Privacy notice
In case of any discrepancy, the Italian version prevails.
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Version of October 2026.
1. Who the controller is
The data controller is Frantoio Carrozzino - Terre di SanGregorio, trading as "Frantoio Carrozzino - Terre di SanGregorio", with registered office at C.da Palazza 40, 87021 Belvedere Marittimo (CS), VAT number and tax code . For any matter concerning your data, you can write to info@frantoiocarrozzino.it or call +39 0985 806580.
2. Which data we process, why and for how long
For each purpose you find the data, the legal basis and the retention period. Where the basis is the contract, we cannot provide the service without the data requested. Where it is consent, you can refuse it with no consequences for your purchase.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Account and personal area: registration, login, saved basket, favourites, addresses, optional two-step verification | name, email, password, saved addresses, products in the basket and in favourites, two-step verification data | performance of a contract (Art. 6(1)(b)) | while the account is active; when it is deleted, the data is deleted or anonymised, except order data |
| Orders, payment and delivery, including cancellation, withdrawal, guarantee and complaints | first name, surname, email, telephone (optional), shipping and billing addresses, order lines and amounts, payment method, status and tracking, invoice details (company, VAT number, PEC, if you provide them) | performance of a contract (Art. 6(1)(b)) | for the order, see the next row |
| Accounting and tax obligations | the same order data, invoices and payment records | legal obligation (Art. 6(1)(c)) | 10 years from the date of the order (Article 2220 of the Italian Civil Code), even if you delete your account |
| Gift vouchers | name and email of the giver and of the recipient, personal message, voucher code and balance | performance of a contract (Art. 6(1)(b)) | for the life of the voucher (one year) and then for the retention periods of orders |
| Contact requests: form, email, back-in-stock alert | name, email, telephone (optional), subject and text of the message | performance of pre-contractual measures or of the contract (Art. 6(1)(b)) | up to 12 months from the last reply, unless needed for an order or a dispute; the availability alert is deleted after it is sent |
| Reviews: publication | rating, title, text, profile name, linked order | performance of the service you request (Art. 6(1)(b)) | while the review stays published; when the account is deleted, we anonymise it |
| Promotional emails, abandoned basket and invitation to write a review: newsletter, offers, basket reminders, an invitation after delivery | email, name, products in the basket, products ordered | consent (Art. 6(1)(a)), given with the optional box | until you withdraw it; after that we keep only the record of consent and withdrawal, to defend ourselves in case of a dispute |
| Site security and abuse prevention: limit on login attempts, technical logs, backups | IP address, outcome of checks, technical logs | legitimate interest in protecting the site (Art. 6(1)(f)) | logs up to 30 days; backups 30 days |
| Statistics, map and anti-spam check (Google Analytics, Google Maps, reCAPTCHA) | browsing data, events on pages and purchases, IP address, browser data | consent (Art. 6(1)(a)) through the banner or the button that enables the tool | see the cookie policy |
| Defence of our rights | strictly necessary data | legitimate interest (Art. 6(1)(f)) | for the duration of the dispute and of the limitation period |
We do not receive your card details: you enter them on the Stripe page. If you buy a voucher for someone else, you give us the recipient's data and the source is you (Article 14 GDPR): tell them that we use their name and email only to deliver the voucher to them.
We do not send promotional emails to customers without consent, not even for products similar to those they have already bought.
We collect data directly from you. From Stripe we receive the confirmation and outcome of the payment; from your bank, in the case of a bank transfer, the details of the payment received; from the courier, the delivery status.
We do not take decisions based solely on automated processing that produce legal effects concerning you (Article 22 GDPR).
Security
We protect data with encrypted connections, access restricted to authorised staff and nightly backups. If an incident exposes your data with a risk to your rights, we notify you and inform the Garante in the cases and within the time limits set by Articles 33 and 34 of the GDPR.
3. Who we share data with
We disclose data only to those who are needed to provide the service. Suppliers who process data on our behalf are processors (Article 28 GDPR) and act on our instructions.
| Category | Supplier | Country | Role |
|---|---|---|---|
| Website hosting and backups | Google Cloud EMEA Limited | Ireland; the data is stored in Belgium | processor |
| Data storage (database) | Neon, Inc., on Amazon Web Services infrastructure | United States (the company); the data is stored in Frankfurt, Germany | processor |
| VHosting Solution S.r.l. | Italy | processor | |
| Technical maintenance of the site | appointed professional | Italy | processor |
| Card payments | Stripe Payments Europe Limited | Ireland, with possible transfer to the United States | independent controller for its own legal and anti-fraud obligations, according to its privacy notice |
| Shipping | the courier named in the Terms and conditions of sale | Italy | independent controller |
| Banks and tax and accounting advisers | appointed professionals | Italy | independent controllers or processors |
| Statistics | Google Ireland Limited (Google Analytics) | Ireland, with possible transfer to the United States | processor |
| Map and anti-spam check | Google Ireland Limited (Google Maps, reCAPTCHA) | Ireland, with possible transfer to the United States | Google also processes some data for its own purposes, according to its privacy notice |
| Address suggestions: the text you type in the street field reaches Google through our server, without your IP address | Google Ireland Limited (Google Places) | Ireland, with possible transfer to the United States | Google also processes some data for its own purposes, according to its privacy notice |
If you write to us on WhatsApp from the button on the site, your messages pass through WhatsApp servers according to its privacy notice. We may disclose data to public authorities when the law requires it. We do not sell your data.
4. Transfers outside the European Union
The data we process normally stays within the European Economic Area. Stripe, Google and Neon are, or belong to, US companies and may transfer data to the United States, or allow access from there. They do so on the basis of the European Commission's adequacy decision of 10 July 2023 on the Data Privacy Framework, where the supplier participates in it, or with the standard contractual clauses approved by the Commission (Article 46 GDPR). To obtain a copy of the safeguards, write to us.
5. Your rights
You can ask us at any time for:
- access to your data and a copy (with an account you download them straight away, see below);
- rectification of inaccurate data;
- erasure, within the limits of the retention obligations in section 2;
- restriction of processing;
- portability of the data you provided, for processing based on contract or consent;
- objection to processing based on legitimate interest.
If processing is based on consent, you can withdraw it whenever you wish. Withdrawal does not affect processing already carried out. For promotional emails, you can also withdraw using the link at the bottom of every message.
If you have an account, you download your data straight away from the "My data" page in your account area: a file with your profile, addresses, orders, returns, reviews, favourites, subscriptions and gift vouchers. Passwords and security codes are not in it.
To delete your account, ask for it from the same page with "Request deletion" and confirm with your password, and with the two-step verification code if you have turned it on. Anyone without a password, for example someone who signs in with Google, confirms by typing the account email again. We send you an email confirming that we received the request, and while it is open you can withdraw it from the same page. We reply within 30 days. Before we delete, open orders, refunds in progress and open returns must be closed. Gift vouchers with a balance stay valid for whoever holds the code: keep the code of each one.
When we confirm the deletion, we remove your name, email, telephone, password and sign-in data, basket, favourites, addresses not tied to an order, and your subscriptions to the newsletter and back-in-stock alerts. Your reviews stay on the site signed "Customer". Orders and their shipping and billing addresses are kept for 10 years, because tax law requires it, and then we delete them. Data leaves the backups within 30 days. We send you an email confirming the deletion.
For your other rights, write to info@frantoiocarrozzino.it from the email address you used to register or order: if necessary, we ask you to confirm your identity before giving you the data. If you ordered without an account, write to the same address for access and deletion too. Exercising your rights is free of charge. We reply within one month; if the request is complex, we may extend the period by a further two months and we tell you so.
6. Complaint to the supervisory authority
If you believe the processing violates the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it), or apply to the courts.
7. Minors
The site is aimed at adults. You must be of legal age to buy. We do not knowingly collect data from children under 14 for promotional emails. If we become aware of it without the consent of the person with parental responsibility, we delete it.
8. Changes
If the processing or the law changes, we update this notice and the date at the top. For significant changes, we notify you with a message or a notice on the site.