Privacy Policy

Last updated: 5 May 2026  |  Version 1.0

1. Data Controller

2. Data Collected, Purposes and Legal Bases

We collect personal data only for specific, explicit and legitimate purposes. For each purpose we indicate the legal basis under Art. 6 GDPR and the retention period.

2.1 Browsing data Legitimate interest

The Website’s systems automatically collect technical data whose transmission is inherent to the use of Internet protocols: IP address, browser type, operating system, pages visited and access times. These data are used solely to ensure the correct functioning and security of the Website and to prevent misuse. The legal basis is the legitimate interest of the Data Controller (Art. 6(1)(f) GDPR). Retention: maximum 12 months.

2.2 Contact requests via form or email Consent

When you fill in a contact form or write to us by email, we collect: first and last name, email address and the content of your message. The legal basis is the consent of the data subject (Art. 6(1)(a) GDPR), which may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal. Retention: for as long as necessary to handle your request and, thereafter, a maximum of 24 months.

2.3 Contact details for communications Consent

If you provide us with your name, email address and/or phone number to receive updates about our products, the processing is based on the consent of the data subject (Art. 6(1)(a) GDPR). Retention: until withdrawal of consent or termination of the service.

2.4 Compliance with legal obligations Legal obligation

In some cases we are required to process your data in order to comply with legal obligations or orders of competent authorities (Art. 6(1)(c) GDPR).

3. Cookies

The Website uses technical cookies necessary for its operation, which do not require consent under the Italian Data Protection Authority’s Cookie Guidelines (10 June 2021).

Should analytical or profiling cookies from third parties (e.g. Google Analytics) be used, you will be informed via a banner and may choose whether to grant or refuse your consent. For further details please consult our Cookie Policy available on the Website.

4. Disclosure of Data

Your personal data are not disclosed to unspecified parties. They may be communicated exclusively to:

• Technical service providers (e.g. hosting providers, website developers), bound by appropriate agreements as Data Processors pursuant to Art. 28 GDPR;
• Public authorities or supervisory bodies, in cases provided for by law or by order of a judicial authority;
• Potential buyers or partners, in the event of a merger, acquisition or sale of the business, subject to adequate prior notice to the data subjects.

5. Transfer of Data to Third Countries

Personal data are processed within the European Economic Area. Should a transfer to third countries become necessary (e.g. through cloud services or tools with servers outside the EEA), such transfer will take place only where the safeguards required by Arts. 44–49 GDPR are in place, such as standard contractual clauses approved by the European Commission.

6. Security

We adopt appropriate technical and organisational security measures to protect your data from unauthorised access, loss, destruction or unlawful disclosure. Access is restricted to those who require it for operational purposes. Security measures are periodically reviewed and updated.

7. Third-Party Websites

The Website may contain links to third-party websites. This Privacy Policy does not apply to those sites. We cannot guarantee that third parties process personal data in a reliable or secure manner. We recommend that you consult their respective privacy policies before providing any personal data.

8. Your Rights

Under Arts. 15–22 GDPR you have the right to:

• Access (Art. 15): find out whether we process your data and obtain a copy;
• Rectification (Art. 16): correct inaccurate or incomplete data;
• Erasure (Art. 17): obtain the deletion of your data (“right to be forgotten”);
• Restriction (Art. 18): request restriction of processing in certain circumstances;
• Data portability (Art. 20): receive your data in a structured, machine-readable format;
• Objection (Art. 21): object to processing based on legitimate interest;
• Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise your rights, please write to giulia@anticaamaretteria.com. We will respond within 30 days of receipt of your request, as required by Art. 12 GDPR.

9. Lodging a Complaint

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali):

10. Changes to This Policy

We reserve the right to update this Privacy Policy at any time, in accordance with applicable law. Any changes will be published on this page with an updated date at the top. We recommend that you check this page periodically.

11. Contact Us