Privacy policy
What data we collect when you order or write to us, why we use it, who we share it with, how long we keep it and what you can do about it.
1. Data controller
This privacy policy is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and covers the personal data collected through this site, the Brugnera farm shop and the producer's contact channels.
- Controller
- Qualità Artigiana S.R.L.
- Registered office
- Viale Europa 24, 33070 Brugnera (PN), Italy
- VAT number
- 01816010936
- Privacy email
- info@alessiobrusadin.it
- Phone
- +39 333 499 3767
2. What data we process
- Personal and contact details: first name, surname, delivery and billing address, email, phone number.
- Order data: products bought, amounts, date, payment method, tracking number, messages with customer service.
- Tax data: tax code, VAT number and recipient code, when you ask for an invoice.
- Payment data: card details are never visible to or kept by the controller, because payment takes place on the provider's systems. We only receive the outcome of the transaction and the minimum details needed to identify it.
- Browsing data: IP address, browser and device type, pages visited, times. They are collected by the site's IT systems and by the cookies described in the cookie policy.
- Confirmation that you are over 18, when the order includes alcoholic drinks.
We do not knowingly process data of anyone under 18. We do not ask for and do not wish to receive special categories of data, such as health data: any information about allergies or intolerances written spontaneously in the order notes is processed only to answer the request and deleted as soon as the request has been dealt with.
3. Purposes and legal bases
| Purpose | Legal basis | Consequences of refusal |
|---|---|---|
| Managing the order, delivery and support | Performance of the contract, art. 6.1.b GDPR | The purchase cannot be completed |
| Invoicing, accounting and tax obligations | Legal obligation, art. 6.1.c GDPR | The document cannot be issued |
| Verifying that you are over 18 for alcohol | Legal obligation, art. 6.1.c GDPR | An order containing alcohol cannot be accepted |
| Replying to enquiries from the contact form or WhatsApp | Pre-contractual measures and legitimate interest, art. 6.1.b and 6.1.f | No reply is possible |
| Newsletter and marketing communications | Consent, art. 6.1.a GDPR | None: the purchase is still possible |
| Site usage statistics | Consent, art. 6.1.a (the site collects no statistics today) | None |
| Site security and fraud prevention | Legitimate interest, art. 6.1.f GDPR | None |
| Defending a right in court | Legitimate interest, art. 6.1.f GDPR | None |
If you are already a customer we may send you messages about products similar to those you bought, under the rules on so-called soft spam: you can object at any time, using the link in every message or by writing to us.
4. Whether data is mandatory
The data marked as mandatory in the forms is needed to perform the contract or to comply with a legal obligation: without that data the order or the reply is not possible. All other data is optional and not providing it has no consequences.
5. Who we share the data with
The data is processed by the controller's authorised staff and may be shared with the parties that provide services we need, appointed as data processors under art. 28 GDPR:
| Category | Data involved |
|---|---|
| Site hosting (Lovable, on Cloudflare infrastructure) | Technical browsing data |
| Database of requests sent through the forms (Supabase) | Name, email, phone, message |
| E-commerce platform and checkout (Shopify) | Orders, shipping data and accounts |
| Payment service providers shown in the Shopify checkout | Transaction data |
| Courier and logistics | Name, address, phone |
| Sending service emails (Resend) | Email and request content |
| Chat assistant (Dimmi) | Messages written in the chat |
| Accountant and advisers | Tax and accounting data |
The data may also be disclosed to authorities and supervisory bodies when the law requires it. It is never sold or passed to third parties for their own marketing purposes.
6. Transfers outside the European Union
The data is normally processed within the European Economic Area. Some providers may process it in third countries: in that case the transfer is based on an adequacy decision of the European Commission or on the standard contractual clauses, with supplementary measures where necessary.
7. How long we keep the data
| Type of data | Retention period |
|---|---|
| Tax and accounting documents | 10 years, as required by law |
| Newsletter subscription | Until consent is withdrawn |
Other data is kept only for as long as needed for the purpose it was collected for, and then deleted.
When that period ends the data is erased or made anonymous, unless it has to be kept to defend a right in court, for the time strictly necessary.
8. Your rights
At any time you can exercise the rights set out in Articles 15 to 22 of the GDPR:
- Access: to know which data we process and to obtain a copy of it.
- Rectification: to correct inaccurate data or complete it.
- Erasure: to ask for the data to be removed, when we have no obligation or need to keep it.
- Restriction: to ask us to suspend the processing in the cases allowed by law.
- Portability: to receive the data in a machine-readable format, or have it sent to another controller.
- Objection: to object to processing based on legitimate interest and, at any time and without giving a reason, to direct marketing.
- Withdrawal of consent: to withdraw consent already given, without affecting the lawfulness of the processing carried out before the withdrawal.
To exercise them write to info@alessiobrusadin.it or to Qualità Artigiana S.R.L., Viale Europa 24, 33070 Brugnera (PN). We reply within one month of the request, extendable by two months in complex cases, and we will let you know if that happens.
9. Complaint to the Garante
If you believe that the processing of your data breaches the law, you can lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority), Piazza Venezia 11, 00187 Roma, or apply to the courts. Information and forms are at garanteprivacy.it (opens in a new tab).
10. Automated decisions
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly affect you, apart from the anti-fraud checks carried out by the payment providers as part of their security procedures.
11. Data security
We take appropriate technical and organisational measures to protect the data from unauthorised access, loss or disclosure: an encrypted connection on the site, named accounts limited to authorised staff, regular backups, systems kept up to date.
12. Cookies
The site uses cookies and similar technologies. The types, providers, durations and how to change your preferences are described in the cookie policy.
13. Updates
This policy may be updated because of changes in the law or in the service. The version in force is always the one published on this page, with the last updated date shown at the top. If the changes are significant, we will let you know using the contact details you have given us.