Privacy policy

PRIVACY POLICY

Pursuant to articles 13 and 14 of Regulation (EU) 2016/679

Last update: 15 July 2026

1. Introduction

This Policy describes the ways in which Podere Cavàga collects, uses, stores and communicates the personal data of users who:

  • visit the cavaga.it website;
  • create or use an account;
  • purchase products;
  • purchase or use gift cards;
  • book stays, tastings, events or other experiences;
  • request information or assistance;
  • subscribe to the newsletter;
  • require membership of the Cavàga Members program;
  • participate in initiatives, events or promotions;
  • interact with Podere Cavàga through email, telephone, social networks or other channels.

This Policy is provided under Regulation (EU) 2016/679, hereinafter “GDPR”, Legislative Decree no. 196 of 30 June 2003, as amended, and applicable Italian legislation on personal data protection and electronic communications.

Specific information may be provided in relation to particular services, events, competitions, photographic recordings, video surveillance systems or further processing.

2. Data controller

The Data Controller is:

Podere della Cavaga S.r.l. Società Agricola
Registered office: Via Gafforelli 1, 24060 Foresto Sparso (BG), Italy
VAT number: 00602690166
Tax code: 80023050166
REA: BG-159525
PEC: poderecavagasrl@legalmail.it
Email for privacy issues: direzione@cavaga.it
Telephone: +39 035 930939

In this document, “Podere Cavàga”, “Cavàga”, “we”, “us” and “our” refer to the Data Controller.

3. Categories of personal data processed

The data collected depends on the service requested and the ways in which the user interacts with Podere Cavàga.

3.1 Identification and contact data

We may process:

  • name and surname;
  • date of birth or confirmation of age of majority;
  • residential, billing or shipping address;
  • email address;
  • telephone number;
  • language and country of origin;
  • any company or organization you belong to;
  • professional role;
  • VAT number and tax code;
  • recipient code or PEC address.

3.2 Account and authentication data

When an account is created, we may process:

  • email address;
  • account identifier;
  • secure credentials or other authentication elements;
  • access history;
  • saved preferences;
  • associated addresses;
  • orders and reservations linked to the account.

Passwords are not normally knowable in clear text by Podere Cavàga.

3.3 Order and purchase data

We may process:

  • purchased products;
  • quantities and amounts;
  • order number and date;
  • delivery method;
  • shipping address;
  • billing data;
  • payment status;
  • returns, replacements and refunds;
  • promotional codes;
  • gift cards used;
  • communications relating to the order;
  • any disputes or requests for assistance.

3.4 Payment data

Payments are handled through Shopify and specialized providers.

Podere Cavàga can receive:

  • confirmation of payment;
  • amount;
  • currency;
  • payment method used;
  • transaction identifier;
  • outcome of the authorization;
  • last digits or partial information of the payment instrument, when made available by the operator.

Podere Cavàga does not receive and does not normally store the complete card number, security code or complete payment services credentials.

3.5 Data relating to stays and hospitality

For reservations and stays we can collect:

  • booking holder data;
  • names of guests;
  • arrival and departure dates;
  • number and type of guests;
  • room or living room preferences;
  • special requests;
  • information necessary for check-in;
  • identity document details;
  • citizenship, place and date of birth;
  • data required by public safety regulations;
  • data necessary for administrative, fiscal and statistical obligations;
  • information relating to payments, cancellations and ancillary services.

Guests must be identified according to current legislation. The data required by law can be communicated to the competent authorities through the systems provided for the accommodation facilities.

Except for specific obligations, Podere Cavàga avoids keeping full copies of identity documents beyond the time strictly necessary for identification and applicable obligations.

3.6 Data relating to experiences, catering and events

For tastings, visits, dinners, picnics, tours, events, relaxation areas or other experiences we may process:

  • names of participants;
  • number of participants;
  • date and time of the reservation;
  • organizational preferences;
  • event-related requests;
  • information necessary for the provision of the service;
  • data relating to cancellations, modifications and payments;
  • any accessibility needs;
  • any allergies or intolerances communicated voluntarily.

3.7 Data relating to allergies, intolerances and health

Information relating to allergies, intolerances, disabilities or particular needs may constitute special categories of personal data pursuant to article 9 GDPR.

This data is collected only when:

  • are communicated voluntarily by the data subject;
  • are necessary to adapt the service;
  • the processing is based on the explicit consent of the data subject or on another condition established by law.

Customers who disclose health information about other participants declare that they are authorised to do so and have informed those participants about the processing.

This data is not used for commercial or profiling purposes.

3.8 Data relating to age of majority

Since the Site sells wine, spirits and other alcoholic products, we may process information necessary to verify that the buyer or recipient is at least eighteen years old.

Verification may include:

  • declaration of age;
  • date of birth;
  • document verification upon delivery or access to a service;
  • outcome of the verification carried out by the courier or staff.

Unless specifically needed, a copy of the document used to verify age is not kept.

3.9 Data relating to Cavàga Members and B2B relationships

For requests to join the Cavàga Members program or for relationships with companies, restaurants, wine shops, distributors and professionals we may process:

  • contact details;
  • company data;
  • role and function;
  • professional addresses;
  • VAT number and tax data;
  • activity carried out;
  • reasons for the request;
  • history of commercial relationships;
  • reserved conditions;
  • orders and reservations;
  • assessments necessary for admission to the program;
  • correspondence and requests for assistance.

3.10 Data provided through contacts and support

When you contact us, we may process:

  • data present in the message;
  • email address or telephone number;
  • requests, complaints and reports;
  • photographs and videos submitted to document problems;
  • information relating to orders, products or services;
  • any attachments;
  • correspondence history.

The user is invited not to communicate unnecessary data or particularly confidential information, except when essential.

3.11 Newsletter and marketing data

We can collect:

  • name, when required;
  • email address;
  • telephone number, if applicable;
  • date, time and method of registration;
  • proof of consent;
  • language and preferences;
  • interactions with communications, such as opening or selecting links, when permitted;
  • revocations, oppositions and unsubscriptions.

3.12 Navigation data and technical information

While browsing the following may be automatically collected:

  • IP address;
  • online identifiers;
  • device type;
  • operating system;
  • browser type and version;
  • language;
  • approximate geographic area;
  • date and time of the visit;
  • pages visited;
  • origin of visit;
  • interactions with the Site;
  • products displayed;
  • cart and checkout data;
  • technical logs;
  • security events;
  • cookie preferences.

This information is collected through logs, cookies, pixels, tags, similar tools and technologies made available by Shopify or other suppliers.

3.13 Data from social networks and external platforms

When the user interacts with Podere Cavàga social profiles or uses features connected to external platforms, we may receive:

  • profile name;
  • username;
  • public image;
  • comments, reactions and messages;
  • shared content;
  • information made available based on social network settings.

Social platforms also process data according to their own information.

4. Data source

Data can be collected:

  • directly from the data subject;
  • by the holder of an order or reservation;
  • from an attendee booking for other people;
  • from authorized agencies, intermediaries or partners;
  • through Shopify;
  • from payment processors;
  • from couriers and logistics operators;
  • from reservation systems;
  • from social platforms;
  • from analysis and advertising tools, with prior consent when necessary;
  • from publicly accessible sources, limited to B2B professional relationships;
  • by public authorities or subjects, when required by law.

When data are provided by a person other than the data subject, the person communicating them must ensure that they are entitled to do so and, when necessary, inform the data subject.

5. Purpose, legal bases and nature of the provision

5.1 Navigation and technical operation of the Site

Purpose

  • make the Site accessible;
  • manage session, cart, checkout and account;
  • maintain technical preferences;
  • prevent errors and malfunctions;
  • ensure security and continuity of service.

Legal basis

  • execution of measures requested by the user;
  • legitimate interest of Podere Cavàga in the safe and efficient management of the Site;
  • fulfillment of legal obligations, when applicable.

The provision of the necessary technical data is automatic. Their failure to process may prevent the correct functioning of the Site.

5.2 Management of orders and sales

Purpose

  • receive and confirm the order;
  • process payment;
  • prepare and ship products;
  • send service communications;
  • manage returns, refunds, replacements and complaints;
  • verify age of majority;
  • provide assistance;
  • manage any gift cards.

Legal basis

  • execution of the contract or pre-contractual measures;
  • compliance with legal obligations;
  • legitimate interest in the prevention of fraud and the protection of rights.

The provision of the requested data is necessary. Without this data it is not possible to conclude or execute the order.

5.3 Management of stays, reservations and experiences

Purpose

  • process requests and reservations;
  • check availability;
  • organize stays, catering, tastings and experiences;
  • customize the requested service;
  • manage payments, changes and cancellations;
  • fulfill guest obligations;
  • provide assistance before, during and after service.

Legal basis

  • execution of pre-contractual measures;
  • execution of the contract;
  • compliance with legal obligations;
  • legitimate interest in the correct organization and protection of the service.

The data marked as mandatory is necessary to manage the reservation.

5.4 Guest identification and communication

Purpose

  • identify hosts;
  • carry out the communications required by public safety regulations;
  • comply with applicable administrative and statistical obligations.

Legal basis

  • fulfillment of a legal obligation to which the Owner is subject.

The provision is mandatory. Otherwise, Podere Cavàga may not be able to provide accommodation.

5.5 Management of allergies and special needs

Purpose

  • adapt menus, activities or services;
  • protect the safety of the data subject;
  • manage any emergencies or incidents.

Legal basis

  • explicit consent of the data subject;
  • protection of vital interests, in the exceptional cases provided for by law;
  • establishment, exercise or defense of a right, when necessary.

The provision is optional, but failure to communicate may prevent Podere Cavàga from making specific adaptations.

5.6 Assistance, requests and complaints

Purpose

  • respond to requests;
  • provide information;
  • prepare estimates;
  • manage complaints and reports;
  • resolve problems with products or services.

Legal basis

  • execution of pre-contractual or contractual measures;
  • legitimate interest in providing assistance and correctly managing relationships with customers and users;
  • compliance with legal obligations.

5.7 Account management

Purpose

  • create and maintain the account;
  • allow access to confidential information;
  • show orders, addresses and reservations;
  • ensure credential security.

Legal basis

  • execution of the contract;
  • legitimate interest in systems security.

5.8 Cavàga Members and professional relationships

Purpose

  • evaluate membership requests;
  • verify requirements;
  • manage confidential commercial conditions;
  • maintain relationships with members, distributors and operators;
  • organize dedicated events and initiatives;
  • send communications strictly related to the program.

Legal basis

  • execution of pre-contractual measures;
  • execution of the contractual relationship;
  • legitimate interest in the management and development of professional relationships;
  • consent, for promotional communications not strictly necessary for the relationship.

Admission to the program may include an assessment carried out by Podere Cavàga staff. No exclusively automated decisions are adopted that produce legal effects on the data subject.

5.9 Newsletter and promotional communications

Purpose

  • send newsletter;
  • communicate news, offers, events, products, stays and experiences;
  • invite the user to promotional initiatives;
  • measure the effectiveness of communications, when permitted.

Legal basis

  • consent of the data subject.

Registration is optional and does not affect the possibility of purchasing or using other services.

Consent can be revoked at any time:

Revocation does not affect the lawfulness of the processing carried out before the revocation.

Podere Cavàga may send its customers email communications relating to products or services similar to those already purchased only in the cases and within the limits permitted by law, always offering the possibility to object free of charge.

5.10 Reminders for incomplete carts or reservations

Podere Cavàga may send communications strictly related to a cart, checkout or booking process that has been started and not completed.

Legal basis

  • execution of measures requested by the user;
  • legitimate interest in facilitating the completion of the operation and resolving any technical problems.

When the communication takes on an autonomously promotional nature, consent is used where required.

The data subject can object at any time.

5.11 Statistical analysis and improvement of services

Purpose

  • understand the use of the Site;
  • improve navigation, content and offers;
  • develop aggregate statistics;
  • measure store and campaign performance.

Legal basis

  • legitimate interest, when the data is aggregated, anonymized or collected using tools comparable to technical ones;
  • consent, when non-necessary cookies or identifiers that allow user tracking are used.

5.12 Personalized advertising and commercial profiling

Subject to consent, data relating to browsing, purchases and interactions can be used to:

  • create audiences;
  • propose content consistent with the interests identified;
  • display personalized advertising;
  • measure advertising campaigns;
  • link interactions that occurred on different devices or platforms, where provided by the provider.

Legal basis

  • consent of the data subject.

The user can deny or revoke consent through the cookie preferences panel.

Failure to consent does not prevent the use of the Site or the purchase of products.

5.13 Fraud prevention and security

Purpose

  • verify suspicious transactions;
  • prevent fraud and abuse;
  • protect accounts, systems and payments;
  • establish violations of the Terms and Conditions;
  • manage security incidents.

Legal basis

  • legitimate interest of Podere Cavàga and users in security;
  • fulfillment of legal obligations;
  • establishment, exercise or defense of rights.

5.14 Administrative, fiscal and legal obligations

Purpose

  • issue tax documents;
  • keep accounts;
  • comply with tax obligations;
  • respond to competent authorities;
  • handle disputes;
  • protect the rights of Podere Cavàga.

Legal basis

  • compliance with legal obligations;
  • legitimate interest in the defense of rights.

6. Cookies and tracking tools

The Site uses cookies and similar technologies.

Strictly necessary cookies

They are necessary for:

  • operation of the Site;
  • cart management;
  • authentication;
  • security;
  • checkout;
  • choice of language and country;
  • storing privacy preferences.

They do not require the user's consent, but are described in the cookie information.

Functional cookies

Allow additional functionality and the storage of certain preferences.

When they are not strictly necessary, they are used with your consent.

Statistical or analytical cookies

They are used to measure the use of the Site.

They can be used without consent only when they comply with the conditions established by law to be equated with technical cookies. In other cases they are activated upon consent.

Advertising and profiling cookies

They are used to:

  • measure campaigns;
  • create audiences;
  • display personalized advertising;
  • track you across different sites or services.

They are activated only after the user's consent.

The user can:

  • accept all cookies;
  • reject unnecessary ones;
  • select individual categories;
  • change your choice later.

Preferences must be able to be reopened through a permanent link or command called, for example, “Cookie Preferences” or “Manage Preferences”.

More detailed information on individual cookies, suppliers, duration and purpose is available in the preferences panel or in the dedicated Cookie Policy.

7. Shopify

The online store is hosted and supported by Shopify.

Shopify processes personal data necessary to:

  • host the Site;
  • manage accounts, cart and checkout;
  • process orders;
  • ensure security and fraud prevention;
  • provide technical analysis and functionality;
  • allow the use of Shop Pay, Shop or other services chosen by the user.

For some activities, Shopify acts as a data processor or sub-processor on behalf of Podere Cavàga.

For other services, particularly those provided directly to users through a Shopify, Shop or Shop Pay account, Shopify may process certain data under its own privacy policy and in an independent capacity.

Using Shopify does not automatically lead to the activation of advertising cookies without consent. Podere Cavàga configures the privacy settings and the banner according to the services actually used.

8. Recipients of the data

The data may be communicated, to the extent necessary, to the following categories of recipients:

  • Shopify and its group companies;
  • hosting, cloud, maintenance and cybersecurity providers;
  • payment managers, banks and financial circuits;
  • PayPal, Klarna, Shop Pay and other providers selected by you;
  • couriers, freight forwarders and logistics operators;
  • providers of hospitality reservation and management systems;
  • newsletter, email and communications providers;
  • analytics and advertising providers, subject to consent when required;
  • guides, organizers and suppliers involved in the booked experiences;
  • accounting, tax, legal, insurance and IT consultants;
  • companies that provide assistance or services on behalf of Podere Cavàga;
  • fiscal, administrative, judicial and public security authorities;
  • Police headquarters and authorities responsible for communications relating to guests;
  • subjects to whom communication is necessary to protect the rights of Podere Cavàga;
  • any purchasers or assignees in the context of corporate transactions, in compliance with the law.

Providers processing data on behalf of Podere Cavàga are appointed as data processors under Article 28 GDPR, where required.

Some recipients, such as payment processors, social platforms or public authorities, may operate as independent data controllers.

The updated list of managers can be requested by writing to direzione@cavaga.it.

9. Transfer of data outside the European Economic Area

Some providers, including Shopify and technology or payment operators, may process data in countries outside the European Economic Area.

When an international transfer occurs, Podere Cavàga verifies that it is based on one of the mechanisms provided by the GDPR, including:

  • European Commission adequacy decision;
  • standard contractual clauses;
  • binding corporate rules;
  • recognized certification framework, when applicable;
  • other guarantees provided for by articles 44 and following GDPR.

The data subject can request information on the guarantees applied by contacting the Data Controller.

10. Processing methods and security

The data is processed using paper, IT and telematic tools according to the principles of:

  • lawfulness;
  • correctness;
  • transparency;
  • minimization;
  • accuracy;
  • storage limitation;
  • integrity;
  • confidentiality.

Podere Cavàga applies technical and organizational measures appropriate to the risk, which may include:

  • access control;
  • individual credentials;
  • strengthened authentication;
  • encryption during transmission;
  • backup;
  • systems update;
  • limiting permissions;
  • incident management procedures;
  • selection and verification of suppliers;
  • staff training.

No computer system is completely immune to risk. In case of violation of personal data, Podere Cavàga will apply the procedures established by articles 33 and 34 GDPR.

11. Retention periods

The data are kept for the time necessary for the purposes for which they were collected and, subsequently, to fulfill legal obligations or protect the rights of the parties.

Indicatively:

Accounts

Account data is retained for the life of the account and, after termination, for the period necessary to complete pending transactions and fulfill applicable obligations.

Inactive accounts may be deleted or anonymized after a reasonable period of inactivity, except for order data and legal obligations.

Orders, invoices and accounting documents

They are normally kept for 10 years from the conclusion of the operation or for the different period required by tax and civil legislation.

Returns, complaints and warranty data

They are kept for the time necessary to manage the request and, subsequently, for the period useful for the protection of rights and the management of any disputes.

Requests for information and quotes

They are normally kept for a maximum of 24 months from the last communication, unless a contractual relationship is established or there is a need for further conservation.

Reservations not completed

The data is normally retained for a maximum of 12 months, unless requested by the data subject, consent to further communications or need to protect a right.

Stays, experiences and events

Contractual and accounting data are retained for the period required by law, normally up to 10 years.

Data used exclusively to organize the service is deleted or anonymized when it is no longer needed.

Guest data and identity documents

They are kept only for the time required by the applicable legislation or necessary for the obligations relating to the stay.

Any copies of documents are deleted when no longer necessary, except for legal obligations or disputes.

Allergies, intolerances and other health information

They are kept until the end of the service and, normally, deleted within 30 days, except for accidents, disputes, need to protect the data subject or legal obligations.

Cavàga Members

Unsuccessful requests are normally retained for up to 24 months.

Member data is retained for the duration of the relationship and, subsequently, for the periods required by law or necessary to protect rights.

Newsletter and marketing

Data is processed until:

  • upon withdrawal of consent;
  • in opposition;
  • upon unsubscription;
  • or, in the absence of interactions, for a maximum indicative period of 24 months from the last significant interaction.

Podere Cavàga may retain the minimum information necessary to document consent, revocation or opposition for the time required to demonstrate compliance with the law.

Browsing data and security logs

Technical logs are normally retained for a period of between 6 and 12 months, unless necessary for investigation, security or judicial protection.

Cookies

The duration of individual cookies is indicated in the cookie preferences panel.

Upon expiration of the applicable periods, the data is deleted, anonymized or stored only when required by law.

12. Minors

The Site and the sale of alcoholic products are not intended for persons under the age of eighteen.

Podere Cavàga does not intend to knowingly collect data from minors for commercial purposes without an adequate legal basis and, when necessary, without the authorization of those exercising parental responsibility.

The data of minors who participate in stays, events or activities may be processed when provided by parents, guardians or legitimated subjects and to the extent necessary to organize and provide the service.

If a parent or guardian believes that a child's data has been improperly collected, they can contact direzione@cavaga.it.

13. Automated decision-making processes and profiling

Podere Cavàga does not adopt decisions based exclusively on automated processing that produces legal effects or similarly significantly affects the data subject.

Subject to consent, limited commercial segmentation or profiling activities may be carried out, based for example on:

  • products displayed;
  • previous purchases;
  • interactions with the Site;
  • preferences;
  • responses to communications;
  • approximate geographic area.

These activities are intended to personalize content, offers or advertising.

The data subject can revoke consent through the cookie preferences or by contacting the Data Controller.

14. Third Party Links and Services

The Site may contain links or integrations with:

  • social networks;
  • maps;
  • partner sites;
  • payment platforms;
  • reservation systems;
  • review services;
  • multimedia content;
  • experience providers.

When the user accesses an external service, the processing is also governed by the information of the relevant supplier.

Podere Cavàga does not control the processing methods operated independently by third-party sites or platforms.

15. Rights of the data subject

In the cases provided for by the GDPR, the data subject can exercise the following rights:

Access

Obtain confirmation as to whether or not processing is underway and receive information on the data processed.

Rectification

Request the correction or integration of inaccurate or incomplete data.

Erasure

Request the deletion of data in the cases provided for by article 17 GDPR.

Restriction

Request that the processing be temporarily limited in the cases provided for by article 18 GDPR.

Data portability

Receive the data provided in a structured, commonly used and machine-readable format and, where technically possible, transmit it to another data controller.

Objection

Object to processing based on legitimate interest for reasons related to your particular situation.

Opposition to direct marketing can be exercised at any time and does not require justification.

Withdrawal of consent

Revoke the consent given at any time, without prejudice to the lawfulness of the previous processing.

Automated decisions

Obtain human intervention and contest an exclusively automated decision in the cases provided for by article 22 GDPR.

Complaint

Lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the competent supervisory authority in the EU Member State where the data subject lives, works or believes the infringement occurred.

The exercise of rights is free, except for manifestly unfounded or excessive requests.

16. How to exercise your rights

Requests can be sent to:

Email: direzione@cavaga.it PEC: poderecavagasrl@legalmail.it

or by post to:

Podere della Cavaga S.r.l. Società Agricola Via Gafforelli 1 24060 Foresto Sparso (BG), Italy

In the subject it is advisable to indicate:

“Privacy request – exercise of GDPR rights”

The request should specify:

  • name and surname;
  • address used to interact with Podere Cavàga;
  • right that you intend to exercise;
  • information necessary to identify the data;
  • any useful documentation.

Podere Cavàga may request additional information to verify the identity of the applicant, avoiding collecting excessive data.

The response will normally be provided within one month, unless extended in complex cases provided for by the GDPR.

17. Changes to this Policy

Podere Cavàga may update this Policy to:

  • regulatory changes;
  • changes in services;
  • introduction or removal of suppliers;
  • changes in processing modalities;
  • security needs;
  • indications from the competent authorities.

The updated version will be published on the Site with the indication of the date of the last update.

In the event of significant changes, data subjects may be informed through the Site, account or available contact details, when required by law.

18. Contacts

For questions, requests or reports relating to the processing of personal data:

Podere della Cavaga S.r.l. Società Agricola Via Gafforelli 1 24060 Foresto Sparso (BG), Italy

Privacy email: direzione@cavaga.it PEC: poderecavagasrl@legalmail.it Telephone: +39 035 930939