Privacy notice

This notice explains how we use your personal data when you visit our shop, contact us or place an order. It is provided under Article 13 of the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.

1. Who is responsible

“We” means the seller identified in our legal notice, who is the data controller for this shop.

Azienda Agricola Campus Stellae di Anna Maria Corretti

Via di Pulica, 10
51100 Pistoia PT
Italy

2. Data, purposes and legal bases

Orders, payment and customer service

We use the name, e-mail address, phone number, billing and delivery address, selected products and quantities, order and payment references, amounts, payment status and shipping/tracking information needed to process your purchase. If you contact us, we also use your message and any attachments, such as photos supporting a damage claim.

We use these data to answer pre-purchase questions, take and fulfil orders, arrange payment and delivery, send order updates, and manage returns, refunds and guarantee claims. The legal basis is taking steps at your request before a contract and performing our contract with you (GDPR Article 6(1)(b)).

Stripe collects payment details directly in its hosted Checkout. We do not see or store your full card number or security code. Stripe supplies the payment status and order-related details needed to fulfil your order. Stripe also processes data for its own legal, regulatory and fraud-prevention purposes as explained in its privacy notice.

Accounting, tax and legal obligations

We use and keep transaction and customer details required for accounting, tax, consumer-protection and other applicable legal obligations (Article 6(1)(c)).

Security and legal claims

Technical connection data, such as IP address, browser information and request times, may be processed by the hosting infrastructure to deliver the website and investigate security incidents. We process data necessary to prevent abuse, protect the shop and establish, exercise or defend legal claims on the basis of our legitimate interests in secure operation and protection of our rights (Article 6(1)(f)), subject to your interests and fundamental rights.

Required checkout fields are necessary to conclude and perform the sale; without the necessary payment, contact and delivery details we cannot fulfil an order. Information legally required for accounting or tax records must also be provided. Additional information in an enquiry is voluntary: please do not send sensitive information we do not need.

We do not send a newsletter, use data for advertising or build marketing profiles. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects under GDPR Article 22. Your payment provider’s own payment authorisation and security checks are governed by its notice.

3. Who receives data

Access is limited to the people who need it to operate our business and to providers involved in your purchase:

• Stripe: payment processing and payment-related security.
• Our hosting provider: running and storing the shop and order records.
• The shipping platform and carriers: creating shipments, customs documentation where needed, transport and delivery.
• Our e-mail provider: delivering transactional messages and handling customer correspondence.
• Professional advisers and public authorities: where necessary for accounting, compliance or legal claims, or required by law.

Providers processing data on our instructions act under data-processing arrangements. Some recipients, including payment providers, carriers and public authorities, may act as independent controllers for their own obligations. We do not sell your personal data.

International transfers

Payment processing and international delivery can involve recipients outside the European Economic Area, including carriers and customs authorities in your destination country. Where a transfer falls under GDPR Chapter V, it must have an applicable legal basis: an adequacy decision, appropriate safeguards such as the European Commission’s standard contractual clauses, or a permitted exception where its conditions are met, such as a transfer necessary to perform your international delivery contract. You can contact us for information on the recipients, destinations and applicable safeguards and, where relevant, a copy of the safeguards.

4. How long we keep data

• Accounting and tax records: normally 10 years as required by Italian accounting law, and longer if a specific legal obligation or an ongoing proceeding requires it.
• Other order and service records: for the time needed to fulfil the order, handle returns and guarantees, and meet applicable legal obligations or limitation periods for claims. Relevant records may be kept until a dispute is finally resolved.
• Enquiries unrelated to an order: for the time needed to answer and resolve the enquiry, unless further retention is necessary for a legal obligation or claim.
• Technical and security records: only for the period necessary to operate and secure the service, taking account of incident investigation and any legal preservation requirement.

We limit retained records to what is necessary for the relevant purpose. Browser storage is described below.

5. Your rights

Subject to the conditions in GDPR Articles 15–22, you can request access to your data, correction of inaccurate data, erasure, restriction of processing and a portable copy of data processed automatically on the basis of consent or a contract. You may object, on grounds relating to your particular situation, to processing based on legitimate interests; we must stop unless we demonstrate compelling legitimate grounds or need the data for legal claims. A request to delete data does not override required accounting retention.

The processing described here does not rely on marketing consent. If we ever rely on your consent for a separate purpose, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. We will inform you before using your data for a new purpose.

Use our contact details above or in the legal notice. We may ask for proportionate information to verify your identity. We normally respond within one month; where the GDPR permits an extension, we will explain it within that month. Requests are normally free of charge.

You can complain to the Garante per la protezione dei dati personali in Italy, or to the supervisory authority in the country of your habitual residence, place of work or the alleged infringement. You do not have to contact us first.

6. Cookies and localStorage

Our shop has no analytics, advertising or tracking cookies, and no newsletter. We use only storage necessary for the functions you request:

• Basket storage (localStorage): your browser stores your selected bottle formats, quantities and delivery country under olive-basket-v1 so the basket survives page changes and later visits. A separate olive-cleared-order entry remembers which completed order has already cleared the basket. These entries have no automatic browser expiry and remain until overwritten or removed by you or your browser. They are not advertising identifiers.
• Administrator login: a strictly necessary authentication cookie maintains the authorised administrator’s session. It is set only when the administrator signs in, is not used to track customers, and is removed on logout or expires with the session.

You can remove localStorage and cookies in your browser’s site-data settings. Clearing or blocking basket storage can stop the basket from being remembered; blocking the administrator cookie prevents authenticated administration. Necessary technical storage does not require consent under Article 122 of the Italian Privacy Code, as explained in the Garante’s cookie and tracking guidance.

Stripe Checkout is a separate hosted payment service. Stripe may use its own necessary storage and payment-security technologies when you open Checkout; its privacy and cookie information applies there. The absence of analytics on our shop is not a claim that Stripe’s hosted pages use no storage.

For the statutory notice requirements, see GDPR Article 13. For purchase conditions, see our terms of sale.