Privacy Policy - Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

1. Data controller

The Data Controller is:

Società Agricola F.lli Simoni s.s.
Strada di Colle Pinzuto, 30 - 53100 Siena (SI)
P. VAT/FISCAL CODE: 01340150521
Website: https://sangiorgioalapi.it
Email: privacysangiorgioalapi@gmail.com
PEC: sangiorgioalapi@pec.it

2. Types of personal data processed

Depending on the interaction with the site, the type of product or service requested, they may be processed:

• Identifying data: first name, last name
• Contact information: email address, phone number, residence or shipping address
• Payment data: electronic payment details (e.g., last credit card numbers, IBAN, PayPal transaction ID)
• Order or reservation data: product/service purchased, date, amount, payment method
• Navigation technical data: IP address, browser type, device used, anonymized log data
• Promotional preferences: voluntary newsletter subscription or event participation

No special data are processed (art. 9 GDPR), unless voluntarily disclosed by the user (e.g., allergies reported for events).

3. Purpose and legal basis for processing

Personal data collected through the sangiorgioalapi.it Are processed for the following purposes:

a. Direct sale of wine and extra virgin olive oil

Legal basis: performance of a contract (Art. 6.1.b GDPR)
Description: Order management, shipping, customer service, including identifying data, contact information, and shipping address.

b. Booking and purchasing tourist experiences through Bookingkit

Legal basis: Contractual performance and legitimate interest (Art. 6.1.b and f GDPR)
Description: Management of reservations, operational communications and transactions.

c. Promotional activities and marketing communications

Legal basis: explicit consent (Art. 6.1.a GDPR)
Description: Sending newsletters, invitations to events, personalized promotions. Revocable at any time.

d. Anonymous statistical analysis

Legal basis: legitimate interest (Art. 6.1.f GDPR)
Description: Aggregate, non-personally traceable data collection for internal analysis.

e. Administrative, accounting and tax compliance

Legal basis: legal obligation (Art. 6.1.c GDPR)
Description: storage for tax purposes, issuing invoices, handling complaints about products or services.

4. Obligation to provide data.

The conferment is mandatory for contractual and legal purposes (purchases, reservations, tax compliance). In case of refusal, it will not be possible to provide the service.

Instead, it is optional For promotional purposes: failure to consent does not affect browsing or purchase.

5. Modes of processing and security

Processing is carried out using electronic and, if necessary, paper-based instruments, in accordance with the principles of lawfulness, fairness, transparency, minimization, security and integrity of data (Art. 5 and 32 GDPR).

6. Recipients or categories of recipients

Data may be disclosed to third parties only as strictly necessary for the stated purposes, including:

• IT service providers and web hosting
• Couriers and shipping services
• Electronic payment providers (e.g., PayPal Holdings Inc.)
• Bookingkit GmbH platform (experience booking)
• Legal, tax and accounting consultants
• Marketing agencies and newsletter management

All individuals are designated, if necessary, Data Processors in accordance with Article 28 GDPR.

7. Transfer of data abroad

Some vendors used (e.g., PayPal, Bookingkit) may involve the transfer of personal data to countries not belonging to the European Economic Area (EEA).

The transfer shall take place only in accordance with the articles 44-49 of the GDPR, adopting at least one of the following guarantees:

• European Commission adequacy decisions for the country of destination;
• Standard Contract Clauses (SCC) approved by the European Commission;
• Binding Corporate Rules (Binding Corporate Rules);
• Exceptions for specific cases under Article 49 GDPR (e.g., performance of a contract with the data subject).

In any case, any data transferred shall be limited to the minimum necessary and protected by appropriate technical and organizational measures.

8. Period of data retention

9. Rights of the data subject

Under Articles 15-22 of the GDPR, you have the right to:

• obtain confirmation of the existence of their data
• Access, update, correct or delete data
• restrict or object to processing
• receive data in a portable format
• revoke consent at any time
• file a complaint with the Data Protection Authority (www.garanteprivacy.it)

📧 To exercise rights: privacysangiorgioalapi@gmail.com

📮 PEC: sangiorgioalapi@pec.it

📬 For complaints about orders or products: reclamisangiorgioalapi@gmail.com

10. Minors

The site and services offered are not intended for individuals under the age of 18. No data from minors are knowingly collected.

Users must declare that they are at least 18 years old to make alcohol purchases or book food and wine experiences.

Should the Controller become aware of the inadvertent processing of data related to a minor, it will upon request provide for their immediate deletion.