Wine tasting

---

Pursuant to art. 13 of Legislative Decree no. 196/2003 and articles 13 and 14 of Regulation (EU) no. 679/2016 (“GDPR”)

Corte Canella, with headquarters in Via Canella 14, 37031 Illasi (Verona) – ITALY, VAT number/CF number 03690990233, protects the confidentiality of personal data and guarantees them the necessary protection from any event that could put them at risk of violation.
As required by European Union Regulation no. 679/2016 (“GDPR”), and in particular art. 13, the following information is provided to the user (“Interested Party”) as required by law regarding the processing of their personal data in relation to the website https://www.cortecanella.it/
Who we are and what data we process

(art. 13, 1st paragraph letter a, art. 15, letter b GDPR)

The Data Controller is Corte Canella, with registered office in Via Canella 14, 37031 Illasi (Verona) – ITALY, VAT number/Tax Code 03690990233 – info@cortecanella.it, to whom you may contact at any time to exercise the rights provided for by art. 7 of Legislative Decree 196/2003 and art. 15 GDPR.

Telematic traffic data/Navigation data
Log, IP address of origin. This data is used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning.

Data provided voluntarily by the interested party
The collection of personal data of users/interested parties may occur voluntarily, by sending e-mail to the addresses listed on the site or by sending the electronic forms present on the site by users.

The Data Controller does not require the Data Subject to provide so-called “special” data, that is, as provided for by the GDPR (art. 9), personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data relating to health or sexual life or sexual orientation of the person. In the event that the service requested from the Data Controller requires the processing of such data, the Data Subject will receive specific prior information and will be asked to provide specific consent.
For what purposes do we need the interested party's data?

(art. 13, 1st paragraph GDPR)

The data is used by the Data Controller to follow up on the request for registration and the contract for the supply of the chosen Service and/or purchased Product, manage and execute contact requests forwarded by the Interested Party, provide assistance, fulfill the legal and regulatory obligations to which the Data Controller is bound in relation to the activity carried out. In no case does the Data Controller resell the personal data of the Interested Party to third parties or use them for undeclared purposes.
Communication to third parties and categories of recipients

(art. 13, 1st paragraph GDPR)

The communication of the interested party's personal data occurs mainly towards third parties and/or recipients whose activity is necessary for the performance of the activities inherent to the established relationship and to respond to certain legal obligations, such as:
Third party suppliers and external consultants: Provision of services (assistance, maintenance, suppliers of electronic communication networks and services) connected to the management of the website.
The Data Controller does not transfer your personal data to countries where the GDPR is not applied (non-EU countries) unless otherwise specifically indicated for which you will be informed in advance and, if necessary, your consent will be requested.
The legal basis for such processing is the fulfillment of the services inherent to the established relationship, compliance with legal obligations and the legitimate interest of the Data Controller to carry out processing necessary for these purposes.
What happens if the interested party does not provide his/her data identified as necessary for the performance of the requested service?

(Art. 13, 2nd paragraph, letter e GDPR)

In general, the collection and processing of personal data is necessary to follow up on the requested services. If the interested party does not provide personal data, the Data Controller will not be able to follow up on the processing related to the management of the requested services, nor on the obligations that depend on them.
What happens if the Data Subject does not provide consent to the processing of personal data for commercial promotion activities on Services/Products other than those purchased?

In the event that the interested party does not give his/her consent to the processing of personal data for such purposes, said processing will not take place for the same purposes, without this having any effect on the provision of the requested services, nor for those for which he/she has already given his/her consent, if required.
In the event that the interested party has given consent and subsequently revokes it or opposes the processing for commercial promotion activities, his/her data will no longer be processed for such activities, without this entailing consequences or detrimental effects for the interested party and for the requested services.
How we process the data of the interested party

(art. 32 GDPR)

The Data Controller arranges for the use of adequate security measures in order to preserve the confidentiality, integrity and availability of the personal data of the Data Subject and imposes similar security measures on third-party suppliers and Processors.
Where we process the data of the interested party

The personal data of the interested party are stored in paper, computer and telematic archives located in countries where the GDPR is applied (EU countries). Pursuant to art. 43 of the Privacy Code and art. 44 of the GDPR, the Data Controller may also transfer his/her personal data to Third Parties located in States outside the European Union or the European Economic Area. In this circumstance, the Data Controller ensures the adoption of adequate guarantees (such as the signing of standard contractual clauses approved by the EU Commission) with the foreign company receiving the data; these clauses guarantee a level of data protection corresponding to that established by European legislation.
How long are the interested party's data stored?

(art. 13, 2nd paragraph, letter a GDPR)

Unless the interested party explicitly expresses his/her will to remove them, the personal data of the interested party will be retained until they are necessary with respect to the legitimate purposes for which they were collected.
In particular, they will be retained for the entire duration of your registration and in any case no longer than a maximum period of 12 (twelve) months of your inactivity, or if, within this period, no Services are associated and/or Products purchased using the registration itself.
It should also be added that, in the event that a user forwards to the Data Controller personal data that are not requested or not necessary for the purpose of carrying out the requested service or for the provision of a service strictly connected to it, the Data Controller cannot be considered the owner of this data, and will proceed to delete it as soon as possible.
Regardless of the interested party's determination to remove them, personal data will in any case be stored according to the terms established by current legislation and/or national regulations, for the exclusive purpose of guaranteeing specific fulfillments, specific to some Services.
Furthermore, personal data will in any case be retained for the fulfillment of obligations (e.g. fiscal and accounting) that remain even after the termination of the contract (art. 2220 cc); for these purposes the Data Controller will retain only the data necessary for the related pursuit.
This does not apply to cases where rights arising from the contract and/or from registration in the registry office need to be asserted in court, in which case the personal data of the interested party, exclusively those necessary for such purposes, will be processed for the time necessary to pursue them.
Your rights

In relation to the processing of your personal data, you have the right to ask the Data Controller:

access: you can ask for confirmation as to whether or not data concerning you is being processed, as well as for further clarifications regarding the information in this Policy, and to receive the data itself, within the limits of reasonableness;
rectification: you can ask to rectify or integrate the data you have provided us or in any case in our possession, if inaccurate;
cancellation: you can request that your data acquired or processed by the Data Controller be deleted, if they are no longer necessary for our purposes or where there are no ongoing disputes or controversies, in the event of withdrawal of consent or your opposition to the processing, in the event of unlawful processing, or if there is a legal obligation to delete;
limitation: you can request the limitation of the processing of your personal data, when one of the conditions set out in art. 18 of the GDPR applies; in this case, your data will not be processed, except for storage, without your consent, except as explicitly stated in the same article in paragraph 2.
opposition: you can object at any time to the processing of your data based on our legitimate interest, unless there are legitimate reasons for us to proceed with the processing that prevail over yours, for example for the exercise or our defense in court; your opposition will always and in any case prevail over our legitimate interest in processing your data for marketing purposes;
portability: you can ask to receive your data, or to have it transmitted to another owner indicated by you, in a structured, commonly used and machine-readable format.
Furthermore, pursuant to art. 7, par. 3, GDPR, we inform you that you can exercise your right to withdraw your consent at any time, without prejudice to the lawfulness of the processing based on the consent previously given. Finally, we inform you that you have the right to lodge a complaint with the Supervisory Authority, which in Italy is the Guarantor for the Protection of Personal Data.
right to be forgotten: We inform you that this Policy concerns exclusively the processing of personal data that you have provided or will provide to the Data Controller - possibly also by purchasing our products and/or services provided for payment or by participating in our promotions and/or offers - and those that, eventually, the Data Controller will acquire during the course of this relationship and/or further relationships between you and us.
If, however, you wish to assert the right to be forgotten with reference to your personal data possibly contained in articles, publications or sections of the site, you can contact, for the purposes of exercising this right pursuant to art. 17 of the GDPR, writing to the Data Controller Corte Canella, with headquarters in Via Canella 14, 37031 Illasi (Verona), VAT number/CF number 03690990233, info@cortecanella.it.

p>To exercise these rights, report problems or ask for clarifications on the processing of your personal data you can send an email to info@cortecanella.it.
We also inform you that it is possible to forward your requests by post, writing to the Data Controller, Corte Canella, with registered office in Via Canella 14, 37031 Illasi (Verona), VAT number/Tax Code 03690990233, specifying the subject of the request.

Changes to the Policy

The possible entry into force of new sector regulations, as well as the constant examination and updating of the services reserved and directed to you, could lead to the need to modify the methods and terms described in this Information. It is therefore possible that this document may undergo changes over time. We therefore invite you to periodically consult this page.
We will post any changes to this Policy on this page and, if the changes are material, we will provide you with a more prominent notice.

Last updated: 22/05/2025