Privacy Policy — www.acquerello.it

Information notice on the processing of personal data pursuant to Articles 13-14 of Regulation (EU) 2016/679 (GDPR)

Last updated: 23 July 2026

1. Data Controller and DPO

The Data Controller is Rondolino Società Cooperativa Agricola, with registered office at Tenuta Colombara, 13046 Livorno Ferraris (VC), Italy — VAT No. 01986880027 (the "Controller"). Email: info@acquerello.it — Tel.: 0161 477832.

The Controller has appointed a Data Protection Officer (DPO): Luigi Mattea, who can be contacted at dpo@acquerello.it.

2. Categories of data processed

• Browsing data: data collected automatically by the website's IT systems (IP addresses, logs, device/browser identifiers, pages visited). For cookies and tracking technologies, please refer to the Cookie Policy.
• Contact data provided voluntarily through the contact form or by email/telephone (e.g. name, email, content of the request).
• Newsletter data (e.g. email address) provided upon subscription.

The Controller does not process special categories of data (Art. 9 GDPR) or judicial data, save as strictly necessary to comply with legal obligations or to establish, exercise or defend a legal claim.

3. Purposes, legal bases and nature of the provision of data

Purpose	Legal basis	Provision
a) Enabling navigation and use of the website and ensuring its security	Legitimate interest of the Controller (Art. 6(1)(f)) and, for necessary cookies, Art. 122 of the Privacy Code	Necessary for navigation
b) Responding to requests for information/contact sent by the user	Response to the data subject's request / pre-contractual measures (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f))	Optional; refusal prevents the request from being followed up
c) Sending newsletters and promotional communications of the Controller by email	Consent of the data subject (Art. 6(1)(a))	Optional and revocable at any time
d) Analysis of preferences and profiling for personalised marketing purposes	Consent of the data subject (Art. 6(1)(a))	Optional and revocable
e) Third-party statistical and marketing cookies	Consent (Art. 6(1)(a); Art. 122 of the Privacy Code) — see Cookie Policy	Optional
f) Complying with legal, accounting, tax and public-security obligations	Legal obligation (Art. 6(1)(c))	Mandatory where provided for by law
g) Establishing, exercising or defending a legal claim in court	Legitimate interest of the Controller (Art. 6(1)(f))	—

The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. It is always possible to object to marketing through the unsubscribe link included in every email.

4. Methods of processing

Processing is carried out using electronic and, where necessary, paper-based tools, with technical and organisational measures adequate to ensure security and confidentiality (Art. 32 GDPR). The data are accessible only to authorised personnel and to the designated data processors.

5. Recipients and data processors

For the purposes indicated above, the data may be processed by parties acting as data processors pursuant to Art. 28 GDPR or as independent controllers, including:

• the website's hosting and maintenance service provider;
• The Rocket Science Group LLC (Mailchimp / Intuit) — newsletter sending platform;
• Google Ireland Ltd / Google LLC — statistics (Google Analytics 4), tag management and advertising (Google Ads/Tag Manager), maps (Google Maps);
• Meta Platforms Ireland Ltd — advertising pixel for campaigns on Facebook/Instagram;
• Usercentrics A/S (Cookiebot) — management of cookie consent;
• consultants and professionals (legal, tax, IT), Public Authorities and parties to whom communication is required by law.

An up-to-date list of the data processors is available from the Controller upon request.

6. Transfer of data outside the EU

Some providers (in particular Google, Meta and Mailchimp) may process data in the United States. Transfers take place with adequate safeguards: the EU-US Data Privacy Framework adequacy decision of 10 July 2023 (for certified entities) and/or Standard Contractual Clauses approved by the European Commission, together with any supplementary measures.

7. Retention period

• Contact data/requests: for the time necessary to handle the request and for a further 12 months for management purposes.
• Marketing and profiling data: until consent is withdrawn; for inactive users, deletion after 24 months from the last interaction.
• Data processed to comply with legal/accounting obligations: for the periods provided for by law (as a rule 10 years).
• Data processed to defend a legal claim: until the conclusion of the relevant proceedings.

8. Rights of the data subject

The data subject may exercise the rights set out in Articles 15-22 GDPR: access, rectification, erasure, restriction, objection, portability, as well as the withdrawal of consent. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it). Requests should be addressed to the Controller (info@acquerello.it) or to the DPO (dpo@acquerello.it).

9. Amendments

The Controller reserves the right to update this information notice. The version in force is published on this page together with its date; in the event of substantial changes, notice may also be given by email.

This is a courtesy translation; in the event of any discrepancy, the Italian-language version shall prevail.

This notice is also available in: Italiano · Deutsch · Français · Español · Português · العربية · 日本語 · 中文