Privacy Policy

1. Who processes your data

The data controller is the company shown below, which decides the purposes and means of processing.

We have not appointed a Data Protection Officer (DPO): the conditions of Article 37 GDPR do not apply. For any question about your data you can write to the addresses above.

2. What data we collect

Data you give us

• Tasting requests: first name, last name, email, phone, preferred date, number of guests (adults and children).
• Event requests: first name, last name, email, phone, type of event and the message you write to us.
• Newsletter: first name, last name and email.
• Online orders: first name, last name, email, phone, delivery address, any notes and the message for the gift wrapping; if you ask for an invoice, tax code or company name, VAT number, recipient code (SDI) or certified email (PEC) and billing address. We also record your statement that you are of legal drinking age and your acceptance of the terms of sale, with date and time.

You enter your card details in a Stripe form and they go straight to Stripe: we never see or store them. From Stripe we only receive the outcome of the payment.

Please do not send us, through the forms, data belonging to special categories (Article 9 GDPR) — for example information about health, allergies or intolerances. If you have dietary requirements to tell us about, we discuss them directly on the phone when we confirm the visit.

Data collected automatically

• Browsing data: IP address, browser and device type, date and time of the request, pages visited. These are the technical logs that every web server records in order to work and to be protected from abuse.
• Browser local storage: the site saves some technical information on your device, for example the choice you make in the cookie banner. It is not used to profile you. The full list, purposes and durations are in the Cookie Policy.

Measurement and marketing tools: with your consent, we collect statistical and interaction data through the tools listed in the Cookie Policy. If you have accepted statistics cookies, the purchase is also recorded in Google Analytics (order number, products and amount), without your name, email or address.

3. Why we process it and on what legal basis

Once these periods expire the data is deleted or anonymised, unless it must be kept to defend a legal claim.

4. Do you have to give us your data?

No. Providing it is voluntary. However, the fields marked as required in the forms are what we need in order to reply: without a name, email or phone number we cannot get back to you. Marketing consent, on the other hand, is entirely optional: if you do not give it, you will still receive a reply to your request. To buy, however, we need the details in the order form: without them we cannot ship the products or issue the tax document.

5. Who we share the data with

Your data is neither sold nor transferred to third parties for their own purposes. It may be processed, on our behalf and on our instructions, by the suppliers that make our work possible, appointed as data processors (Article 28 GDPR):

• Hosting provider — the servers hosting the site are located in the European Union (Frankfurt, Germany).
• Adobe Fonts (Adobe Inc.) — supplies some of the site's typefaces. To serve them it receives your IP address. It sets no profiling cookies and does not use this data for advertising.
• Email, certified email and database providers — to receive and store what you send us through the site.
• Stock management and invoicing software — to record orders and issue tax documents.
• Google and Microsoft — for statistics and marketing, only with prior consent. Details in the Cookie Policy.
• Advisors and professionals (e.g. accountants) and public authorities, where the law requires it.

The one exception, and only if you accept marketing cookies:

• Meta (Meta Platforms Ireland Ltd., Ireland) — through the Meta Pixel it receives from your browser your IP address, browser data, the pages you visit and some actions you take on the site: products you view and add to the cart, the start of payment and sending a form (not its content). When you send a form or complete a purchase, the same event is also sent by our server (Meta Conversions API), with the order number, products and amount, and with your contact details in encrypted form (SHA-256 hash, never in plain text): email, phone, first and last name and, for purchases, city, postcode, province and country of delivery. Meta uses them to match the event to your account, if you have one. Meta never receives the text of messages, the full address or billing details. For the collection and transmission of this data we are joint controllers with Meta (Art. 26 GDPR), under Meta’s joint controller addendum. After the transmission Meta processes the data as an independent controller, also for its own purposes such as advertising, as described in its privacy policy. You can exercise your rights over this data with us or directly with Meta, which handles requests about the data it stores after the transmission. Meta may transfer the data to the United States to Meta Platforms, Inc., which participates in the EU–U.S. Data Privacy Framework.

Some data is also received, as independent controllers, by parties that also use it for their own obligations:

• Stripe (Stripe Payments Europe, Ltd., Ireland) — processes payments. It receives your card details directly from you; from us it receives the name, phone number, delivery address and amount of the order. It also uses them to prevent fraud and for the legal obligations of the payments sector, as described in its privacy policy.
• Mail Boxes Etc. and the couriers — receive the recipient’s name, address and phone number to ship and deliver the order.

6. Transfers outside the European Union

The site is hosted on European servers. Some suppliers may however be based in the United States or process data outside the European Economic Area. In those cases the transfer only takes place with the appropriate safeguards set out in Articles 44 ff. GDPR: an adequacy decision of the European Commission (for those adhering to the EU–U.S. Data Privacy Framework) or Standard Contractual Clauses. You can ask us for a copy of the safeguards in place by writing to info@saottinivini.com.

7. Your rights

At any time, and free of charge, you can exercise the rights set out in Articles 15–22 GDPR:

• Access: find out whether we process your data and obtain a copy of it.
• Rectification: correct inaccurate or incomplete data.
• Erasure: be forgotten, where we have no legitimate grounds to keep the data.
• Restriction: ask us to suspend the processing.
• Portability: receive the data in a machine-readable format, or have it transferred to another controller.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: at any time, without affecting the lawfulness of processing already carried out. For the newsletter, the unsubscribe link at the bottom of every email is enough.

To exercise them, write to info@saottinivini.com or by certified email to cantinasaottini@legalmail.it. We reply within one month (Article 12(3) GDPR).

8. Complaint to the supervisory authority

If you believe the processing of your data breaches the GDPR, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome — garanteprivacy.it), or take the matter to court.

9. Children

The site is not aimed at children under 14 and we do not knowingly collect their data. If we realise we have received any, we delete it. The number of children given in a tasting request is used only to organise the welcome: we do not collect their identifying data.

The products in the online shop are alcoholic beverages and we sell them only to adults: to buy, you must declare that you are at least 18 years old.

10. Security

We adopt appropriate technical and organisational measures (Article 32 GDPR) to protect data from destruction, loss, unauthorised access or misuse: encrypted HTTPS connection, access limited to authorised people only, systems kept up to date.

11. Automated decision-making

We do not use automated decision-making processes or profiling that produce legal effects concerning you (Article 22 GDPR).

To prevent fraud, Stripe automatically assesses the risk of every payment and may decline suspicious ones. If your payment is declined and you think it is a mistake, write to us: we will look into the reasons and, where possible, help you complete the purchase.

12. Changes to this notice

We may update this notice, for example if the services or tools we use change. The version in force is always the one published here, with the date of the last update shown at the top. If the changes are significant, we will let you know.