no longer than 12 months.
• Existing customer accounts: deleted after 24 months of inactivity.
• Order data: 24 months from delivery for handling, support and returns; invoices and accounting records are kept for the period required by law (10 years).
• Technical and security logs: no longer than 12 months.
• Marketing consent: until withdrawn; evidence of consent is kept for as long as needed to demonstrate it.

In the event of a dispute, we may keep only the data needed to protect our rights for longer, for as long as strictly necessary.

8. Your rights

Where provided by the GDPR, you may request access to your data, correction, erasure, restriction of processing and portability; you may object to processing based on legitimate interests and withdraw any consent at any time, without affecting the lawfulness of earlier processing. You may object to direct marketing at any time. Email cantinaattanasio@yahoo.it.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

9. Cookies and similar technologies

The website uses cookies and similar technologies (such as the browser’s local storage) to work and for security. We do not use profiling or advertising cookies or third-party analytics tools.

Cookie / technology	Provider	Purpose	Duration
woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*	vinorosso.love	Technical: keeps your basket and shopping session	Session – 2 days
Browser local storage (basket, wishlist, notices already seen)	vinorosso.love	Technical: remembers your browsing choices	Until cleared from the browser
Google reCAPTCHA (_GRECAPTCHA)	Google	Security: tells people apart from automated systems on forms	6 months
PayPal cookies	PayPal	Technical: needed for payment, at checkout only	As set out in PayPal’s privacy notice
wordpress_*, wp-settings-*	vinorosso.love	Technical: only for staff logging in to the website’s admin area	Session – 1 year

Technical and security cookies do not require consent. You can still block or delete cookies in your browser settings; some features, such as the basket and checkout, may then stop working. If we use cookies requiring your consent in the future, we will ask for it first through a specific notice.

10. Changes

We may update this notice. The current version is always published on this page, with the date of the last update.