Privacy Policy

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA (PRIVACY POLICY)

Last updated: 13 October 2026

Pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR), this notice describes how La Cantina Dello Sbusto S.R.L. collects, uses and protects the personal data of users (hereinafter the "User" or "Data Subject") who browse and make purchases on the website lacantinadellosbusto.com (hereinafter the "Site").

1. Data Controller

The Controller of personal data is:

La Cantina Dello Sbusto S.R.L.

Registered Office: Via Fratelli Friggeri 8, 42010 Rio Saliceto (RE), Italy

VAT No. / Tax Code: 03156720355

Email: [email protected]

PEC (certified email): [email protected]

2. What data we collect

We collect and process the following categories of personal data:

  • Identification and contact data: First name, surname, physical billing and shipping address, email address, telephone number (also used for contact via WhatsApp for the Custody ("Giacenza")/Shipping service).
  • Payment data: Information required to process payments (handled securely through external gateways such as Stripe, PayPal, Crypto.com). We do not store credit card numbers.
  • Account data: If you register on the Site, your name, email address and password (stored in encrypted form). If you choose "Sign in with Google", we receive from Google your name, email address, Google identifier and, where available, your profile picture.
  • Browsing data: IP addresses, browser type and information on pages visited, collected through cookies (for details, please refer to the Cookie Policy).
  • Social media/streaming platform data: Nickname or username used in the chat during our live streams, where the User interacts with us to request a live opening.

3. Purposes and Legal Basis of processing

We process the User's data for the following purposes:

A) Performance of the sales contract: To process the order, manage payments, ship the Products, manage the "Custody" ("Giacenza") service and provide customer support. Legal basis: Performance of a contract to which the data subject is party (Art. 6(1)(b) GDPR).

B) Legal obligations: To fulfil accounting, tax and administrative obligations under Italian law. Legal basis: Legal obligation (Art. 6(1)(c) GDPR).

C) Provision and recording of the "Live Opening" service: If the User requests a live opening, the Controller will publicly mention, during the live stream, the order number, the User's first name or nickname, in order to publicly associate the packs with the rightful purchaser. In addition, live streams are recorded in full and may be kept publicly available as "Video On Demand" (VOD) content on the relevant platforms. The purpose of the video recording is to allow the User to watch the opening again at a later time, and to serve as objective evidence that the Controller has duly and correctly performed the service in the event of disputes, complaints or bank disputes (chargebacks). By writing to [email protected], the User may ask to be mentioned only by a pseudonym or not to be mentioned at all, and may request removal of the video where technically possible. Legal basis: Performance of a contract/service requested by the data subject (Art. 6(1)(b) GDPR) and the Controller's legitimate interest in protecting its rights in the event of a dispute (Art. 6(1)(f) GDPR).

D) Newsletter and promotional communications: To send you newsletters and offers, only if you have given your consent. Legal basis: Consent (Art. 6(1)(a) GDPR). You may withdraw it at any time via the unsubscribe link included in the emails or by writing to [email protected].

E) Account registration and management: To create and manage your account on the Site, including via "Sign in with Google", to allow you to view your orders and data and to make purchases more quickly. Legal basis: Performance of a contract/service requested by the data subject (Art. 6(1)(b) GDPR). You may request deletion of your account by writing to [email protected].

F) Site security: To protect the Site against unauthorised access and cyber attacks, we log IP addresses, failed login attempts and requests blocked by the firewall. Legal basis: The Controller's legitimate interest in the security of its systems (Art. 6(1)(f) GDPR).

4. Who we share data with (Recipients)

Personal data will never be sold to third parties. To ensure the operation of the Site and the fulfilment of orders, data may be shared with:

  • Couriers and shipping companies (e.g. Poste, BRT, GLS) for the delivery of goods.
  • Payment service providers (e.g. PayPal, bank gateways, crypto services).
  • The Controller's accounting and tax advisers.
  • IT service providers (hosting, email delivery, database management) appointed as external Data Processors.
  • E-commerce platform providers (WordPress, WooCommerce).
  • The streaming platform on which we broadcast our live streams (e.g. TikTok), which processes viewers' data as an independent controller, in accordance with its own privacy notice.
  • Messaging services (e.g. WhatsApp), to contact you regarding the Custody ("Giacenza")/Shipping service.
  • Google (Google Analytics and Google AdSense), for statistics and advertising, only with your prior consent.
  • Google ("Sign in with Google" service), if you choose to sign in or register with your Google account: Google processes your data as an independent controller, in accordance with its own privacy policy.
  • Site security service providers (Wordfence), for protection against unauthorised access and attacks.

5. Transfers of data outside the EU

Some of the providers listed (for example Google, TikTok, PayPal, Stripe, Meta) may also process personal data outside the European Economic Area. In such cases, the transfer takes place on the basis of an adequacy decision of the European Commission or with appropriate safeguards, such as the Standard Contractual Clauses.

6. Data retention

Personal data will be retained for no longer than is strictly necessary to achieve the purposes for which it was collected. Specifically:

  • Data relating to purchases and invoicing will be retained for 10 years from the date of the transaction, as required by Italian tax legislation.
  • Data relating to the account registered on the Site will be retained until the User requests its deletion.
  • Data processed for marketing purposes will be retained until consent is withdrawn (unsubscription).
  • Videos containing references to orders (VOD) will be kept publicly available on the streaming platforms in accordance with the retention periods set by the platforms themselves (for example 30 days on TikTok). The Controller also reserves the right to download and keep a private local copy of such recordings for the time strictly necessary to manage and resolve any ongoing commercial or legal disputes with the Customer, and in any case for no longer than 24 months.
  • Photos and videos of parcel packing are kept for 30-60 days from shipment, unless a dispute is ongoing.
  • Security logs (IP addresses, login attempts, blocked requests) are kept for a maximum of 30 days, unless a security incident is ongoing.
  • Support requests are kept for the time needed to handle them and, thereafter, for 24 months.

7. Rights of the Data Subject

Pursuant to Arts. 15-22 of the GDPR, the User has the right to:

  • Access their personal data and obtain a copy of it.
  • Request the rectification or updating of inaccurate data.
  • Request the erasure of data ("Right to be forgotten"), subject to retention obligations required by law.
  • Obtain the restriction of processing or object to it.
  • Withdraw consent given at any time (e.g. for the newsletter).
  • Request data portability.

To exercise these rights, the User may send a written request by email to [email protected]. The User also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it) if they believe that the processing infringes the GDPR.

8. Provision of data and automated decision-making

To complete a purchase you must provide your identification, shipping and payment details: without this data we cannot fulfil the order. Consent to marketing and to non-essential cookies is optional and does not affect the purchase. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you.

9. Minors

Our services are reserved for persons aged 18 or over. We do not knowingly collect data from minors; if we become aware of any, we delete it.

10. Changes

We may update this notice. The version in force is the one published on the Site, with the date of the last update shown at the top.