This notice describes how the personal data of users visiting the website https://www.bottegadei4vini.com/it/ are processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 ("Italian Privacy Code").
The data controller is Bottega dei Quattro Vini, with registered office at Piazza Italia, 2 - 12052 Neive (CN), Italy, VAT no. 02052890049. Any request concerning the processing of personal data may be sent to info@bottegadei4vini.com.
The data controller has not appointed a Data Protection Officer (DPO), as none of the cases in which the appointment is mandatory under Art. 37 GDPR applies.
Browsing data. During their normal operation, the IT systems that run the website acquire certain data whose transmission is implicit in the use of Internet protocols: for example the IP address, browser type, operating system, pages visited, and the date and time of the request. These data are used to ensure the operation and security of the website.
Cookies and other tracking tools. For information on the cookies and similar tools used by the website, please refer to the Cookie Policy.
The data are processed for the purposes set out below, each based on the corresponding legal basis.
| Purpose | Legal basis | Retention |
|---|---|---|
| Operation, security and prevention of misuse of the website | Legitimate interest of the data controller in ensuring the operation and security of the website (Art. 6(1)(f) GDPR) | 6 months |
| Display of third-party content and services embedded in the website | Consent of the data subject (Art. 6(1)(a) GDPR), given through the cookie banner | See the Cookie Policy |
When the periods indicated expire, the data are erased or anonymised. The data may be kept for longer only where necessary to comply with legal obligations or for the establishment, exercise or defence of legal claims.
The website uses services provided by Google (Google Fonts (loaded from a remote server), Google Maps (embedded maps)), which are activated only with the user's consent when they are not strictly necessary. How these services work, including any advertising features, is described in the Cookie Policy. To learn how Google uses information from sites that use its services, see the page policies.google.com/technologies/partner-sites.
The data are processed using electronic and, where necessary, paper-based tools, with appropriate technical and organisational measures to ensure their security and confidentiality, pursuant to Art. 32 GDPR. The data are processed by persons authorised and instructed by the data controller.
The data may be disclosed to the following parties, which normally act as data processors under a contract with the data controller (Art. 28 GDPR) or, where stated in their respective privacy notices, as independent data controllers:
| Service | Provider | Provider's privacy notice |
|---|---|---|
| Website hosting provider | Seeweb S.r.l. | Privacy notice |
| Cookie-Script (consent management) | Objectis Ltd | Privacy notice |
| Public CDNs (JavaScript and CSS libraries) | CDN providers (e.g. jsDelivr, cdnjs, unpkg) | — |
| Google Fonts (loaded from a remote server) | Google Ireland Limited | Privacy notice |
| Google Maps (embedded maps) | Google Ireland Limited | Privacy · Cookies |
The data may also be received by consultants and suppliers who assist the data controller (for example with website maintenance or accounting obligations), as well as by public authorities where required by law. The up-to-date list of data processors may be requested from the data controller.
Some of the providers listed may process data outside the European Economic Area. In such cases, the transfer takes place on the basis of an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified US providers, or of other appropriate safeguards under Arts. 45-46 GDPR, such as the Standard Contractual Clauses.
| Service | Provider | Transfer and safeguards |
|---|---|---|
| Public CDNs (JavaScript and CSS libraries) | CDN providers (e.g. jsDelivr, cdnjs, unpkg) | Possible transfer to non-EEA countries depending on the provider's network. |
| Google Fonts (loaded from a remote server) | Google Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. |
| Google Maps (embedded maps) | Google Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. |
Providing browsing data is necessary to use the website. Providing the data requested in forms is optional, but the fields marked as mandatory are necessary to handle the request: without them it will not be possible to reply. Consent for marketing purposes and for non-technical cookies is always optional, and refusing it has no consequences on the use of the website.
The website and the services offered are not intended for minors under 14 years of age, the minimum age set in Italy for giving consent to data processing in relation to online services on one's own (Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code). Minors under 14 must not provide personal data through the website. If the data controller becomes aware of having collected data of a minor under 14 without the consent of the holder of parental responsibility, it will erase them without delay. Parents or guardians who believe this has happened may write to info@bottegadei4vini.com.
The data subject may at any time exercise the rights provided for by Arts. 15-22 GDPR:
Requests may be sent to info@bottegadei4vini.com. The data controller will reply within one month of receipt, a period that may be extended by two months in particularly complex cases, as provided for by Art. 12 GDPR.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it) or with the supervisory authority of the Member State in which they reside or work.
The data are not subject to decision-making based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects the data subject (Art. 22 GDPR).
The data controller does not use artificial intelligence systems to process the personal data collected through the website. In the future it may use artificial intelligence tools to analyse the data collected for the data controller's information: in that case this notice will be updated before the processing begins.
The data controller may amend this notice, including as a result of changes in legislation or in the services used. Please check this page periodically.
Last updated: 9 November 2026
