Information pursuant to Articles 12 and 13 of Regulation (EU) 2016/679
Privacy Policy
Information on the processing of personal data on the Di Giminiani corporate website and online shop.
1. Data Controller
Azienda Agricola Di Giminiani Giuseppe
Via Dante Alighieri, 5 · 64013 Corropoli (TE) · Italy
VAT no. IT04388450167 · Tax Code DGMGPP54R25D043G
REA TE-176922
Phone: +39 347 390 8977
Email: info@vinidigiminiani.it
2. Scope of this notice
This notice covers vinidigiminiani.it, the e-commerce area at vinidigiminiani.it/shop/, the contact form, customer accounts and processing connected with orders, order requests, payments, deliveries, customer service, withdrawal, returns and refunds.
3. Categories of personal data processed
3.1 Browsing and security data
IP address, date and time, requested URL, browser/device information, technical logs and data required to secure and operate the services.
3.2 Contact data
First and last name, email address, message content and any further information voluntarily provided in order to handle information or commercial enquiries.
3.3 Account, cart and order data
Identification and contact data, account credentials, billing and shipping addresses, telephone number, selected products, quantities, amounts, delivery method, order status and information required for administrative and tax purposes. Where required by the customer type or tax document, tax code, VAT number and further billing details may also be processed.
3.4 Age declaration
Because the shop sells alcoholic beverages, the purchaser's declaration that they are at least 18 years old is recorded together with the order date and time. Further age checks may be carried out where required by law or by the delivery method.
3.5 Payment data
The website may record the amount, result, transaction identifier and payment method. Full card data and security codes are not stored by Di Giminiani. When electronic payment is enabled, payment details are processed by the appointed payment provider, currently Nexi XPay, under its own privacy information and security measures.
3.6 Delivery, assistance, withdrawal and refunds
Data necessary for delivery, tracking, complaints, returns, withdrawal, replacements and refunds are processed. The online “Withdraw from the contract here” function collects the customer's name, order or contract reference, email address for confirmation, the content of the withdrawal statement, and the date and time of transmission. The system generates a receipt and, where the data match, links the statement to the relevant order.
3.7 Privacy preferences and technical tools
The corporate website stores privacy choices locally. The shop uses technical cookies and similar tools required for session management, cart, authentication, security and age verification. See the Cookie Policy for details.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Browsing, security, abuse prevention and technical operation | Controller's legitimate interest in operating and securing the service, Art. 6(1)(f) GDPR |
| Replying to enquiries and handling pre-contractual activities | Art. 6(1)(b) GDPR |
| Creating and managing accounts, cart, order requests, orders, delivery, support, withdrawal and refunds | Performance of a contract or pre-contractual measures, Art. 6(1)(b) GDPR |
| Tax, accounting, administrative and consumer-protection obligations | Legal obligation, Art. 6(1)(c) GDPR |
| Recording the age declaration and managing checks connected with alcohol sales | Legal obligation and management of the sales relationship, Arts. 6(1)(c) and 6(1)(b) GDPR |
| Fraud management, disputes and protection of legal rights | Legitimate interest, Art. 6(1)(f) GDPR |
| Loading Google Fonts on the corporate site, where enabled | Consent, Art. 6(1)(a) GDPR |
Data required to handle an order or request must be provided in order for the service to be supplied. Consent to optional external content is not required in order to purchase.
5. Payments and Nexi XPay
When online payment is enabled, the customer is redirected or connected to the services of Nexi Payments S.p.A. for transaction authorisation. Nexi processes payment data under its own privacy notice and under the privacy role provided for by applicable law and its terms. Di Giminiani does not receive or store the full card number or CVV.
Where the temporary “Order request” method is available, no online payment is taken when the request is submitted. The data are used to register and manage the request and to contact the customer for finalisation.
6. Recipients and categories of recipients
Data may be processed by the Controller and authorised staff and, within their respective functions, by hosting and email providers, technical maintainers, e-commerce platform providers, payment service providers, couriers and logistics operators, administrative/tax/legal advisers and public bodies or authorities where required by law.
7. Transfers outside the EEA
If a provider involves transfers of personal data outside the European Economic Area, the transfer is handled in accordance with Chapter V GDPR, on the basis of an adequacy decision or other appropriate safeguards. On the corporate website, Google Fonts is contacted only after consent.
8. Retention
- Orders and administrative/accounting records: for the period required by applicable law, normally up to 10 years, without prejudice to longer periods required for disputes.
- Customer account: for the life of the account; closure does not erase data that must be retained for legal obligations or the protection of rights.
- Contact enquiries: for the time required to reply and manage follow-up, normally no longer than 12 months if no contractual relationship or legal need arises.
- Withdrawal statements, complaints, returns and refunds: for the time required to handle them and, where connected to a purchase, together with the relevant contractual records for the applicable statutory period. The withdrawal receipt records content, date and time.
- Technical/security logs: according to the retention periods required for operation and security by the hosting and technical providers.
- Privacy preference on the corporate site: approximately 6 months, unless deleted earlier by the user.
9. Data subject rights
Where applicable, you may exercise the rights provided by Articles 15–22 GDPR, including access, rectification, erasure, restriction, portability and objection. Where processing is based on consent, consent may be withdrawn at any time without affecting processing carried out before withdrawal. Requests may be sent to info@vinidigiminiani.it.
10. Right to lodge a complaint
You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or, where applicable, with the competent supervisory authority.
11. Cookies and similar technologies
For the technical cookies used by WooCommerce, account authentication, age verification, Nexi and optional Google Fonts on the corporate website, see the Cookie Policy. The current configuration does not use analytics, advertising or profiling cookies.
12. Changes
This notice may be updated following legal, organisational or technical changes. The version published online is the current version.