Privacy policy
This notice describes how the personal data of users visiting the website https://www.vignedifagnano1709.com/ is processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Italian Privacy Code”).
1. Data controller
The data controller is Exad S.r.l.s., with registered office at Via Fontanette 33, 12058 Santo Stefano Belbo (CN), VAT number 04000890048. For any request concerning the processing of personal data, you can write to info@vignedifagnano.com or by certified email (PEC) to exad@confcommercio.legalmail.it.
2. Data Protection Officer (DPO)
The data controller has not appointed a Data Protection Officer (DPO), as none of the cases in which the appointment is mandatory under Art. 37 GDPR applies.
3. Types of data processed
Browsing data. During their normal operation, the computer systems running the website acquire certain data whose transmission is implicit in the use of Internet protocols: for example the IP address, browser type, operating system, pages visited, and the date and time of the request. This data is used to ensure the operation and security of the website.
Data provided voluntarily by the user. When the user fills in the forms on the website, the data entered is processed, such as name, email address and any other information contained in the message. Please do not enter special categories of data (for example health data) in the forms unless strictly necessary.
Cookies and other tracking tools. For information on the cookies and similar tools used by the website, please refer to the Cookie Policy.
4. Purposes, legal bases and retention periods
The data is processed for the purposes indicated below, each based on the corresponding legal basis.
| Purpose | Legal basis | Retention |
|---|---|---|
| Operation and security of the website and prevention of abuse | Legitimate interest of the data controller in ensuring the operation and security of the website (Art. 6(1)(f) GDPR) | 6 months |
| Replying to requests sent through the contact forms | Performance of pre-contractual measures taken at the request of the data subject, or legitimate interest in replying (Art. 6(1)(b) and 6(1)(f) GDPR) | 24 months from the reply |
| Sending the newsletter through the website’s internal system and Mailjet | Consent of the data subject (Art. 6(1)(a) GDPR), which can be withdrawn at any time through the link included in every communication | until unsubscription |
| Sending commercial and promotional communications | Consent of the data subject (Art. 6(1)(a) GDPR), optional and withdrawable at any time | 24 months from consent, unless withdrawn |
| Statistical analysis of website usage | Consent of the data subject (Art. 6(1)(a) GDPR), given through the cookie banner | See the Cookie Policy |
| Protecting forms from automated submissions (spam) | Consent of the data subject (Art. 6(1)(a) GDPR), given through the cookie banner | See the Cookie Policy |
| Analysis, for information purposes, of the data collected through the website using artificial intelligence tools | Legitimate interest of the data controller in understanding the website’s performance and improving its services (Art. 6(1)(f) GDPR) | The same periods that apply to the data processed |
When the periods indicated expire, the data is deleted or anonymised. The data may be kept longer only where necessary to comply with legal obligations or to establish, exercise or defend legal claims.
5. Google services
The website uses services provided by Google (Google Fonts (loaded from a remote server), Google Analytics 4, Google reCAPTCHA, Google Tag Manager / Google tag), which are activated only with the user’s consent when they are not strictly necessary. How these services work, including any advertising features, is described in the Cookie Policy. To find out how Google uses information from sites that use its services, see the page policies.google.com/technologies/partner-sites.
6. Processing methods
The data is processed using electronic and, where necessary, paper-based tools, with appropriate technical and organisational measures to ensure its security and confidentiality, pursuant to Art. 32 GDPR. The data is processed by persons authorised and instructed by the data controller.
7. Recipients of the data
The data may be disclosed to the following parties, which normally act as data processors under a contract with the data controller (Art. 28 GDPR) or, in the cases indicated in their respective notices, as independent controllers:
| Service | Provider | Provider’s notice |
|---|---|---|
| Website hosting provider | Vercel Inc. | Privacy · Cookies |
| Hosting of the content management system (WordPress) | SiteGround | — |
| Google Fonts (loaded from a remote server) | Google Ireland Limited | Notice |
| Adobe Fonts (typefaces) | Adobe Systems Software Ireland Limited | Notice |
| Google Analytics 4 | Google Ireland Limited | Notice |
| Google reCAPTCHA | Google Ireland Limited | Notice |
| Google Tag Manager / Google tag | Google Ireland Limited | Notice |
| Mailjet (newsletter and email) | Mailjet SAS (Sinch group) | Privacy · Cookies |
| Gemini (artificial intelligence system) | Notice |
The data may also be received by consultants and providers assisting the data controller (for example for website maintenance or accounting obligations), as well as by public authorities where required by law. The up-to-date list of data processors can be requested from the data controller.
8. Transfer of data outside the European Economic Area
Some of the providers listed may process data outside the European Economic Area. In these cases, the transfer takes place on the basis of an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified US providers, or of other appropriate safeguards under Articles 45-46 GDPR, such as the Standard Contractual Clauses.
| Service | Provider | Transfer and safeguards |
|---|---|---|
| Gemini | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. | |
| Google Fonts (loaded from a remote server) | Google Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. |
| Adobe Fonts (typefaces) | Adobe Systems Software Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. |
| Google Analytics 4 | Google Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework (certified provider) and by the Standard Contractual Clauses. |
| Google reCAPTCHA | Google Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. |
| Google Tag Manager / Google tag | Google Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. |
| Hosting | Vercel Inc. | Servers in Frankfurt (main region) and nodes of Vercel’s global network, including in the USA and Singapore: EU-US Data Privacy Framework and Standard Contractual Clauses |
9. Whether providing data is mandatory
Providing browsing data is necessary in order to use the website. Providing the data requested in the forms is optional, but the fields marked as mandatory are necessary to handle the request: without them it will not be possible to reply. Consent for marketing purposes and for non-technical cookies is always optional, and refusing it has no consequences on the use of the website.
10. Minors
The website and the services offered are not intended for children under 14, the minimum age in Italy for giving consent on one’s own to the processing of data in relation to online services (Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code). Children under 14 must not provide personal data through the website. If the data controller becomes aware that it has collected data of a child under 14 without the consent of the holder of parental responsibility, it will delete such data without delay. Parents or guardians who believe this has happened can write to info@vignedifagnano.com.
11. Rights of the data subject
The data subject may at any time exercise the rights provided for by Articles 15-22 GDPR:
- access: to know whether and which data is processed and to receive a copy;
- rectification: to correct or complete inaccurate or incomplete data;
- erasure: to obtain the deletion of the data, in the cases provided for;
- restriction: to request that the data only be stored, without any other use, in the cases provided for;
- portability: to receive the data provided in a structured format or have it transmitted to another controller;
- objection: to object to processing based on legitimate interest and, at any time, to direct marketing;
- withdrawal of consent: to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Requests can be sent to info@vignedifagnano.com. The data controller will reply within one month of receipt, a period that may be extended by two further months in particularly complex cases, as provided for by Art. 12 GDPR.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it) or with the supervisory authority of the Member State in which they live or work.
12. Automated decision-making
The data is not subject to decision-making based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them (Art. 22 GDPR).
13. Artificial intelligence
The data controller uses artificial intelligence systems for the purposes described below.
Data analysis for information purposes
The data controller uses artificial intelligence tools to analyse the data collected through the website, such as browsing statistics and the content of the requests received, solely for the data controller’s information: for example, to understand the website’s performance and improve its services. Where possible, the data is analysed in aggregate form or stripped of identifying elements, and it is not used to make decisions that produce legal effects concerning data subjects or similarly significantly affect them.
The tool used is Gemini, provided by Google, which acts as a data processor under the contractual terms of the service.
For processing based on legitimate interest, the data subject may object at any time, on grounds relating to their particular situation, by writing to the data controller (Art. 21 GDPR).
14. Changes to this notice
The data controller may amend this notice, including following changes in legislation or in the services used. Please check this page periodically.
Last updated: 22/10/2026