PRIVACY POLICY – PERSONAL DATA PROCESSING NOTICE

pursuant to Articles 13–14 of Regulation (EU) 2016/679 (GDPR)

Last updated: 26 giugno 2026 / 26 June 2026

1. Data Controller

The Data Controller for personal data collected through the website https://invinisveritas.com/ is:

• Company name: In Vinis Veritas Srl
• Legal representative: Hermes Gilardoni
• Registered office: Via XX Settembre 7 – 23829 Varenna (LC), Italy
• VAT number: IT08198790969
• Registered in the Chamber of Commerce of Monza e Brianza, REA No. 1889060
• E-mail: info@invinisveritas.it

For any matter concerning the processing of your personal data, please contact the Data Controller at the e-mail address above.

2. Categories of data processed and purposes

The website collects personal data exclusively in connection with the following activities:

1. a) Data provided during purchase / booking

When you purchase a tasting session, event, gift card or any other product/service through our WooCommerce shop, we collect the following data:

• First and last name
• E-mail address
• Phone number (if provided)
• Billing / shipping address
• Payment data (processed directly by PayPal or Stripe – see Art. 5)

Legal basis: Art. 6(1)(b) GDPR – performance of a contract to which the data subject is party.

Retention: accounting and tax records are retained for 10 years as required by Italian law; other order data for 5 years from the date of purchase.

1. b) Browsing data (technical cookies)

The website uses only technical cookies strictly necessary for the correct functioning of its pages (e.g. WooCommerce cart management, user session). Such cookies do not require user consent under the Italian Data Protection Authority’s guidelines of 10 June 2021 and the 2022 Cookie Guidelines.

No profiling cookies, third-party analytics cookies or tracking pixels are installed.

Legal basis: Art. 6(1)(f) GDPR – legitimate interest in the correct technical operation of the website.

1. c) Contact form data

If you complete the contact form on the Contacts page, we collect your name, e-mail address and the content of your message, solely for the purpose of replying to your request.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual) or Art. 6(1)(f) GDPR (legitimate interest in responding to communications).

Retention: until the request is fulfilled and, in any case, no longer than 12 months.

3. Processing methods

Personal data are processed by electronic means, adopting technical and organisational measures appropriate to the level of risk (Art. 32 GDPR), including:

• Encrypted HTTPS/TLS connection
• System access restricted to authorised staff
• Regular backups

Data are not subject to automated decision-making or profiling (Art. 22 GDPR).

4. Data disclosure and sharing

Personal data are not sold, assigned or disclosed to third parties for their own purposes. Data may be shared exclusively with:

• Technical service providers (hosting, WooCommerce platform) acting as Data Processors pursuant to Art. 28 GDPR, under a written data processing agreement;
• Payment intermediaries PayPal (Europe) S.à r.l. et Cie, S.C.A. and Stripe Payments Europe, Limited, who process payment data independently as separate Data Controllers (see Art. 5);
• Public authorities where required by law (e.g. tax obligations).

5. Third-party payment services

The website uses the following payment gateways. Financial information (card details, PayPal account) is transmitted directly to the providers and does not transit or get stored on In Vinis Veritas Srl’s servers:

PayPal

Controller: PayPal (Europe) S.à r.l. et Cie, S.C.A. – 22-24 Boulevard Royal, L-2449 Luxembourg.

Privacy policy: https://www.paypal.com/it/legalhub/privacy-full

Stripe

Controller: Stripe Payments Europe, Limited – 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

Privacy policy: https://stripe.com/privacy

We recommend reading the respective privacy policies before completing a payment.

6. International data transfers

Stripe and PayPal may transfer data to countries outside the European Economic Area (EEA). Such transfers take place on the basis of appropriate safeguards (Standard Contractual Clauses under Art. 46 GDPR or adequacy decision), as detailed in their respective privacy policies.

7. Data subject rights

You have the right to:

• Access your personal data (Art. 15 GDPR);
• Obtain rectification of inaccurate data (Art. 16 GDPR);
• Request erasure of your data (‘right to be forgotten’) where applicable (Art. 17 GDPR);
• Obtain restriction of processing (Art. 18 GDPR);
• Receive your data in a structured, machine-readable format (portability, Art. 20 GDPR);
• Object to processing based on legitimate interests (Art. 21 GDPR);
• Lodge a complaint with the competent supervisory authority (Italian Data Protection Authority – Garante per la Protezione dei Dati Personali – www.garanteprivacy.it).

To exercise your rights, simply send a request to: info@invinisveritas.it. The Data Controller will reply within 30 days of receipt, unless an extension of up to 60 additional days is justified (Art. 12 GDPR).

8. Changes to this Privacy Policy

The Data Controller reserves the right to amend this Privacy Policy, including due to regulatory or technical updates. In the event of material changes, appropriate notice will be given. The updated version will always be available at: https://invinisveritas.com/privacy-policy/