Privacy policy

The Controller of the data collected through agricola-lafornace.it is Azienda Agricola La Fornace di Fabio Giannetti, with registered office at Podere Fornace 154/A, 53024 Montalcino (SI), Italy, VAT / tax code 00948330527 / GNNFBA74D14F402G.
Privacy contact: info@agricola-lafornace.it.

The IT systems and software procedures used to operate the site acquire, during normal operation, some data whose transmission is implicit in the use of Internet protocols: IP address, browser type and operating system, pages visited, time and duration of the visit, request outcome. They are used to ensure the proper functioning and security of the site and to derive anonymous usage statistics. Legal basis: legitimate interest of the Controller (art. 6(1)(f) GDPR). Security logs are kept for 12 months.

Sending messages through the contact forms, to the email addresses shown on the site or through other channels involves acquiring the sender's contact details (name, email, phone) and the content of the message, needed to answer the request. Data are kept for 24 months from receipt, unless the relationship continues as a contract.

Data are processed with IT and telematic tools, and residually on paper, with logic strictly related to the purposes stated. Only persons authorised by the Controller and instructed accordingly, and the appointed processors, have access. Appropriate technical and organisational measures are in place to prevent loss, unlawful or improper use and unauthorised access: encrypted connections (HTTPS), access control with personal credentials, periodic backups, system updates, access logging. Measures are reviewed periodically.

• Answering requests and providing the services requested — performance of pre-contractual measures or of the contract (art. 6(1)(b) GDPR).
• Compliance with legal obligations (tax, accounting, security) — legal obligation (art. 6(1)(c)).
• Security and operation of the site, prevention of abuse and fraud — legitimate interest (art. 6(1)(f)).
• Aggregated statistics on site usage — legitimate interest, or consent when the tool uses identifying cookies (art. 6(1)(a)).
• Promotional communications and marketing — consent (art. 6(1)(a)), revocable at any time.
• Protection of the Controller's rights in court — legitimate interest (art. 6(1)(f)).

Data are neither disseminated nor sold to third parties for commercial purposes. They may be communicated, within the limits strictly necessary, to: technical service providers (hosting, email, site maintenance), appointed as processors under art. 28 GDPR; consultants and professionals (accountants, lawyers); payment institutions and couriers, where the service requires it; public authorities, when required by law. The Controller's staff processing the data act under its authority and are instructed accordingly. The updated list of processors is available on request at info@agricola-lafornace.it.

Some providers mentioned in this notice (Google, for the map) may process data in countries outside the European Economic Area, in particular the United States. For US providers certified under the EU-US Data Privacy Framework, transfers may rely on the related adequacy decision; in other cases the Standard Contractual Clauses adopted by the European Commission (art. 46 GDPR) and the further safeguards provided by applicable law are used, supplemented by additional measures where necessary. A copy of the safeguards is available on request. The data of customers ordering from a country outside the European Union, including the United States, are communicated to couriers and, where the law of the destination country requires it, to customs and to the licensed operators involved in the delivery: the transfer is necessary to perform the contract requested by the customer (art. 49(1)(b) GDPR).

• Browsing data and security logs: 12 months.
• Contact requests: 24 months from receipt.
• Accounting and tax documentation: within the terms set by applicable law, normally 10 years. Contractual data are kept for the duration of the relationship and for the period needed to protect the Controller's rights.
• Proof of cookie consent: 24 months from the choice, unless a further period is needed to protect the Controller's rights.
• Data for marketing purposes: until consent is withdrawn and in any case no longer than 24 months from the last contact.

Under arts. 15-22 GDPR the data subject may at any time: access their data and obtain a copy; request rectification or erasure; obtain restriction of processing; object to processing based on legitimate interest or carried out for marketing; receive the data in a structured format (portability); withdraw consent, without affecting the lawfulness of processing already carried out. Requests must be sent to info@agricola-lafornace.it. A complaint may also be lodged with the Italian Data Protection Authority (www.garanteprivacy.it).

Requests must be sent to the Controller at info@agricola-lafornace.it or by post to Podere Fornace 154/A, 53024 Montalcino (SI), Italy. To protect the data subject the Controller may ask to verify the identity of the requester. A reply is given within one month (extendable by two months in complex cases, with notice) and is free of charge, except for manifestly unfounded or excessive requests. For cookie-related matters please quote the consent ID shown in the site's preferences panel.

The Controller is based in Italy: your data are processed under the GDPR and this notice applies wherever you live. This section adds the information required by US state privacy laws, such as those of California, Virginia and Colorado. The rights described here are granted to all visitors located in the United States.

Data we collect. Identifiers and contact details (name, email, phone, address); account and order data; payment outcomes, not card details, which Nexi handles; internet activity (IP address, browser, pages visited) through server logs and Umami. We receive them from you and from your device, for the purposes and periods stated in this notice.

We do not sell your personal information and we do not share it for targeted advertising. We disclose it only to providers working for us (hosting, email, payments, delivery) and to authorities when the law requires it. We do not disclose it to third parties for their direct marketing.

Your rights. You can find out what data we hold about you, get a copy, have it corrected or deleted, and object to optional processing. You can also act through an authorized agent. To protect you, we may ask you to confirm your identity. We respond within one month, free of charge, and exercising these rights will not lead to any discrimination. If we deny a request, you can ask us to review it by writing to the same address, and you can contact your state Attorney General.

Global Privacy Control. We treat the GPC signal as a request to keep the optional cookie categories turned off.

Age. The site is not directed to children under 13 and we do not knowingly collect their data. In the United States you must be at least 21 to buy or receive alcoholic beverages.

Email. We send promotional messages only with your consent; every message contains a link to unsubscribe.

Where your data is. The site and the data are managed in Europe, so by using the site your data are transferred outside the United States. For deliveries to the United States, the necessary data are disclosed as described in “Transfers to non-EU countries”.

For any request, write to info@agricola-lafornace.it.

Providing the data marked as mandatory in the forms is necessary to follow up on the request or contract: failure to provide them makes it impossible to deliver the service. Providing other data and consents for marketing purposes is optional and their absence has no consequences on access to the services.

The Controller does not adopt decisions based solely on automated processing that produce legal effects on the data subject. The site does not use profiling tools for advertising purposes.

The site is not intended for minors and the Controller does not knowingly collect their data. Joining the Wine Club and buying are reserved for adults and, for deliveries outside Italy, for people who have reached the minimum age to buy alcoholic beverages in the destination country (21 in the United States). If a minor has provided personal data, the holder of parental responsibility may request erasure by writing to info@agricola-lafornace.it.

Data are collected directly from the data subject through the site, communications sent to the Controller or the services requested. Where data are obtained from third parties (e.g. a customer indicating a contact person), the data subject receives the information required by art. 14 GDPR at the first useful contact.

In the event of a personal data breach (unauthorised access, loss, destruction, disclosure) the Controller promptly assesses its severity and, where the breach poses a risk to the rights and freedoms of individuals, notifies the Italian Data Protection Authority within 72 hours of becoming aware of it (art. 33 GDPR). Where the risk is high, the data subjects are also informed in clear language, stating the nature of the breach, its likely consequences and the measures taken (art. 34 GDPR). Anyone noticing a possible incident may report it to info@agricola-lafornace.it.

Version privacy-2026-11, updated on 2026-11-05. The Controller reserves the right to amend this notice to reflect legal developments or changes in the services; the version in force is always the one published on this page.

This notice is provided under arts. 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Personal Data Protection Code), as amended by Legislative Decree 101/2018, taking into account the decisions and guidelines of the Italian Data Protection Authority. For cookies and tracking tools, Directive 2002/58/EC (ePrivacy), art. 122 of the Code and the Authority's Guidelines of 10 June 2021 also apply. Terms such as personal data, processing, controller, processor and data subject have the meaning given in art. 4 GDPR.

The site is hosted by OVHcloud (OVH SAS), which processes browsing data as a processor on behalf of the Controller. Provider's notice: https://www.ovhcloud.com/en-ie/personal-data-protection/. Technical maintenance of the site is entrusted to Falconi Marco, acting as processor.

The site uses Umami, installed on an OVHcloud server managed by the technical provider Falconi Marco (analytics.bjuice.eu), for aggregated usage statistics: pages visited, source, device type. It does not use cookies and does not allow identifying the user. Legal basis: legitimate interest (art. 6(1)(f) GDPR).

The “Where we are” page embeds a Google Maps map (Google LLC). The map loads only after consent to marketing cookies: until then a placeholder is shown. Upon loading, Google receives the IP address, may set its own cookies and also supplies the map's fonts (Google Fonts). Legal basis: consent. Non-EU transfer with safeguards. Notice: policies.google.com/privacy.

By ticking the dedicated box when joining the Wine Club, the user provides a name and an email address to receive periodic communications on news, products and initiatives of the Controller. Legal basis: consent (art. 6(1)(a) GDPR), revocable at any time through the link in every message or by writing to info@agricola-lafornace.it. Sending is entrusted to Falconi Marco (mail server on OVHcloud), acting as processor (notice). Data are kept until consent is withdrawn.

To join the Wine Club, which gives access to the shop, we process first name, last name, email, country of residence, password and the declaration of legal age. For purchases we also process billing details (including tax code or VAT number where needed), delivery addresses, contacts, order history and any withdrawal requests. The country you indicate determines the prices and products shown. Delivery data are communicated to the appointed couriers. Legal basis: performance of the contract (art. 6(1)(b)) and legal obligations (art. 6(1)(c)). Retention: until the account is deleted; 10 years for tax and accounting data.

Payments on the site are handled by third-party payment institutions and providers (Nexi Payments S.p.A. (XPay)), which process as independent controllers the data needed for the transaction (card number, holder, expiry): the Controller neither receives nor stores full payment instrument data, only the outcome and the transaction references needed for accounting. Providers may also process data outside the European Union with the safeguards required by law. Legal basis: performance of the contract (art. 6(1)(b)) and legal obligations (art. 6(1)(c)). For bank transfers, data are also processed by the banks of the payer and of the Controller.

The site contains links to the Controller's pages on social networks (Facebook, X, LinkedIn). A link transmits no data until it is opened; on those platforms the terms of use and privacy notices of the respective operators apply.