Privacy Policy
Published on 06/11/2025
Podere Paganico di Buzdon Anna Maria, with registered office in Via Ex Cassia, 54, Montalcino (SI) - 53024, Tax ID IT00948360524, (hereinafter "Data Controller" or "Controller") is constantly committed to protecting the online privacy of natural persons during the browsing and enjoyment of services on websites https://poderepaganico.it, https://www.poderepaganico.it (hereinafter "Portal" or "Website").
This document describes all aspects related to the processing of Personal Data of users (hereinafter "Data Subjects") carried out through the Website, in compliance with the provisions of Art. 13 of Regulation (EU) no. 2016/679 (hereinafter "Regulation"). According to the rules of the Regulation, the processing carried out by the Controller through the Website shall be based on the principles of lawfulness, fairness, transparency, purpose limitation and storage limitation, data minimization, accuracy, integrity and confidentiality.
1. Data Controller
The Data Controller for the processing carried out through the Portal is Podere Paganico di Buzdon Anna Maria as defined above and can be contacted through the methods indicated in the "Contacts" section (see Art. 10).
2. Categories of Personal Data Processed
3. Processing Purposes
The Controller uses Personal Data collected through this Website for the following purposes:
4. Legal Basis of Processing
The processing of Personal Data is lawful by virtue of the following legal bases, as provided for in Art. 6 of the Regulation:
Performance of tasks in the public interest:
Art. 6(1)(e) of the Regulation – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
Consent:
Art. 6(1)(a) of the Regulation – The data subject has given consent to the processing of their personal data;
5. Processing Methods
Processing is carried out through manual and/or automatic methods, including through the use of information and computer technologies (e.g., CRM, management software and mailing list services), subject to the application of appropriate technical and organizational security measures to ensure the security, integrity and confidentiality of Personal Data, so as to minimize the risks of destruction, loss, unauthorized access, modification and unauthorized disclosure, in accordance with Articles 6 and 32 of the GDPR.
6. Transfer of Personal Data outside the EU/EEA
The Controller does not intend to transfer Personal Data outside the European Economic Area. However, should it become necessary to meet organizational/production needs (by way of non-exhaustive example, by using providers and/or cloud services that require the transfer of data abroad), adequate safeguards will be identified for the transfer of Personal Data to a Third Country, which depending on the circumstances may include: verification of the existence of adequacy decisions of the European Commission, execution of standard contractual clauses and/or binding corporate rules, verification of the adoption of any supplementary measures in implementation of Recommendation 01/2020 EDPB.
| Vendor Name | Description | Vendor Privacy Policy |
|---|---|---|
| Microsoft | https://privacy.microsoft.com/en-us/privacystatement | |
| Avacy CMP | https://jumpgroup.it/privacy-policy/ |
7. Data Retention Periods
The Controller retains Personal Data only for the periods of time necessary to pursue the purposes indicated in this document, or for the timeframes provided for by specific regulations.
- Personal Data processed for the purpose of "Provision of the service" will be retained for a period not exceeding 10 years;
- Personal data processed for the purpose of "Payments and Billing" will be retained for a period not exceeding 10 years (art. 2220 c.c.)
- Personal Data processed for Direct Marketing purposes will be retained for a period not exceeding 2 years, or until the data subject revokes consent to processing.
- The duration of persistence of individual cookies is reported within the "Cookie Policy";
- Without prejudice to the possibility for the Controller to retain Personal Data for the period of time provided for and allowed by Italian law for the purposes of "Legal protection" of its interests (art. 2946 and 2947 c1, c.3 c.c.).
After the expiration of such retention periods, Personal Data will be deleted or made anonymous, if not retained for further purposes based on appropriate legal grounds.
8. Recipients
Personal Data collected by the Data Controller may be communicated or made accessible, for the execution of the purposes indicated above, to the following categories of subjects:
- Employees and collaborators who assist the Controller in processing operations, subject to express authorization for processing and possibly to the execution of confidentiality agreements;
- Subjects providing outsourcing services on behalf of the Controller, as Data Processors: cloud computing service providers, freelancers, companies or professional firms providing assistance and consulting activities to the Data Controller, or subjects delegated to carry out hosting and technical maintenance activities, including software maintenance, network equipment and electronic communication networks;
- Independent data controllers to whom the communication of data is necessary for the purposes of providing the service requested by the data subject.
- Independent data controllers in the pursuit of their own purposes (subject to consent from the data subject);
- Public authorities, in the event that such communication is required by law.
After the expiration of such retention periods, Personal Data will be deleted or made anonymous, if not retained for further purposes based on appropriate legal grounds.
9. Rights of the Data Subject
At any time, the Data Subject may access the information concerning them and request its rectification, deletion, restriction of processing, and portability. They may also object, in whole or in part, to the processing and have the right not to be subject to automated decision-making concerning natural persons, including profiling.
To exercise the rights referred to in Articles 15-22 of the GDPR, the Data Subject may contact the Data Controller in the manner indicated in the "Contacts" section (see art. 10). The Data Controller must respond to the request within 1 month, or communicate any delay in response in the case of numerous and/or complex requests (the extension cannot exceed 2 months in any case). In any case, the Data Subject always has the right to lodge a complaint with the competent Supervisory Authority (Data Protection Authority), pursuant to Article 77 of the Regulation, if they believe that the processing of their Personal Data is contrary to the applicable regulations.
Contacts
For further information about the processing of Personal Data carried out in execution of the contract, or to submit a request to exercise rights, it is possible to contact the Controller at the email address: info@poderepaganico.it
