Privacy Policy
Ca' del Naso Società Agricola S.r.l. Unipersonale — www.cadelnaso.com
Last updated: 25 September 2026
1. Data Controller
The data controller is Ca' del Naso Società Agricola S.r.l. Unipersonale, registered office at Largo Usilia, 18, 53036 Poggibonsi (SI), Italy, VAT number/Tax Code 01506550522, REA SI-204059 ("Ca' del Naso", "we"). For any privacy matter, contact us at info@cadelnaso.com or by PEC at cadelnaso@pec.it.
2. Scope
This Privacy Policy explains how we collect, use, share and protect personal data of visitors and customers of www.cadelnaso.com (the "Site"), in accordance with Regulation (EU) 2016/679 ("GDPR") and applicable Italian data protection law.
3. Categories of Personal Data We Collect
● Identification and contact data: name, surname, billing and shipping address, email address, phone number.
● Order data: products purchased, order value, order history, delivery instructions.
● Age-verification data: your confirmation/declaration that you meet the minimum legal drinking age.
● Payment data: processed directly by Squarespace Payments and its payment partners; we do not receive or store your full card number. We may receive limited transaction data (e.g., amount, payment status, last 4 digits of card, transaction ID).
● Communications: content of emails, messages or forms you send us (e.g., customer service requests).
● Technical/usage data: IP address, browser type, device information, and data collected via basic/technical cookies necessary for the Site to function (see Section 8).
4. Purposes and Legal Basis
We process your personal data for:
● (a) Managing your account (if created) and processing and fulfilling your orders, including shipping, invoicing and customer service — legal basis: performance of a contract with you (Art. 6(1)(b) GDPR).
● (b) Age verification for the sale of alcoholic beverages and compliance with applicable regulatory requirements — legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR) and, where relevant, performance of a contract.
● (c) Issuing invoices and maintaining accounting/tax records — legal basis: compliance with legal obligations (Italian tax and civil code record-keeping requirements).
● (d) Preventing fraud, misuse of the Site, and enforcing our Terms and Conditions — legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in protecting our business and customers.
● (e) Responding to your enquiries and communications — legal basis: performance of a contract and/or our legitimate interest in providing customer service.
● (f) Sending you marketing communications, if and only if you have given specific consent — legal basis: consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
5. Minimum Age and Minors
Our products contain alcohol and the Site is not directed at, nor intended for use by, individuals below the legal drinking age. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.
6. Recipients of Personal Data
We may share your personal data with:
● Squarespace, Inc. and its payment service, Squarespace Payments, which host the Site, operate our e-commerce platform, and process payments;
● Our shipping/courier partners (currently FedEx and/or BRT (Bartolini), or equivalent), to the extent necessary to deliver your order and, where required, to verify the recipient's age;
● Our professional advisors (e.g., accountant, tax advisor) and, where required, public authorities (e.g., tax authorities), on the basis of legal obligations;
● IT service providers who support the operation of the Site, acting as our data processors under written agreements.
We do not sell your personal data to third parties.
7. International Data Transfers
Some of the providers referred to above (in particular Squarespace and its payment partners) may process personal data in the United States or other countries outside the European Economic Area. Where this occurs, we ensure that appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses or the provider's certification under an approved transfer framework (e.g., the EU-U.S. Data Privacy Framework), as applicable. You may request further information on these safeguards by contacting us.
8. Cookies
The Site currently uses only basic/technical cookies that are strictly necessary for it to function correctly (e.g., to operate the shopping cart, remember your session, and ensure security), together with the standard technical cookies set by our hosting platform, Squarespace. These cookies do not require your prior consent under applicable law, but you can manage or disable cookies through your browser settings, which may affect the functioning of the Site. Should we introduce analytics, marketing, or other non-essential cookies in the future, we will update this Policy and request your consent through an appropriate cookie banner before such cookies are set.
9. Data Retention
● Order, invoicing and accounting data: retained for the periods required by Italian tax and civil law (generally up to 10 years from the relevant transaction).
● Customer service communications: retained for as long as necessary to handle your request and for a reasonable period afterwards to handle any related claims.
● Marketing consent (if given in future): retained until you withdraw your consent, or otherwise reviewed periodically.
● Technical/cookie data: retained for the period indicated in the relevant cookie's settings.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure, taking into account the nature of the data and the risks involved, including reliance on reputable providers (Squarespace, Squarespace Payments) that maintain their own security and compliance standards (including PCI-DSS for payment data).
11. Your Rights
Subject to the conditions set out in the GDPR, you have the right to:
● access your personal data and obtain a copy of it (Art. 15);
● request rectification of inaccurate or incomplete data (Art. 16);
● request erasure of your data ("right to be forgotten") (Art. 17);
● request restriction of processing (Art. 18);
● receive your data in a portable format, and request its transfer to another controller, where applicable (Art. 20);
● object to processing based on our legitimate interest, including for direct marketing (Art. 21);
● withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3));
● lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it), or with the supervisory authority of your EU country of residence.
To exercise these rights, contact us at info@cadelnaso.com or cadelnaso@pec.it. We will respond within the timeframes required by the GDPR.
12. Automated Decision-Making
We do not carry out any processing based solely on automated decision-making, including profiling, that produces legal or similarly significant effects on you.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time, in particular to reflect changes to our processing activities, providers, or applicable law. The updated version will be published on the Site with a revised "last updated" date.
14. Contact
Ca' del Naso Società Agricola S.r.l. Unipersonale
Largo Usilia, 18 – 53036 Poggibonsi (SI), Italy
Email: info@cadelnaso.com | PEC: cadelnaso@pec.it