Privacy Policy

This document describes how the website www.borgogno.com (‘Site’) is managed, with reference to the processing of personal data of Users (‘User/Users’) consulting it.

It is an information notice provided pursuant to Article 13 of Regulation (EU) 2016/679 (‘GDPR’) and the national legislation on privacy and personal data protection applicable to all those who visit the Site and interact with Borgogno’s web services accessible through the Site.

The information is provided only for the Site and not for other websites that the User may consult through links on the Site, such as the SHOP section. As regards the SHOP section, please read the privacy policy and the general terms and conditions of sale present on the Site of 101 vini.

1. DATA CONTROLLER

The data controller is Vini Classici Borgogno s.r.l., with registered office in Via Gioberti, 1 Barolo in the person of its legal representative pro tempore, (‘Data Controller’). For any information, please contact us at the e-mail address privacy@borgogno.com.

2. TYPE OF DATA COLLECTED

Browsing data:
computer systems and software procedures used to operate the Site acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This is information that is not collected in order to be associated with identified individuals, but which by its very nature could enable users to be identified.

This category of data includes (i) the IP addresses or domain names of the computers used by users who connect to the Site, (ii) the URI (Uniform Resource Identifier) notation addresses of the resources requested, (iii) the time of the request, (iv) the method used to submit the request to the server, (v) the size of the file obtained in response, (vi) the numerical code indicating the status of the response given by the server (successful, error) and (vii) other parameters relating to the User’s operating system and computer environment.

Data provided voluntarily by the User:
the Controller processes personal and identification data (first name, last name, address, telephone, email, state, city, occupation) hereinafter “personal data”. Users are free to provide their personal data in order to make requests for information or bookings. Should the User refuse to provide identifying and personal data, in the contact form, the Controller may not be able to process such requests, in whole or in part.

Cookies:
for the treatment of Cookies, please read the related Cookie policy.

3. PURPOSE OF PROCESSING | LEGAL BASIS OF PROCESSING

Browsing data:
browsing data are used for purposes of Website security and to check its correct operation and could be used to ascertain liability in the event of any computer crimes to the detriment of the Website. The legal basis for the processing of such data is the legitimate interest of the Data Controller (art. 6.1 lett.f of the GDPR) and in the case of requests from the judicial authorities, the legal obligation (art. 6.1 lett. c) of the GDPR).

Data provided voluntarily by the User:
Personal data entered in the contact form will be processed solely for the purpose of responding to the request, i.e. for the provision of the service and booking cellar visits (art.6.1 lett. b of the
GDPR). Personal data are processed for marketing purposes (sending newsletters regarding products and services offered by the Owner), only with the express consent of the User (art.6.1 lett. a of the GDPR). The User shall have the right to revoke, at any time, the consent given.

In the context of the provision of booking services, please note that the Site makes use of a specialised external provider (WineAround SRL) for the management of the online booking service. This supplier acts as Data Processor, according to art. 28 GDPR, on the basis of a contract that guarantees the respect of security measures and treatment in compliance with the applicable regulations. The user during the booking process is redirected from the Site to a page owned by WineAround SRL.

The payment data are managed via the third-party platform Stripe Inc. https://stripe.com/it as data controller in accordance with Art. 28 GDPR.

The User’s personal data may be processed in order to fulfil obligations under the law, a regulation, Community legislation or an order of the Authority and to pursue a legitimate interest of the Controller or to exercise the Controller's rights, such as the right of defence.

Data collected through the Site will not be transferred, shared or used in any way other than as described herein. Data are not disclosed to third parties for marketing purposes. The Data Controller does not carry out any solely automated decision-making processes on personal data, including profiling.

4. CATEGORY OF DATA RECIPIENTS

Personal data may be disclosed to third parties belonging to the following categories:

freelancers, firms or companies in the context of assistance and consultancy relationships;
subjects that provide services for the management of the activities indicated in the above-mentioned purposes (subjects for communication, press);
parties providing services for the management of the information system and telecommunications networks;
platform operators for the services listed above (site hosting, management software);
competent authorities to fulfil legal obligations and/or provisions of public bodies, upon request.

Persons belonging to the above categories act as Data Processors pursuant to Art. 28 GDPR. Personal data will only be processed by persons authorised by the Data Controller, pursuant to Art.
29 GDPR, due to their job description or role in the company.

5. STORAGE PERIOD

Data processed for legal obligations will be retained for the period provided for by applicable legislation (e.g. tax, health, food safety) and, in any case, for a maximum period of 10 years or longer, if required by law;
Data processed for marketing purposes will be retained as long as the user has demonstrated an interest in receiving it. In this regard, a criterion for the data retention period has been established which provides for a “periodic check” by the Controller. According to this criterion, a user who does not prove to open the Holder's newsletter for 36 consecutive months will be automatically
deleted from the mailing list.
Data relating to IT security and monitoring access to company systems will be retained for a maximum period of 12 months after collection, unless security reasons or legal requirements require
a longer period;
Data processed for contractual and tax purposes will be processed for the entire duration of the contractual relationship established, and also thereafter, for the fulfilment of all legal obligations and, in any case, for a period not exceeding 10 years from the termination of the contractual relationship, unless there are further legal obligations or requirements related to the judicial
protection of rights.
With regard to the retention period of cookies installed on the Site, please refer to the extended cookie policy.

6. SECURITY MEASURES

Personal data are collected electronically, recorded in digital format, using organisational and technical security measures to ensure confidentiality and avoid the risks of loss or destruction, unauthorised access, unauthorised processing or processing that does not comply with the purposes set out above.

7. EXTRA-EU DATA TRANSFER

Personal data will not be transferred to countries outside the European Union with data protection regulations that are not aligned with Regulation (EU) 2016/679, except where necessary for the use of specific management services. The storage of the Website’s data is on servers located in the EU. The data controller, if necessary, may be entitled to move the location of the servers, ensuring that the transfer of data outside the EU will take place in accordance with the applicable legal provisions by entering into, if necessary, agreements that guarantee an adequate level of protection and/or by adopting the standard contractual clauses provided for by the European Commission.

8. MINORS

This Site is not intended for use by minors.

9. RIGHTS OF THE DATA SUBJECT

Users may assert their rights as expressed by Articles 15, 16, 17, 18, 19, 20, 21, 22 of the EU Regulation 2016/679, by contacting the Data Controller, by writing an email to privacy@borgogno.com or by sending a registered letter with return receipt to Borgogno srl, Via Gioberti 1, 12060 BAROLO (CN).

The User has the right, at any time, to ask the Data Controller for access to his/her personal data, rectification, cancellation of the same, and restriction of processing. Furthermore, in the cases provided for, he/she has the right to object, at any time, to the processing of his/her data (including automated processing, e.g. profiling), as well as to revoke the consent given without prejudice to the lawfulness of the processing on the basis of the consent given previously. The User has the right to lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it) and/or any other Control Authority competent under the Regulation. The User has the right to the portability of his/her data, in which case the Data Controller shall provide in a structured, commonly used and machine-readable format the personal data concerning the User.

10. CHANGES TO THE PRIVACY POLICY

The Controller reserves the right to change, update, add or remove parts of this privacy policy at its own discretion. Any updates will be published on this page.

Barolo, 26.05.25 Document Version No. 2