{"id":323,"date":"2025-02-18T14:36:24","date_gmt":"2025-02-18T14:36:24","guid":{"rendered":"https:\/\/www.vinaltum.it\/privacy"},"modified":"2026-11-09T13:44:34","modified_gmt":"2026-11-09T13:44:34","slug":"privacy","status":"publish","type":"page","link":"https:\/\/www.vinaltum.it\/en\/privacy","title":{"rendered":"Privacy"},"content":{"rendered":"<div class=\"fusion-fullwidth fullwidth-box fusion-builder-row-1 fusion-flex-container has-pattern-background has-mask-background nonhundred-percent-fullwidth non-hundred-percent-height-scrolling\" style=\"--link_color: var(--awb-custom_color_8);--awb-border-radius-top-left:0px;--awb-border-radius-top-right:0px;--awb-border-radius-bottom-right:0px;--awb-border-radius-bottom-left:0px;--awb-flex-wrap:wrap;\" ><div class=\"fusion-builder-row fusion-row fusion-flex-align-items-flex-start fusion-flex-content-wrap\" style=\"max-width:1352px;margin-left: calc(-4% \/ 2 );margin-right: calc(-4% \/ 2 );\"><div class=\"fusion-layout-column fusion_builder_column fusion-builder-column-0 fusion_builder_column_1_1 1_1 fusion-flex-column\" style=\"--awb-padding-top:70px;--awb-padding-bottom:70px;--awb-bg-size:cover;--awb-width-large:100%;--awb-margin-top-large:0px;--awb-spacing-right-large:1.92%;--awb-margin-bottom-large:20px;--awb-spacing-left-large:1.92%;--awb-width-medium:100%;--awb-order-medium:0;--awb-spacing-right-medium:1.92%;--awb-spacing-left-medium:1.92%;--awb-width-small:100%;--awb-order-small:0;--awb-spacing-right-small:1.92%;--awb-spacing-left-small:1.92%;\" data-scroll-devices=\"small-visibility,medium-visibility,large-visibility\"><div class=\"fusion-column-wrapper fusion-column-has-shadow fusion-flex-justify-content-flex-start fusion-content-layout-column\"><div class=\"fusion-text fusion-text-1\"><div class=\"text\">\n<h2>Privacy notice<\/h2>\n<p><em>Last updated: 6 November 2026.<\/em><\/p>\n<p>This page explains what personal data we process when you visit the Vinaltum website, write to us, take part in the event as a winery, or receive a personal ticket from an exhibiting winery. It is provided under Articles 13 and 14 of Regulation (EU) 2016\/679 (the &#8220;GDPR&#8221;).<\/p>\n<h3>1. Who the data controller is<\/h3>\n<p><strong>Vinaltum Service Soc. Coop. Sociale<\/strong><br \/>Tax code and VAT no. 03339440210<br \/>Via Werner von Siemens 23, 39100 Bolzano (BZ), Italy<br \/>Email: <a href=\"mailto:contatti@vinaltum.it\">contatti@vinaltum.it<\/a><\/p>\n<p>You can write to this address with any question about your data.<\/p>\n<h3>2. What data we process, why, and for how long<\/h3>\n<p>For each activity you will find the data collected, the purpose, the legal basis, how long the data is kept, and what happens if you do not provide it.<\/p>\n<h4>2.1 Browsing the website<\/h4>\n<ul>\n<li><strong>Data:<\/strong> IP address, date and time, page requested, browser type. These are recorded automatically by the server and by the website&#8217;s security system.<\/li>\n<li><strong>Purpose:<\/strong> to run the website and protect it from abuse and attacks.<\/li>\n<li><strong>Legal basis:<\/strong> our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR).<\/li>\n<li><strong>Retention:<\/strong> no more than 12 months, unless needed to investigate abuse.<\/li>\n<\/ul>\n<h4>2.2 Contact form<\/h4>\n<ul>\n<li><strong>Data:<\/strong> first and last name, phone number, email, city, message, plus IP address and the date and time of submission.<\/li>\n<li><strong>Purpose:<\/strong> to answer your request. The form also sends you a summary by email.<\/li>\n<li><strong>Legal basis:<\/strong> your request and pre-contractual steps (Art. 6(1)(b) GDPR); for general enquiries, our legitimate interest in replying (Art. 6(1)(f) GDPR).<\/li>\n<li><strong>Retention:<\/strong> 24 months from submission.<\/li>\n<li><strong>If you do not provide it:<\/strong> without the required fields we cannot receive your request or reply.<\/li>\n<\/ul>\n<h4>2.3 Winery application<\/h4>\n<ul>\n<li><strong>Data:<\/strong> winery name, contact person, phone number, email.<\/li>\n<li><strong>Purpose:<\/strong> to assess the application and get back to you.<\/li>\n<li><strong>Legal basis:<\/strong> pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).<\/li>\n<li><strong>Retention:<\/strong> the data is anonymised after 48 months.<\/li>\n<li><strong>If you do not provide it:<\/strong> we cannot assess the application.<\/li>\n<\/ul>\n<h4>2.4 Event reservations and accreditation<\/h4>\n<ul>\n<li><strong>Data:<\/strong> first and last name, email, phone number, name of the establishment or company, date of attendance.<\/li>\n<li><strong>Purpose:<\/strong> to manage the reservation or accreditation and send any confirmation.<\/li>\n<li><strong>Legal basis:<\/strong> carrying out your request to attend (Art. 6(1)(b) GDPR).<\/li>\n<li><strong>Retention:<\/strong> the data is anonymised after 48 months.<\/li>\n<li><strong>If you do not provide it:<\/strong> we cannot register your attendance.<\/li>\n<\/ul>\n<h4>2.5 Exhibiting wineries: company details and invitations<\/h4>\n<p>Wineries access their reserved area through a personal link received by email.<\/p>\n<ul>\n<li><strong>Data:<\/strong> company and trading name, VAT number or tax code, registered office, SDI recipient code, contact person, phone number, email; response to the invitation and any reason for declining; dates of sending, response and last access; IP address of the last access; the organising office&#8217;s internal notes. Company data becomes personal data when it relates to an individual, such as the contact person or a sole proprietor.<\/li>\n<li><strong>Purpose:<\/strong> to invite the winery, manage its participation, send reminders and communications, and handle administration and invoicing.<\/li>\n<li><strong>Legal basis:<\/strong> performance of the contract and pre-contractual steps (Art. 6(1)(b) GDPR); legal invoicing obligations (Art. 6(1)(c) GDPR); our legitimate interest in inviting wineries to future editions and in knowing who was invited and when they replied (Art. 6(1)(f) GDPR). You can object to invitations at any time.<\/li>\n<li><strong>Retention:<\/strong> company and contact details for as long as the winery remains in our address book; invitation statuses, dates and IP address for three editions.<\/li>\n<li><strong>If you do not provide it:<\/strong> the winery cannot take part.<\/li>\n<\/ul>\n<h4>2.6 Catalogue materials<\/h4>\n<ul>\n<li><strong>Data:<\/strong> description, wines declared, logo and photograph uploaded by the winery.<\/li>\n<li><strong>Purpose:<\/strong> to print the catalogue and publish the winery&#8217;s profile on the website. This content becomes public: if the photograph shows recognisable people, the winery must have informed them before uploading it.<\/li>\n<li><strong>Legal basis:<\/strong> performance of the contract (Art. 6(1)(b) GDPR).<\/li>\n<li><strong>Retention:<\/strong> the current edition and the following one. Catalogues already printed cannot be recalled, and the winery&#8217;s name may remain in the historical archive of editions published on the website.<\/li>\n<li><strong>If you do not provide it:<\/strong> the catalogue entry may be incomplete.<\/li>\n<\/ul>\n<h4>2.7 Contract signed online<\/h4>\n<ul>\n<li><strong>Data:<\/strong> exhibitor details, name and role of the signatory, chosen package, signature drawn on screen (simple electronic signature), date and time of signing, IP address and browser. The contract is archived as a PDF together with its SHA-256 fingerprint, which makes it possible to verify that the document has not been altered.<\/li>\n<li><strong>Purpose:<\/strong> to conclude the contract and be able to prove its content and signature.<\/li>\n<li><strong>Legal basis:<\/strong> performance of the contract (Art. 6(1)(b) GDPR); statutory retention obligations (Art. 6(1)(c) GDPR); our legitimate interest in proving the signature and defending ourselves in a dispute (Art. 6(1)(f) GDPR). Your consent is not required: a link to this notice is available in the reserved area and in our emails.<\/li>\n<li><strong>Retention:<\/strong> 10 years from signing (Art. 2220 of the Italian Civil Code). Until then the signed contract cannot be erased, even on request.<\/li>\n<li><strong>If you do not provide it:<\/strong> the contract cannot be concluded.<\/li>\n<\/ul>\n<h4>2.8 Personal tickets: stand staff and complimentary guests<\/h4>\n<ul>\n<li><strong>Data:<\/strong> first name, last name, email, ticket type, day, associated winery, ticket code with its QR code, date the confirmation was sent, date and time of entry.<\/li>\n<li><strong>Purpose:<\/strong> to issue tickets, send each person the confirmation email with the entry QR code, check admission to the event, including by means of a back-up list, and handle replacements and cancellations.<\/li>\n<li><strong>Legal basis:<\/strong> our legitimate interest in organising an event with personal, controlled admission (Art. 6(1)(f) GDPR).<\/li>\n<li><strong>Retention:<\/strong> 12 months after the end of the event. If you request erasure, the ticket is removed; if it has already been used, it is kept for the same period as a record of entry.<\/li>\n<li><strong>If the data is not provided:<\/strong> the ticket cannot be issued.<\/li>\n<\/ul>\n<p>This data reaches us from the winery: please also read section 3.<\/p>\n<h4>2.9 Log of emails and activities<\/h4>\n<ul>\n<li><strong>Data:<\/strong> for each email, recipient, subject, type, date and outcome; the text containing the personal link is deleted as soon as the email is sent. For each winery, a log of operations: what was done, by whom and when, with the IP address if the operation came through the personal link.<\/li>\n<li><strong>Purpose:<\/strong> to check that communications have arrived and to reconstruct events in a dispute.<\/li>\n<li><strong>Legal basis:<\/strong> our legitimate interest (Art. 6(1)(f) GDPR).<\/li>\n<li><strong>Retention:<\/strong> email log for the current edition; log of operations for three editions.<\/li>\n<\/ul>\n<h4>2.10 Tickets for visitors<\/h4>\n<p>Tickets for the public are sold on the external Clappit platform, which you reach through the links on the website. Data entered there, including payment data, is processed by the platform operator under its own privacy notice. The Vinaltum website does not collect payment data.<\/p>\n<h4>2.11 Cookies and external services<\/h4>\n<ul>\n<li><strong>Technical cookies.<\/strong> They keep the website working: language, form session, and storing your cookie choice. They do not require consent.<\/li>\n<li><strong>Statistics: Google Analytics 4<\/strong> (Google Ireland Limited). It measures visits to the website. It runs only with your consent (Art. 6(1)(a) GDPR).<\/li>\n<li><strong>Advertising: Meta Pixel<\/strong> (Meta Platforms Ireland Limited), loaded through Google Tag Manager. It measures the effectiveness of campaigns on Facebook and Instagram and allows ads to be shown to people who have visited the website. It runs only with your consent (Art. 6(1)(a) GDPR).<\/li>\n<li><strong>Cookie banner: CookieYes<\/strong> (CookieYes Limited). It displays the banner and records your choice in pseudonymised form, as evidence of consent (Art. 6(1)(c) GDPR).<\/li>\n<li><strong>Fonts: Google Fonts<\/strong> (Google Ireland Limited). Your browser downloads the fonts from Google&#8217;s servers, which receive your IP address.<\/li>\n<li><strong>Map: Google Maps<\/strong> (Google Ireland Limited). The Contacts page shows a map provided by Google, which receives your IP address.<\/li>\n<li><strong>Instagram.<\/strong> The website displays content from our profile and contains links to Instagram. If you open a link, your data is processed by Meta under its own privacy notice.<\/li>\n<\/ul>\n<p>You can give, refuse or withdraw consent at any time from the cookie banner icon. Withdrawal does not affect processing already carried out. The list of cookies and their duration is <a href=\"#cookie\">at the bottom of this page<\/a>. More details: <a href=\"https:\/\/policies.google.com\/privacy\" target=\"_blank\" rel=\"noopener\">Google<\/a>, <a href=\"https:\/\/www.facebook.com\/privacy\/policy\" target=\"_blank\" rel=\"noopener\">Meta<\/a>.<\/p>\n<h3>3. If you did not provide your data yourself (Art. 14 GDPR)<\/h3>\n<p><strong>Stand staff and complimentary guests.<\/strong> Your first name, last name and email are given to us by the winery that named you, so that you can receive a ticket. Before entering them, the winery must inform you and make this page known to you, and it declares that it has done so by ticking a box in the reserved area: the winery itself is responsible for this disclosure, as an independent controller. You will receive a confirmation email from us with a link to this notice. If you do not want the ticket or believe your data is wrong, write to <a href=\"mailto:segreteria@vinaltum.it\">segreteria@vinaltum.it<\/a>.<\/p>\n<p><strong>Winery contact persons.<\/strong> Contact details may come from the winery itself, from previous editions or from <mark style=\"background:#ffe600;color:#000;padding:0 .2em\">[TO BE CONFIRMED: other sources of winery contacts]<\/mark>.<\/p>\n<h3>4. Who may receive the data<\/h3>\n<ul>\n<li>Staff and collaborators of the Vinaltum organising office, who are authorised and limited to what they need.<\/li>\n<li>Technical and hosting providers, and providers of email and website maintenance services, appointed as data processors (Art. 28 GDPR).<\/li>\n<li>Administrative, tax and legal advisers where necessary, and the printer of the catalogue, for the winery&#8217;s materials only.<\/li>\n<li>The winery that named a person for a ticket, which can see the data it entered and the status of the ticket.<\/li>\n<li>Google, Meta, CookieYes and Clappit, for the services described in section 2.<\/li>\n<li>Public authorities, where required by law.<\/li>\n<li>The public, only for the materials published in the catalogue and on the website (section 2.6).<\/li>\n<\/ul>\n<p>We do not sell personal data. The up-to-date list of data processors is available from the controller on request.<\/p>\n<h3>5. Where the data is and transfers outside the European Union<\/h3>\n<p>The website and the wineries&#8217; reserved area are hosted on servers located in the European Union. Some providers may also process data outside the EU:<\/p>\n<ul>\n<li><strong>United States:<\/strong> Google, Meta and the provider of the website&#8217;s security system. The transfer relies on the EU-US adequacy decision (Data Privacy Framework), for certified entities, or on the European Commission&#8217;s standard contractual clauses.<\/li>\n<li><strong>United Kingdom:<\/strong> CookieYes. The transfer relies on the European Commission&#8217;s adequacy decision.<\/li>\n<\/ul>\n<p>You can ask the controller for information about these safeguards.<\/p>\n<h3>6. Your rights<\/h3>\n<p>By writing to <a href=\"mailto:segreteria@vinaltum.it\">segreteria@vinaltum.it<\/a> you can request at any time:<\/p>\n<ul>\n<li>access to your data and a copy of it (Art. 15 GDPR);<\/li>\n<li>rectification of inaccurate data (Art. 16);<\/li>\n<li>erasure, except for data we must keep by law or to defend a legal claim, such as signed contracts (Art. 17);<\/li>\n<li>restriction of processing (Art. 18);<\/li>\n<li>portability of the data you provided, where processing is based on contract or consent (Art. 20);<\/li>\n<li><strong>objection to processing based on legitimate interest<\/strong>, including invitations to future editions (Art. 21);<\/li>\n<li>withdrawal of consent, if given, without affecting processing already carried out.<\/li>\n<\/ul>\n<p>We reply within one month. We do not take decisions based solely on automated processing that produce legal effects concerning you.<\/p>\n<h3>7. Complaint to the supervisory authority<\/h3>\n<p>If you believe your data is being processed in breach of the GDPR, you can lodge a complaint with the Italian supervisory authority, the <a href=\"https:\/\/www.garanteprivacy.it\" target=\"_blank\" rel=\"noopener\">Garante per la protezione dei dati personali<\/a>, or with the authority of the EU country where you live or work.<\/p>\n<h3>8. Changes to this notice<\/h3>\n<p>We may update this page when our processing changes. The date at the top shows the version in force.<\/p>\n<p><strong id=\"cookie\">COOKIE LIST<\/strong><\/p>\n<div class=\"cky-audit-table-element\"> <\/div>\n<\/div>\n<\/div><\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","meta":{"footnotes":""},"class_list":["post-323","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.vinaltum.it\/en\/wp-json\/wp\/v2\/pages\/323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.vinaltum.it\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.vinaltum.it\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.vinaltum.it\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.vinaltum.it\/en\/wp-json\/wp\/v2\/comments?post=323"}],"version-history":[{"count":5,"href":"https:\/\/www.vinaltum.it\/en\/wp-json\/wp\/v2\/pages\/323\/revisions"}],"predecessor-version":[{"id":1427,"href":"https:\/\/www.vinaltum.it\/en\/wp-json\/wp\/v2\/pages\/323\/revisions\/1427"}],"wp:attachment":[{"href":"https:\/\/www.vinaltum.it\/en\/wp-json\/wp\/v2\/media?parent=323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}