Privacy and Cookie Policy

1. Privacy notice

This notice describes how Cantina Pulaio ("we", "our") collects, uses and protects the personal data of users visiting the website cantinapulaio.it, in accordance with the European Regulation (EU) 2016/679 (GDPR) and the Italian Privacy Code (Legislative Decree 196/2003).

2. Data controller

The data controller is Daniele Fuso Srl, with registered office in Allerona Scalo, IT - 05014 Terni.

• VAT no.: IT01234567897

To exercise your rights or for any privacy-related request, you can contact us at: cantinapulaio@gmail.com or by phone on +39 393 859 0497.

3. Data collected and purposes

We collect the following types of data:

• Technical hosting logs:our hosting provider (Cloudflare) keeps technical access logs (IP address, browser type, requested path, date and time) for security, abuse prevention and troubleshooting. We do not use these logs for statistical analysis or profiling, and they are not accessible to any third-party analytics tool. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: according to the hosting provider's retention periods.
• Checkout and order data: for purchases made through the site, payment details, shipping address, any phone number and order details (products purchased, quantities, amounts) are collected and stored by Stripe (our payment provider), which manages the entire order and customer relationship cycle on our behalf. The site does not store any order data on its own systems: the only information updated on our infrastructure after a purchase is the product's stock level. Stripe's privacy policy is available at stripe.com/privacy.
• Electronic invoicing data: collected only when the customer asks for an invoice at checkout. In that case we keep: billing address, Codice Fiscale (for individuals), VAT number (for businesses), SDI recipient code or PEC address (for delivering B2B electronic invoices) and the applicable tax regime. Legal basis: legal obligation (Arts. 21 and 21-bis of Presidential Decree 633/1972). Retention: 10 years as required by Art. 2220 of the Italian Civil Code.
• Contact data: if you contact us by email, we keep the data you give us (name, email, message) in order to reply to your requests.

3.1 Processors and sub-processors

For the purposes above we rely on the following providers, appointed as data processors under Art. 28 GDPR:

• Stripe Payments Europe Ltd (Ireland) and Stripe, Inc. (United States) — payment processing. Privacy policy.
• Sanity.io(Sanity, Inc., United States) — the site's content management system (wine pages, events, settings). It does not store any order data or customers' personal data. Privacy policy.
• Cloudflare, Inc. (United States) — website hosting and technical logs. Privacy policy.

4. Legal basis and retention

The legal bases for processing are: performance of a contract (for purchases), legitimate interest (for running the site and security), consent (where required) and legal obligation (for tax and accounting requirements).

The following retention periods apply:

• Order and invoice data: kept by Stripe and by the controller's accounting tools for 10 years from the date of recording, under Art. 2220 of the Italian Civil Code. No order data is stored on the site's systems.
• Customer support communications: up to 24 months from the last contact, unless the relationship needs to continue or the data is needed to defend a legal claim.
• Technical hosting logs: according to the retention periods set by the hosting provider for security purposes.

Transfers outside the EU. Some of the providers listed in section 3.1 (Stripe, Sanity, Cloudflare) may process data in the United States of America. These transfers are governed by the Standard Contractual Clauses approved by the European Commission under Art. 46 GDPR and, where applicable, by the additional safeguards set out in each provider's contractual policies.

5. Your rights

Under the GDPR, you have the right to: access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent. To exercise them, write to cantinapulaio@gmail.com.

You can also lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) — Piazza Venezia 11, 00187 Rome — website garanteprivacy.it. For disputes about online purchases, the European Online Dispute Resolution (ODR) platform is also available: ec.europa.eu/consumers/odr.

6. Cookie Policy

6.1 What cookies and equivalent tools are

Cookies are small text files that websites store on your device to remember preferences, improve browsing or collect statistical information. The Italian Data Protection Authority's guidelines of 8 July 2021 extend the cookie rules to other equivalent tracking tools, including the browser's "localStorage", which we describe below.

6.2 Tools used on this site

This site only uses technical tools that are necessary for the site to work and to provide the service requested by the user. We do not use profiling, advertising or third-party analytics cookies. Technical tools do not require prior consent under Art. 122 of the Italian Privacy Code.

• pulaio-age-verified — localStorage on the cantinapulaio.it domain — stores the confirmation that you are of legal drinking age, as required by the rules on selling alcohol. Duration: persistent until manually deleted.
• pulaio-cookie-consent-v1 — localStorage on the cantinapulaio.it domain — records that the user has closed the cookie notice. Duration: persistent until manually deleted.
• cantina-cart — localStorage on the cantinapulaio.it domain — keeps the contents of your cart between browsing sessions. Duration: persistent until manually deleted or until the cart is emptied.
• Stripe (payments): payment takes place on a Stripe domain. Any cookies are set by Stripe on its own domain during checkout, not on our site. For more details see Stripe's privacy policy.

6.3 Managing and withdrawing

You can delete the technical tools listed above at any time by clearing the site data in your browser settings (in Chrome: Settings → Privacy and security → Third-party cookies → See all site data and permissions → cantinapulaio.it). If you clear the site data, the cookie notice will appear again and you will need to confirm your age again. Disabling technical tools may affect some of the site's features.

7. Changes

We reserve the right to update this notice. Any changes will be published on this page together with the date of the update.