Privacy Policy

The data controller is [COMPANY LEGAL NAME], VAT number (P.IVA) [VAT NUMBER], registered office at [REGISTERED ADDRESS].

Contact for privacy matters: [PRIVACY EMAIL] — PEC: [PEC ADDRESS].

Data Protection Officer (DPO): [DPO NAME AND CONTACT, IF APPOINTED — OTHERWISE "NOT APPOINTED"].

• Contact form: name, email address, and any other information you choose to include in your message.
• Experience request / booking form: name, email, phone number where provided, preferred dates, group size, preferences and notes about your visit.
• WhatsApp contact: phone number, profile name and the content of the messages you send us.
• Email correspondence: address, subject and content of the messages exchanged.
• Newsletter (if and when activated): email address and subscription date.
• Technical and navigation data: IP address, browser and device type, pages visited, timestamps, recorded in server logs and — subject to your consent — by analytics cookies. See the Cookie Policy.

We do not knowingly collect special categories of data (Art. 9 GDPR). Please do not include health or other sensitive information in free-text fields unless strictly necessary (e.g. dietary or accessibility needs), in which case it is processed on the basis of your explicit consent.

• Replying to enquiries and preparing a proposal — legal basis: performance of a contract or pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).
• Organising and delivering the booked experience, including communication with wineries, drivers and other suppliers — Art. 6(1)(b) GDPR.
• Administrative, accounting and tax obligations — legal obligation (Art. 6(1)(c) GDPR).
• Site security, abuse prevention and service continuity — legitimate interest (Art. 6(1)(f) GDPR).
• Analytics cookies and traffic measurement — consent (Art. 6(1)(a) GDPR), freely withdrawable at any time.
• Marketing, newsletter and profiling, where activated — consent (Art. 6(1)(a) GDPR), freely withdrawable at any time.
• Establishing or defending legal claims — legitimate interest (Art. 6(1)(f) GDPR).

Providing the data marked as required in our forms is necessary to reply to you; without it we cannot process your request. All other data is optional.

• Enquiries that do not lead to a booking: up to 24 months from the last contact.
• Booking and experience records: for the duration of the relationship and 10 years thereafter, for accounting and tax purposes (Art. 2220 Italian Civil Code).
• Email correspondence: up to [RETENTION PERIOD] from the last message.
• Newsletter data: until you unsubscribe or withdraw consent.
• Server and security logs: up to [LOG RETENTION PERIOD].
• Cookies: the duration stated in the Cookie Policy; the consent record is kept for 6 months and then requested again.

At the end of these periods data is erased or irreversibly anonymised.

Your data may be shared with parties acting as data processors appointed under Art. 28 GDPR, or as autonomous controllers where required. The current list is:

• Website hosting and application platform — [HOSTING PROVIDER], servers located in [SERVER LOCATION].
• Database and backend services — [BACKEND PROVIDER].
• Email delivery and mailbox provider — [EMAIL PROVIDER].
• Analytics provider — [ANALYTICS PROVIDER, IF USED].
• Booking / itinerary management system — [BOOKING SYSTEM, IF USED].
• Messaging — [WHATSAPP / MESSAGING PROVIDER].
• Wineries, drivers, guides and other suppliers strictly involved in delivering your experience.
• Accountants, lawyers, insurers and public authorities where legally required.

An up-to-date list of data processors is available on request at the contact address above.

Data is processed within the European Economic Area wherever possible. Where a provider processes data outside the EEA — [LIST ANY NON-EEA TRANSFERS AND COUNTRIES] — the transfer is based on an adequacy decision of the European Commission or on Standard Contractual Clauses pursuant to Art. 46 GDPR, together with supplementary measures where necessary. A copy of the safeguards can be requested at the contact address above.

You have the right to:

• obtain access to your personal data and to this information (Art. 15);
• obtain rectification of inaccurate or incomplete data (Art. 16);
• obtain erasure of your data ("right to be forgotten", Art. 17);
• obtain restriction of processing (Art. 18);
• receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller (data portability, Art. 20);
• object to processing based on legitimate interest, and at any time to direct marketing (Art. 21);
• not be subject to decisions based solely on automated processing, including profiling (Art. 22); we do not carry out such decision-making;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, write to [PRIVACY EMAIL] or [PEC ADDRESS], stating the right you wish to exercise. We reply without undue delay and in any case within one month, extendable by two further months for complex requests.

If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with the Italian supervisory authority — Garante per la Protezione dei Dati Personali, Piazza Venezia 11, 00187 Roma, protocollo@gpdp.it, PEC protocollo@pec.gpdp.it, garanteprivacy.it — or seek a judicial remedy before the competent court.

Details of the cookies used on this website, their purpose and duration, and how to change or withdraw your consent, are set out in the Cookie Policy.

This policy may be updated to reflect changes in our services or in applicable law. The version in force is always the one published on this page, with its update date. Material changes are announced on the site and, where consent is required, requested again.

Change history: [VERSION 1.0 — FIRST PUBLICATION, 22 September 2026]