Privacy Policy

Last updated: October 2026

This Privacy Policy explains how personal data are collected and processed through the website www.winetastingcasarossa.it, in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable Italian data protection legislation.

1. Data Controller

The Data Controller is:

AZIENDA AGRICOLA PODERE LA CASA ROSSA DI CHITI ALESSANDRO
VAT No. IT00608580528
Località Monteoliveto 14
53037 San Gimignano (SI), Italy

Email: poderelacasarossa@libero.it

2. Personal Data We Process

Depending on how you use the website, we may process:

  • name and surname;

  • email address;

  • telephone number;

  • selected experience;

  • booking date and time;

  • number of participants;

  • age-category information where relevant to pricing;

  • booking status;

  • information voluntarily entered in booking forms, contact forms or messages;

  • dietary requirements, allergies or intolerances, where voluntarily provided;

  • technical information relating to website access and navigation;

  • referring website, referral source or campaign information;

  • communications exchanged in connection with a booking or enquiry.

3. Booking Management and Provision of Services

Personal data are processed in order to:

  • receive and manage reservations;

  • confirm, modify or cancel bookings;

  • communicate with customers;

  • organise and provide wine tastings, winery visits, wine picnics and related experiences;

  • manage participant numbers and dietary requirements;

  • respond to customer requests;

  • manage administrative matters connected with the service.

The legal basis is the performance of a contract or steps taken at the customer’s request prior to entering into a contract pursuant to Article 6(1)(b) GDPR.

4. Online Booking System – Amelia

The website uses Amelia to manage online reservations.

When a customer completes a booking, information entered into the booking form is stored in the website’s WordPress database.

This may include:

  • name and surname;

  • email address;

  • telephone number;

  • selected experience;

  • selected date and time;

  • number of participants;

  • booking status;

  • additional information voluntarily provided by the customer.

Bookings successfully submitted through the website may be automatically confirmed according to the availability configured in the booking system.

These data are used to manage the reservation and provide the requested service.

5. Contact Forms and Enquiries

If you contact Podere La Casa Rossa through the website, by email or through a contact form, the information provided will be processed in order to respond to your request.

Where the request relates to a possible booking or service, the legal basis is Article 6(1)(b) GDPR.

For general enquiries, processing may be based on the legitimate interest of the Data Controller in responding to communications received pursuant to Article 6(1)(f) GDPR.

6. Dietary Requirements, Allergies and Intolerances

Some experiences include food pairings, picnics or other food products.

Customers may voluntarily provide information concerning allergies, food intolerances or dietary requirements.

Such information may constitute special categories of personal data within the meaning of Article 9 GDPR.

These data are processed only where necessary to organise and provide the requested service safely and appropriately.

Customers should provide only information relevant to this purpose.

Such information is not used for marketing or unrelated purposes.

7. Payments

No payment-card information is collected through the website as part of the standard booking process.

Unless otherwise expressly stated, payment for the booked experience is made directly to Podere La Casa Rossa on site.

The website does not store payment-card details.

8. Combined Experiences and Third-Party Providers

Some experiences may include activities provided by independent third-party partners, such as truffle hunting or other local activities.

Where necessary to provide the booked experience, relevant customer information may be communicated to the provider involved.

Only information reasonably necessary to organise and provide the booked service will be shared.

The relevant third-party provider is responsible for the processing of personal data relating to the service it independently provides, according to its own legal role and privacy obligations.

9. Booking Source and Referral Tracking

The website may record information relating to how a customer reached the website or booking process.

This may include:

  • referring website;

  • referral domain;

  • campaign or UTM parameters;

  • booking source;

  • referral type.

This information may be associated with the relevant booking.

It is used for internal administrative, statistical and commercial purposes, including:

  • identifying the source of a booking;

  • evaluating referral and promotional channels;

  • identifying, where applicable, the commercial partner associated with a booking;

  • determining commissions or commercial attribution where applicable.

Where technically possible, booking-source information may be transmitted through the booking flow without persistent cookies.

Where the relevant cookie consent has been provided, the website may also use a first-party attribution cookie to remember the booking source across future visits.

This information is not used for behavioural advertising or cross-site profiling.

10. Website Analytics – SlimStat

The website uses SlimStat Analytics in a privacy-oriented configuration.

In particular:

  • IP addresses are masked;

  • browser fingerprinting is disabled;

  • SlimStat does not set its own tracking cookie;

  • statistical information is stored locally in the website’s WordPress database;

  • analytics data are retained for a maximum of 420 days;

  • archived records are not retained after the applicable retention period;

  • geographic information is limited to country-level data.

SlimStat may process page views, referring websites, browser/device information, operating system, country of origin and technical navigation information.

These data are used to understand website usage, evaluate traffic sources, identify technical issues and improve the website.

11. Hosting – Aruba

The website and its database are hosted through services provided by Aruba S.p.A.

Personal and technical data processed through the website may therefore be stored on the hosting infrastructure used to operate the website.

The hosting provider may process data where necessary for:

  • website and database hosting;

  • security;

  • backups;

  • maintenance;

  • technical operation.

Where applicable, providers processing personal data on behalf of the Data Controller act as processors pursuant to Article 28 GDPR.

12. Email Communications

The website uses email services for communications concerning:

  • booking confirmations;

  • booking changes and cancellations;

  • customer enquiries;

  • availability requests;

  • other service-related communications.

The main email address used by the Data Controller is:

poderelacasarossa@libero.it

13. Technical and Security Data

Technical data may be processed to ensure correct website operation, prevent misuse or unauthorised access, diagnose technical problems and maintain website and booking-system security.

The legal basis is the legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR.

14. Legal, Accounting and Administrative Obligations

Personal data may be processed where necessary to comply with applicable legal, tax, accounting or administrative obligations.

The legal basis is Article 6(1)(c) GDPR.

15. Provision of Personal Data

Information marked as mandatory during booking is necessary to manage the