Data controller
This notice, given under article 13 of Regulation (EU) 2016/679 (“GDPR”), explains how we process the personal data of those who visit the website, create an account, place an order or write to us. The data controller is:
- Az. Agr. La Serra di Piccotti Riccardo
- Registered office: Via San Francesco 28, 60010 Ostra (AN)
- VAT no.: 02902180427
- Tax code: PCCRCR98M04E388N
- REA (business register no.): AN-280914
- Email: info@aziendalaserra.com
- Phone: +39 320 848 2671
Which data we process
- Account: first and last name, email address, password (stored only in encrypted form), saved addresses.
- Orders: delivery and billing addresses, email address, phone number (optional), products purchased and amounts.
- Contact requests: first and last name, email address, phone number (optional) and the text of the message.
- Payments: card details are entered directly on Stripe; we only receive the outcome of the payment and the transaction references.
- Technical data: IP address, server logs and the technical cookies needed for the website to work.
The data marked as required in the forms (for example name, address and email address for an order) are needed to perform the contract or answer your request: without them we cannot fulfil the order or reply to you. Other data, such as the phone number, are optional.
Why we process them
- Managing your account and fulfilling orders, including shipping and customer service — legal basis: performance of the contract (art. 6(1)(b) GDPR).
- Complying with tax and accounting obligations — legal basis: legal obligation (art. 6(1)(c) GDPR).
- Answering requests sent through the contact form — legal basis: pre-contractual measures taken at your request (art. 6(1)(b) GDPR).
- Keeping the website secure and preventing payment fraud — legal basis: legitimate interest (art. 6(1)(f) GDPR).
- Only if you ask for it by ticking the box at checkout: sending you, a few days after dispatch, a single email with the link to leave a review on Google — legal basis: consent (art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us. You write the review directly on Google, under its own terms.
- If you enter your email at checkout but do not complete the order: sending you, a few hours later, a single email with the link to go back to your cart, with no offers or other products; no other one follows for that cart and at most one is sent every 30 days. Legal basis: our legitimate interest in not letting you lose an order you started (art. 6(1)(f) GDPR). You can object at any time, without giving reasons, by ticking “Don't send me the reminder” at checkout, with the link in the email or by writing to us. The email contains no tracking tools.
- Visit statistics: counting, in anonymous and aggregate form, the pages seen, the website or campaign visitors come from, their approximate country and region and the type of device, to improve the website and its promotion. We use no cookies or other tools on your device and we do not store your IP address: at the time of the visit it is only used to work out the country and region, with a database kept on our server, and to compute an anonymous code that changes every day and does not allow us to recognise you or follow you from one day to the next. The statistics are not shared with anyone. Legal basis: our legitimate interest in understanding how the website is used (art. 6(1)(f) GDPR); you can object by writing to us.
We do not use your data to send you advertising and we do not carry out profiling.
For how long
- Account data: as long as the account is active; you can ask for it to be deleted at any time.
- Order data and tax documents: 10 years, as required by Italian tax law.
- Contact requests: the time needed to handle them and in any case no longer than 12 months.
- Carts not completed, with the data entered at checkout: 30 days from the last change, then they are deleted.
- Cart reminders sent: 30 days; your request not to receive them: as long as needed to respect it.
- Visit statistics, anonymous and aggregate: 26 months.
- Technical logs: only as long as strictly necessary for the security of the website.
Who we share them with
Your data are processed by our authorised staff and shared only with those needed to provide the service:
- couriers, to deliver orders;
- Stripe (card, Apple Pay, Google Pay), to handle payments;
- Hetzner Online GmbH, which hosts the website and the data on servers in Finland;
- Aruba S.p.A., for the website domain, and the email service provider;
- WhatsApp (Meta), only if you choose to write to us on WhatsApp from the button on the website;
- Google, only if you choose to load the map on the Contact page.
These parties act as data processors or, for payment services, as independent controllers. The data are not disclosed to the public or sold.
Transfers outside the EU
Stripe, WhatsApp (Meta) and Google may also process data outside the European Economic Area. In these cases the transfer is based on the EU-U.S. Data Privacy Framework or on the standard contractual clauses adopted by the European Commission.
Your rights
You can ask us at any time for access to your data, their rectification or erasure, the restriction of processing and data portability, and you can object to processing based on legitimate interest (articles 15–22 GDPR). To exercise these rights write to us at the contact details above: we will reply within one month.
Complaint to the supervisory authority
If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.