PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
Website and e-commerce service www.citari.it
Provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)
Last updated: [01/10/2026]
This Privacy Notice describes how personal data are processed when users browse the website www.citari.it, use the forms available on the website (requests for information, bookings for visits and wine tastings, and subscriptions to communications), and make purchases through the related e-commerce service.
Information regarding cookies and tracking technologies is provided in a separate Cookie Policy, which is referenced in the cookie banner and available at the bottom of every page.
1. Data Controller
The Data Controller is Azienda Agricola Citari di Gettuli Giovanna e C. Società Agricola Semplice, with registered office at Località Citari 2, 25015 San Martino della Battaglia – Desenzano del Garda (BS), Italy, VAT No. IT02829190988, represented by its legal representative pro tempore.
Email: info@citari.it
Certified email (PEC): citari@legalmail.it
Telephone: +39 030 9910310
For requests relating to the e-commerce service: sales@citari.it
Any request concerning personal data protection may be addressed to the Data Controller using the contact details provided above.
2. Categories of Data, Purposes and Legal Bases
The Data Controller processes personal data for the purposes and on the legal bases set out below.
2.1 Website Browsing (Technical and Connection Data)
The IT systems and procedures responsible for operating the website automatically collect certain data in the ordinary course of operation, the transmission of which is inherent in the use of Internet communication protocols. These data include, in particular, IP addresses, device and browser information, access date and time, and pages visited.
Such data are processed to enable users to access and use the website, ensure its security and stability, and prevent misuse.
Legal basis: the Data Controller’s legitimate interest in ensuring the proper and secure operation of the website (Article 6(1)(f) GDPR).
2.2 Cookies and Tracking Technologies
The website uses technical cookies and, subject to prior consent, third-party cookies and tracking technologies for statistical and marketing purposes, including Google Analytics and Meta Pixel.
Detailed information on the technologies used and how consent can be managed is provided in the Cookie Policy: https://www.citari.it/cookie-policy/.
Legal basis: legitimate interest for technical cookies only (Article 6(1)(f) GDPR); the data subject’s consent for non-technical cookies and tracking technologies (Article 6(1)(a) GDPR and Article 122 of Legislative Decree No. 196/2003, the Italian Personal Data Protection Code).
2.3 Requests for Information (Contact Form)
The data provided by completing the contact form (first name, surname, email address and message content) are processed to respond to users’ enquiries.
Legal basis: responding to a request made by the data subject and taking pre-contractual steps (Article 6(1)(b) GDPR) and/or the Data Controller’s legitimate interest in managing incoming enquiries (Article 6(1)(f) GDPR).
2.4 Bookings for Visits and Wine Tastings
The data provided through the booking forms (contact details, selected package, date and time slot, number of adult participants and number of minor participants) are processed to manage and confirm bookings.
With regard to minors, only the numerical number of participants is collected, without any identifying information.
Legal basis: performance of a contract or taking steps prior to entering into a contract (Article 6(1)(b) GDPR).
2.5 Newsletter Subscriptions and Marketing Communications
At the user’s request and subject to consent, except as specified below, contact details are processed to send promotional communications and newsletters concerning the Data Controller’s products, services and initiatives, as well as third-party products or services, without disclosing or transferring personal data to such third parties. Contact details may also be processed for market research purposes.
Legal basis: the data subject’s consent (Article 6(1)(a) GDPR), which may be withdrawn at any time.
Where the data subject has purchased products or services, the Data Controller may use the email address provided in connection with that purchase to send commercial communications concerning its own products or services similar to those purchased, without first obtaining consent, provided that the data subject retains the right to object to further communications.
Each communication provides a free and straightforward means of opting out.
Legal basis: Article 130(4) of the Italian Personal Data Protection Code and the Data Controller’s legitimate interest (Article 6(1)(f) GDPR).
2.6 Disclosure to Partners for Marketing Purposes
Only where the data subject has given specific and separate consent may contact details be disclosed to partners or sponsors of events organised by the Data Controller. Such recipients will process the data as independent data controllers for their own marketing purposes.
Legal basis: the data subject’s consent (Article 6(1)(a) GDPR).
2.7 Profiling for Marketing Purposes
Subject to the data subject’s consent, personal data are processed to segment contacts according to criteria such as geographical area, gender, and events or initiatives of interest, in order to send more relevant communications.
Legal basis: the data subject’s consent (Article 6(1)(a) GDPR).
This activity does not involve automated decision-making that produces legal effects concerning the data subject or similarly significantly affects them within the meaning of Article 22 GDPR.
2.8 E-commerce Purchases and Personal Account
To make purchases through the e-commerce service, users must register and create an account in the personal account area. Registration requires the following information: first name, surname, email address, telephone number, billing address and shipping address, together with a declaration confirming that the user is of legal age, as required for the sale of alcoholic beverages.
When each order is placed and fulfilled, the Data Controller also processes purchase-related data, including the products purchased, amounts, order date and order status. These data form the order history available in the personal account area. Payment-related data are handled by payment service providers.
Such data are processed to register and manage the account, conclude and perform the sales contract, arrange shipping, provide customer support, and fulfil administrative and tax obligations.
Where applicable, the same data may also be processed to manage returns, refunds and complaints relating to purchases.
Legal basis: performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations, particularly tax and accounting obligations (Article 6(1)(c) GDPR).
3. Whether the Provision of Data Is Mandatory
The provision of data required for technical browsing and for fulfilment of purchase-related obligations, including billing and shipping details, is necessary. Without such data, users cannot access and use the website as intended or create an account and place an order, respectively.
The provision of data for marketing, newsletters and profiling is optional. Refusal to provide such data does not affect the user’s ability to browse the website, make purchases or use the requested services.
4. Categories of Recipients
For the purposes described above, personal data may be processed by personnel authorised by the Data Controller and disclosed to the following categories of recipients, acting either as data processors or as independent data controllers:
Website hosting and IT service providers;
Business management and sales software providers;
Email marketing platform providers (for sending newsletters and promotional communications);
Payment service providers, acting as independent data controllers for payment processing and fraud prevention;
Couriers and shipping companies responsible for delivery;
Professional advisers and consultants, for example in administrative, accounting and tax matters;
Event partners and sponsors, solely in the circumstances and within the limits described in Section 2.6 and subject to consent;
Public authorities and supervisory bodies, where required by law.
An up-to-date list of data processors may be requested from the Data Controller using the contact details provided in Section 1.
Personal data are not made publicly available.
5. Transfers to Third Countries
E-commerce shipments are made within the European Union. Destinations outside the EU may be considered upon request and assessed on a case-by-case basis, in compliance with applicable legislation.
Certain third-party tools used for statistical and marketing purposes, particularly Google and Meta services, may involve the transfer of personal data to the United States.
Such transfers are carried out in compliance with Articles 44 et seq. GDPR, on the basis of an adequacy decision adopted by the European Commission (the EU–U.S. Data Privacy Framework, where the recipient participates in the framework) or, alternatively, Standard Contractual Clauses together with appropriate supplementary measures.
6. Data Retention Periods
Personal data are retained only for as long as strictly necessary to fulfil the purposes for which they were collected, and in particular:
Browsing data and technical logs: 30 days;
Enquiries and bookings: for the time necessary to respond to the enquiry and manage any subsequent follow-up;
Newsletters, marketing and profiling data: until consent is withdrawn or an objection is raised and, in the absence of either, for no longer than two years from the last contact or interaction;
Order and account data: for the duration of the relationship and, in any event, up to three years after the last purchase for account data; tax and accounting records are retained for 10 years as required by law;
Cookies and tracking technologies: for the periods specified in the Cookie Policy.
Once these periods have expired, the data are deleted or anonymised, except where retention is required by law or where the data are necessary to establish, exercise or defend a legal claim.
7. Data Subject Rights
At any time, the data subject may exercise the rights provided for under Articles 15–22 GDPR in relation to the Data Controller, including the right to access personal data, rectify them, request their erasure, restrict their processing, obtain their portability, and object to their processing.
The data subject also has the right to object at any time to the processing of personal data for direct marketing purposes, including profiling related to such marketing (Article 21 GDPR), and to withdraw any consent previously given, without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3) GDPR).
Consent to promotional communications may also be withdrawn by clicking the appropriate link included in each communication.
Requests should be sent to the contact details provided in Section 1.
Without prejudice to any other administrative or judicial remedy, the data subject also has the right to lodge a complaint with the supervisory authority of the Member State in which they habitually reside, work, or where the alleged infringement occurred.
In Italy, the relevant supervisory authority is the Italian Data Protection Authority (Garante per la protezione dei dati personali), available at www.garanteprivacy.it.
8. Minors
The website and e-commerce service are not intended for persons under the age of 18. As the products sold are alcoholic beverages, sales are restricted to adults aged 18 or over.
The Data Controller does not knowingly collect identifying information relating to minors. For bookings for visits and wine tastings, only the number of minor participants is collected, without any identifying information about them.
9. Amendments to This Privacy Notice
This Privacy Notice is current as of the date indicated above. The Data Controller reserves the right to amend or supplement it, including as a result of changes to applicable legislation or to the processing activities carried out.