Privacy notice

Data controller

Le Quote, Azienda Agricola [ragione sociale da fornire], [sede legale da fornire], VAT no. [P.IVA da fornire]. For any request about your data: info@le-quote.it.

References: Reg. (UE) 2016/679 (GDPR), art. 13 c.1 lett. a

Which data, why, and on what basis

• Orders: name, email, phone, delivery address if you choose shipping, products and amounts. Needed to conclude and perform the contract and to contact you about delivery or collection (basis: performance of the contract).
• Tax and accounting obligations: the order and payment data the law requires us to record and keep (basis: legal obligation).
• Messages: if you write to us, we use the data you give us to reply (basis: steps you requested or our legitimate interest in replying).
• Security: the server logs technical request data, such as the IP address, to protect the site from abuse (basis: legitimate interest in security).

Order data is required: without it we cannot accept the order. Looking up a batch and browsing the site require no personal data.

References: GDPR, art. 6 c.1 lett. b, c, f; GDPR, art. 13 c.1 lett. c-d, c.2 lett. e

Who receives the data

The data is processed by us and, on our behalf and under a binding contract, by:

• the provider of the server hosting the site and the back office: [to be named once chosen, phase 4];
• the provider of the mailbox we send order emails from: [to be named];
• our accountant, for tax compliance;
• the carrier, only for shipped orders: [to be named once shipping is active].

The bank receives the details of the transfer you make. We do not sell or pass on the data to third parties for other purposes.

References: GDPR, artt. 13 c.1 lett. e, 28

Where the data is

The site and back office are hosted on a server in the European Union [to be confirmed once hosting is chosen]. We do not transfer data outside the European Economic Area.

References: GDPR, art. 13 c.1 lett. f

How long

• Order data and accounting records: 10 years, as required by law.
• Carts that did not become orders: 5 days after the last change, then deleted.
• Messages: as long as needed to handle the request, then at most [12 months, to be confirmed].
• Server technical logs: [14 days, to be confirmed].

References: GDPR, art. 13 c.2 lett. a; Codice civile, art. 2220

Your rights

At any time you can ask us for access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest, by writing to info@le-quote.it. We reply within one month.

If you believe the processing breaks the law, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

We make no decisions based solely on automated processing.

References: GDPR, artt. 12, 15-22, 77