Privacy policy
Notice under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018. Last updated: 22 October 2026.
1. Data controller
Fattorie del Pellegrino Soc. Coop. Agr., Via Marco Polo 11, 87010 Firmo (CS), Italy. VAT number and tax code 03028120784, REA CS-205951. Privacy email: privacy@fattoriedelpellegrino.com. Certified email (PEC): fattoriepellegrino@pec.it.
The cooperative is not required to appoint a Data Protection Officer (DPO). For any question about how we process your data, you can write to the addresses above.
2. What data we process
Data you give us. When you write to us through the contact form, by email or by phone: name and surname, email address, phone number, the content of your message and, for trade customers, business name, city and VAT number. Please do not include unnecessary data in your message, in particular health data or other special categories of data.
Browsing data. The systems that run the site record, during normal use, data such as IP address, browser and device type, operating system, pages requested, date and time of the request and the server response code. They are used to run and secure the site and are not used to identify you.
Data collected with cookies and similar tools. Only if you consent, we collect visit statistics with Google Analytics 4 and anonymous recordings of browsing with Microsoft Clarity (mouse movements, clicks, page scrolling). Details are in the Cookie policy.
3. Why we process it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to requests sent through the form, by email or by phone | Contact details and content of the request | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) |
| Sending price lists, quotes, technical sheets and samples to trade customers | Contact and business details | Pre-contractual steps and contract (Art. 6(1)(b) GDPR) |
| Handling orders, deliveries, invoices and payments | Contact, billing and order details | Contract (Art. 6(1)(b)) and tax and accounting obligations (Art. 6(1)(c)) |
| Running the site and protecting it from abuse and attacks | Browsing data | Legitimate interest in the security of the site (Art. 6(1)(f) GDPR) |
| Measuring visits and understanding how the site is used, to improve it | Data collected by Google Analytics 4 and Microsoft Clarity | Consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code), which you can withdraw at any time |
| Showing the map of our address | Technical data sent to Google when the map loads | Consent, given by clicking “Show the map” |
| Defending our rights in case of dispute | Data needed for the case | Legitimate interest (Art. 6(1)(f) GDPR) |
We do not use your data for personalised advertising, we do not sell it and we do not make decisions based solely on automated processing, including profiling.
Providing the form data is optional, but without the required fields we cannot reply to you.
4. Who receives the data
Data is processed by authorised and trained staff of the cooperative. We do not disclose or transfer it. Only as far as necessary, it may be received by the following providers, acting as processors (Art. 28 GDPR) or, where stated, as independent controllers:
| Provider | Service | Role | Where data is processed |
|---|---|---|---|
| Aruba S.p.A. | Website hosting, email (including the sending of form requests), certified email, backups | Processor | Italy (EU) |
| Google Ireland Limited | Google Analytics 4, only with consent | Processor | EU, with possible transfers to the USA |
| Microsoft Ireland Operations Limited | Microsoft Clarity, only with consent | Processor; independent controller for Microsoft third-party cookies | EU, with possible transfers to the USA |
| Google Ireland Limited | Google Maps, only if you open the map | Independent controller | EU, with possible transfers to the USA |
| Accountant, couriers, banks | Invoices, deliveries, order payments | Independent controllers or processors | Italy (EU) |
Data may also be disclosed to the authorities when required by law.
5. Transfers outside the European Union
Google and Microsoft may process some data in the United States. These transfers rely on the European Commission adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework), to which both companies adhere, and in any case on the standard contractual clauses approved by the Commission. You can ask us for a copy of the safeguards in place by writing to the addresses in section 1.
6. How long we keep data
| Data | Retention |
|---|---|
| Requests with no business follow-up | 24 months from the last contact, then deleted |
| Data of customers and trade partners we work with | For the duration of the relationship and 10 years after for accounting and tax records (Art. 2220 of the Italian Civil Code) |
| Server technical logs | Up to 12 months (365 days), then deleted by Aruba |
| Google Analytics 4 data | Event data: 2 months. User-level data: 14 months. Then deleted by Google; only aggregated reports remain, which identify no one. |
| Microsoft Clarity recordings | 30 days; heatmaps and a sample of recordings up to 9 months |
| Cookie choice | 12 months, stored in your browser (cmplz_* cookies) |
7. Your rights
You can ask at any time to:
- access your data and receive a copy (Art. 15);
- correct or complete it (Art. 16);
- delete it (Art. 17);
- restrict its processing (Art. 18);
- receive it in a structured, machine-readable format, or have it sent to another controller (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw your consent, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)). For cookies you can do this from the “Cookie settings” link at the bottom of every page.
To exercise your rights, write to privacy@fattoriedelpellegrino.com or to the certified email fattoriepellegrino@pec.it. We reply within one month, which can be extended by two months for complex requests. If you believe the processing breaches the law, you can lodge a complaint with the Italian data protection authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it.
8. Minors
The site also presents alcoholic beverages and is not intended for people under 18. We do not knowingly collect data from minors; if we find that we have received any, we delete it.
9. Security
We use appropriate technical and organisational measures: encrypted connection (HTTPS), access to the site’s admin panel protected by strong passwords and two-factor authentication, automatic updates of WordPress and plugins, daily and weekly backups.
10. Changes
We may update this notice. The version in force is always the one published on this page, with the date of the last update at the top.