PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
PURSUANT TO ARTICLES 13 AND 14 OF EU REGULATION 2016/679
EU Regulation No. 2016/679 (hereinafter also GDPR) and Italian Legislative Decree 196/2003, and any modifications and/or integrations thereto (Italian Personal Data Protection Code), as amended and supplemented by Legislative Decree 110/2018, lay down rules on the protection of natural persons with regard to the processing of personal data, and on the free movement of such data. In order to protect the fundamental rights and freedoms of natural persons, privacy legislation imposes on data controllers the obligation to provide data subjects with information regarding the processing of personal data collected online and offline through various channels.
The Joint Controllers, as identified below, make available to any person (hereinafter the “Data Subject”) who browses any of the websites owned by one of the Joint Controllers, this document entitled Privacy Notice on the Processing of Personal Data pursuant to Articles 13 and 14 of EU Regulation No. 2016/679 (hereinafter the “Notice”).
Further information may be provided to Data Subjects in different ways and at different times in connection with specific processing activities.
*****
1) Who are the Joint Controllers?
The companies within the CERETTO group, listed below, process your personal data jointly and independently, for the purposes set out hereunder:
hereinafter referred to individually as the Controller or collectively as the Joint Controllers.
The above companies act as independent Controllers with respect to the processing of data for the purposes set out in points A, B, F, G and H. They may also act, independently or jointly as Joint Controllers, with respect to the processing of data for the purposes set out in points C, D and E, having jointly determined the purposes and means of processing by entering into a specific agreement pursuant to Article 26 of the GDPR.
The essential content of the joint controllership agreement shall be made available to the Data Subject upon request. Any Data Subject wishing to exercise their rights under the Regulation may contact CERETTO AZIENDE VITIVINICOLE S.R.L. by e-mail at ceretto@ceretto.com or by registered letter to its registered office.
Irrespective of the provisions of the agreement, the Data Subject may exercise their rights under the Regulation against any of the Controllers.
2) What personal data may we collect?
Each Controller, individually or as a Joint Controller, informs the Data Subject that, pursuant to Article 4 of the GDPR, personal data means any information relating to the Data Subject that is capable of identifying them directly and/or indirectly.
The data that may be collected (either mandatory in order to provide the service or optional), depending on the purposes, are:
Please note that any data provided by the user during the booking and payment process (e.g. credit card number, cardholder name, etc.) are managed directly by the platform, which acts as an independent controller with regard to such data.
The data Controller will not process special data. Should it become necessary, the data Controller shall process such data in accordance with applicable legislation.
Your data may be collected through the websites (hereinafter collectively the Websites) owned by each of the Controllers:
Your data may be processed following collection through the Websites in the following ways:
3) Why do we process your data? Purposes and legal basis
Your data, as defined above, will be processed by the data Controller for the following purposes:
04) Who are the Recipients of the data?
Your data shall not be disclosed or made accessible and available to third parties, with the exception of communications made by the Controller – without requiring your consent – in compliance with legal and contractual obligations, which shall be carried out within the EU solely for the purposes set out below.
Your data may be shared, for the pursuit of the purposes specified above, with the following categories of recipients:
A. internal persons within each Controller, acting as “authorised processors”.
Your personal data shall be processed by the Controller for the purposes described above through internal persons who have access to your data in order to carry out their work duties. Such persons have been specifically authorised by means of a letter of appointment. These subjects have been specifically authorised by a letter of appointment.
B. external parties carrying out specific tasks on behalf of the Controllers and ancillary to the above purposes, acting as “data processors”, including where they serve as system administrators.
Your personal data may be processed, by way of example and without limitation, by parties serving in the following capacities: (i) system administrators for the management of each Controller’s IT resources, or parties managing the booking and payment systems; (ii) accountants for the management of tax and accounting matters; (iii) auditors or other parties tasked with inspections or checks on compliance with applicable legislation; (iv) external consultants and suppliers, banks and credit institutions, insurance companies, carriers, professional firms; (v) other companies within the Ceretto group; (vi) public administrations.
Such parties may also process your data as independent controllers.
Under no circumstances shall your data be transferred to third parties. The list of data processors may be requested from the data controller in the manner provided for in section 7 below.
05) Do we transfer data to third countries?
Your personal data may be transferred to third countries outside the European Union.
In such cases, where those countries do not offer an adequate level of protection and have not been recognised as such by an adequacy decision of the European Commission (United States of America and India), the Controller, including through its Data Processors bound by Data Processing Agreements, shall ensure an adequate level of protection through appropriate measures and safeguards.
06) How long do we retain the data?
Please note that, pursuant to Article 5 of the GDPR and in compliance with the principles of lawfulness, purpose limitation, storage limitation and data minimisation:
7) What are the rights of the Data Subject?
The data subject may exercise the following rights against the data controller with regard to the processing of their data:
- Right of Access and to Rectification
Pursuant to Article 15 of the GDPR, in your capacity as data subject, you have the right to obtain the following from the data controller: confirmation as to whether or not personal data relating to you are being processed, access to such data and to all the information referred to in Article 15(1)(a) to (h), by means of the issue of a copy of the data being processed in a structured, commonly used, machine-readable and interoperable format.
Pursuant to Article 16 of the GDPR, as a Data Subject you have the right to obtain from the Controller the rectification and/or supplementation of data being processed where such data are out of date and/or inaccurate and/or incomplete.
- Right to Erasure and Right to Restriction
Pursuant to Article 17 of the GDPR, in your capacity as data subject, you have the right to obtain the erasure of data relating to you - with the exception of the cases specifically provided for in Article 17(3) - exclusively in the cases referred to in Article 17(1)(a) to (f) of the GDPR, from the data controller, without undue delay.
Pursuant to Article 18(1), points (a) to (d), of the GDPR, as a Data Subject you have the right to request and obtain from the Controller the restriction of the processing of your personal data, i.e. that such data shall not be subject to further processing and may no longer be modified. The Controller shall ensure that the restriction of processing is implemented by means of appropriate technical measures that guarantee inaccessibility and immutability.
- Right to Portability
Pursuant to Article 20 of the GDPR, in your capacity as data subject, you have the right to receive the personal data concerning you from the data controller, the processing of which is carried out by automated means, in a structured, commonly used and machine-readable format, and you also have the right to transmit such data to another data controller, or to obtain from the data controller, when technically feasible, the direct transmission of such data to another specifically identified data controller.
- Right to Object
Pursuant to Article 21 of the GDPR, in your capacity as data subject you have the right to object at any time to the processing of personal data concerning you, on grounds relating to your particular situation, in cases where the processing of your data is necessary (1) for the performance of a task carried out in the public interest and/or in connection with the exercise of official authority vested in the data controller; (2) for the pursuit of a legitimate interest of the data controller or a third party; (3) for profiling activities, if carried out by the data controller, on the basis of the preceding sections. You also have the right to object to the processing of your personal data on grounds relating to your particular situation where the data is processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89 paragraph 1 of the GDPR, except where the processing is necessary for the performance of a task carried out in the public interest.
- Withdrawal of consent
If the data processing is based on the consent of the data subject, they may withdraw it at any time. Processing carried out in the period prior to withdrawal of consent shall be deemed to have been lawfully carried out.
- Right to lodge a complaint
Pursuant to Article 77 of the GDPR, in your capacity as data subject, you have the right to lodge a complaint with a supervisory authority in the manner indicated in the same article.
Receipt of your request shall be acknowledged and the relevant information shall be provided to you within one (1) month of receipt of the request. If necessary, taking into account the complexity and number of requests, this period may be extended by a further two (2) months, subject to a reasoned communication to be sent within one
(1) month of receipt of the request.
Any rectification, erasure, restriction or objection shall be communicated to all recipients, as identified in Article 4(1)(9) of the GDPR, to whom the data have been transmitted, unless this proves impossible or involves disproportionate effort.
Following the submission of your request for rectification, erasure, restriction or objection, should the Controller have reasonable doubts as to your identity, it shall request further information to confirm it. Such communications will be sent by email.
In the event that the data controller does not comply with your request within 1 (one) month from receipt of the request, the data controller shall inform you of the reasons for non-compliance, informing you as of now of your right to lodge a complaint with the Supervisory Authority (Italian Garante per la protezione dei dati personali), as specified pursuant to Article 13(2)(d) and covered by Articles 77 et seq. of the GDPR.
8) Do we use automated decision-making processes?
The data controller informs you that, for the purpose of processing your personal data, they do not use automated decision-making processes, namely processes aimed at making decisions based solely on technological means according to predetermined criteria (i.e. without human involvement).
Last update: June, 10th 2026
