1. Who processes your data (Data Controller)
Mazzetti d’Altavilla Srl
Viale Unità d'Italia 2 – 15041 Altavilla Monferrato (AL), Italy
Tax code and VAT number 00156630063
Email: info@mazzetti.it
PEC: Amministrazione@pec.mazzetti.it
For any questions about privacy or to exercise your rights, you can write to us at info@mazzetti.it or by post to our headquarters address.
2. Data Protection Officer (DPO)
Mazzetti d’Altavilla Srl has not appointed a Data Protection Officer because the conditions set forth in Article 37 of the GDPR are not met (we are not a public entity, and our core activity does not involve the systematic and large-scale monitoring of individuals or the large-scale processing of sensitive data). For all privacy issues, please contact the Data Controller at the contact details listed above.
3. What data we collect, why and on what basis
Below, for each situation in which you contact us, you will find the data processed, the purpose, the legal basis authorizing us to use it, and how long we retain it.
3.1 Navigation on the site
Processed data: IP address, browser and device type, operating system, pages visited, date and time of visit, referring website, language. This data is automatically collected by computer systems when using the internet.
Why: to operate the website and keep it secure (monitoring its correct functioning, preventing abuse and attacks, ascertaining any liability in the event of cybercrime).
Legal basis: legitimate interest of the Data Controller in ensuring the security and continuity of the service (Article 6, paragraph 1, letter f) of the GDPR).
Retention: security logs are retained for a maximum of 12 months, unless required to investigate criminal offenses.
3.2 Verification of age of majority
Data processed: only confirmation, via the button at the site entrance, that you are at least 18 years old. We do not record your date of birth.
Why: The site presents and sells alcoholic beverages: we must ensure that anyone purchasing them or viewing their content is of legal age, as required by Italian law.
Legal basis: legal obligation (Article 6, paragraph 1, letter c, GDPR).
Retention: Your choice is stored on your device for the duration of your browsing session (see the Cookie Policy).
3.3 Purchases in the online shop
Processed data: first and last name, billing and shipping address, email, telephone number, products purchased, amount and payment method, any tax code or VAT number for the invoice, order notes. We do not see or store your complete payment card details: they are handled directly by the payment service provider you choose at checkout.
Why: to manage your order (confirmation, payment, shipping, support, returns, and warranties) and fulfill tax and accounting obligations.
Legal basis: performance of the sales contract (Article 6, paragraph 1, letter b) and legal tax and accounting obligations (Article 6, paragraph 1, letter c).
Retention: for the entire duration of the relationship and subsequently for 10 years from the conclusion of the order, as required by civil and tax regulations (Article 2220 of the Italian Civil Code). Data no longer required for these purposes is deleted or anonymized.
If you do not provide the data marked as mandatory at checkout, we cannot process your order.
3.4 Personal account
Processed data: registration data (name, email, encrypted password), saved addresses, order history, products in your wish list.
Why: to allow you to access your personal area, track orders, and purchase more quickly.
Legal basis: performance of the contract/service you requested (Article 6, paragraph 1, letter b).
Retention: as long as the account is active. You can close it at any time by writing to us; after closure, we only retain order data for tax purposes (section 3.3). Accounts inactive for more than 36 months will be deleted upon notification by email.
3.5 Newsletter
Data processed: email address and, if provided, name and preferences. We also record the date, time, and method of subscription (proof of consent) and, for each email, whether the email was opened and which links you clicked.
Why: to send you news, stories from the distillery, invitations to events and tastings, offers, and shop promotions; to understand which content is most relevant to improve our communications.
Legal basis: your consent (Article 6, paragraph 1, letter a), which you provide by subscribing and confirming your subscription via the link you receive via email (double confirmation). Consent is voluntary: it is never a condition for purchasing or using the site.
Retention: as long as you remain subscribed. You can unsubscribe at any time using the link at the bottom of each newsletter or by contacting us. Addresses that do not open any of our emails for 24 months will be removed from the list. Proof of consent is retained for 12 months after unsubscribing, to demonstrate the accuracy of the processing.
3.6 Promotional communications to customers (soft spam)
If you have purchased from our shop, we can email you offers for products similar to those you purchased, even without your specific consent, as permitted by Article 130, paragraph 4, of the Privacy Code. We do this only if you did not object at the time of purchase, and you can object at any time, free of charge, using the link at the bottom of each email or by writing to us.
Legal basis: legitimate interest of the Data Controller (Article 6, paragraph 1, letter f), in compliance with your right to object.
Retention: for as long as you remain a customer and do not object; in any case, no longer than 24 months from your last purchase.
3.7 Contact requests, reservations and events
Processed data: the data you provide by email, through the website forms, via chat, or by phone (name, contact information, content of the request); for visits and tastings, the date and number of participants. Experience reservations are made on the dedicated website visit.mazzetti.it, managed with our supplier's platform, which processes the data on our behalf.
Why: to respond to you and manage your reservation or request.
Legal basis: to perform pre-contractual measures or to provide the requested service (Article 6, paragraph 1, letter b).
Retention: 24 months from the closure of the request; for reservations, the periods specified in section 3.3 if payment has been made.
3.8 Website usage statistics (analytics)
Data processed: aggregated and pseudonymous browsing data collected via Google Analytics 4 (page views, navigation path, device, approximate geographic area, interactions with the shop), with IP address not stored.
Why: to understand how the site is used and improve it.
Legal basis: your consent (Article 6, paragraph 1, letter a), expressed via the cookie banner. Without consent, measurement tools are not activated; Google can only receive anonymous, cookie-free signals (Consent Mode) that do not allow you to be identified.
Retention: user-level data is retained in Google Analytics for 14 months; aggregate reports do not expire because they do not contain personal data.
3.9 Advertising and social media (marketing)
Data processed: Browsing and site interaction data (pages and products viewed, cart additions, purchases) collected via the Meta pixel and Google advertising tags; email and order data shared, in encrypted form, with these platforms to measure campaign conversions.
Why: Measure the effectiveness of our campaigns on Facebook, Instagram, and Google and show you more relevant ads, including on other sites and apps.
Legal basis: Your consent (Article 6, paragraph 1, letter a), expressed via the cookie banner and revocable at any time from the preferences panel. Without your consent, no data is sent to these platforms.
Retention: Cookies have the durations indicated in the Cookie Policy; data transmitted to advertising platforms are retained by them according to their respective policies.
3.10 Chat and external content
The site may include Messenger chat, YouTube videos, and maps. These services are activated only with your consent via the cookie banner; if you use them, the respective providers process your data according to their own policies, indicated in the Cookie Policy.
4. How we process data
The data is processed using IT tools, by authorized and trained personnel, with appropriate security measures (HTTPS encrypted connection, access control, backup, encrypted passwords) to prevent loss, misuse, and unauthorized access. We do not make decisions based solely on automated processing that produce legal effects concerning you (Article 22 GDPR).
5. Who we share data with
We do not sell or share your data. We only share it with those we need to provide you with the services described, and only to the extent necessary:
-
Suppliers working on our behalf (data controllers pursuant to Art. 28 GDPR): website hosting and maintenance, e-commerce platform, sending service emails and newsletters, automatic website translation, cookie consent management, experience booking, consultants and agencies that support our communications.
- Payment service providers (Satispay, Axerve – Banca Sella, Nexi) and delivery couriers : they process the data as independent controllers, for payment and shipping transactions only
-
Analytics and advertising platforms (Google, Meta): only with your consent, as described in points 3.8 and 3.9.
-
Consultants and professionals (accountants, lawyers), banks, public authorities when required by law.
The updated list of data controllers is available upon request by writing to info@mazzetti.it.
6. Transfers outside the European Union
Some providers are based or have servers in the United States (Google, Meta, Intuit Mailchimp, Amazon Web Services). In these cases, the transfer occurs with the guarantees provided for in Articles 44-49 of the GDPR:
- providers certified under theEU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), and/or
-
Standard contractual clauses approved by the European Commission (Decision 2021/914), supplemented by additional technical measures where necessary.
You can request a copy of the safeguards we have adopted by writing to info@mazzetti.it. Where possible, we have chosen to keep your data on European servers.
7. Your rights
At any time you can ask us to:
-
Access your data and receive a copy (Article 15)
-
Correct inaccurate or incomplete data (art. 16)
-
Delete your data when we no longer have a reason to keep it (art. 17)
-
Limit processing in certain cases (Article 18)
-
Receive your data in a machine-readable format and transfer it to another controller, for data you have provided to us and that we process based on consent or a contract (portability, Art. 20)
-
Object to processing based on legitimate interest, and in any case object to the sending of marketing communications (Article 21)
-
Revoke consent at any time, without affecting the lawfulness of what was done before the revocation (art. 7)
To exercise your rights, please write to info@mazzetti.it or send a letter to Mazzetti d’Altavilla Srl, Viale Unità d'Italia 2, 15041 Altavilla Monferrato (AL). We will respond within one month; in complex cases, the deadline may be extended by two months, and we will notify you accordingly. Exercising your rights is free of charge.
To change your cookie preferences, you can use the "Cookie Preferences" in the footer of the site at any time.
Complaint to the Data Protection Authority. If you believe that the processing of your data violates the law, you have the right to lodge a complaint with the Data Protection Authority (Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it – protocollo@pec.gpdp.it) or with the supervisory authority of the EU country in which you live or work, or to contact the judicial authority.
8. Minors
The website and shop are intended for adults. We do not knowingly collect data from minors under 18; if we learn that we have collected data from a minor, we delete it.
9. Cookies and similar tools
The site uses cookies and similar technologies: what they are, what they're used for, how long they last, and how to manage them is explained in the Cookie Policy, which is part of this policy. Non-essential cookies are activated only with your consent, which you can change or revoke using the "Cookie Preferences" link at the bottom of each page.
10. Changes to this Policy
We may update this policy, for example, when we introduce new services or the law changes. The current version is always the one published on this page, with the last update date at the top. If we make any changes that are relevant to newsletter subscribers or registered customers, we will notify them via email.
