Privacy & Cookie Policy

Rosanna Coccia, sole trader, trading as La Vigna degli Dei, VAT number 06283821210, with registered office at Via Castello Lauritano, 3, 80051 San Lazzaro (NA), Italy (hereinafter “La Vigna degli Dei” or the “Business”), owner of the website www.lavignadeglidei.com, is aware of how important the responsible processing of personal data is. The Business therefore wishes to explain how the personal data provided by each user, or otherwise acquired by the Controller (as defined below) in the course of the relationship or of the user’s interaction with the pages of the website, is used and processed, in accordance with the fundamental rights and freedoms of the individual and with data protection law.

Users connecting to the website are asked to read this Privacy Policy carefully. It has been drawn up under Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of personal data (hereinafter the “GDPR” or the “Regulation”).

This Privacy Policy applies to this website only. It does not apply to other websites the user may reach through links published here.

Personal data is processed in accordance with the principles of fairness, lawfulness, necessity, minimisation, purpose and storage limitation, transparency, accuracy, integrity and confidentiality.

Under Article 13 of the GDPR, we therefore provide the following information.

Under Article 4 of the GDPR, the “Data Controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

The Controller of the personal data collected by the Business, to be contacted with any question about this Privacy Policy or about how personal data is processed, is:

• Rosanna Coccia, sole trader, trading as La Vigna degli Dei
• Via Castello Lauritano, 3, San Lazzaro (NA), Italy
• Telephone: +39 347 557 8461
• Email: agricolo1@legalmail.it
• Certified email (PEC): agricolo1@legalmail.it

Browsing data

The computer systems and software procedures that operate this website acquire, in the course of their normal functioning, certain personal data whose transmission is inherent in the use of internet communication protocols. This category includes IP addresses or domain names of the devices used to connect to the site, MAC (Media Access Control) addresses, URI (Uniform Resource Identifier) addresses of the resources requested, and other parameters relating to the user’s operating system and computing environment.

To protect the booking form, the contact form and the staff login from abuse, the website also records the IP address of the device together with the number of attempts made in a short period of time. This record is used only to block repeated attempts and is deleted automatically after a short period.

Data provided voluntarily by the user

If the user voluntarily sends an email to the addresses published on the website, the Business may process the sender’s email address and any other personal data provided, in order to reply to the request. The legal basis for this processing is Article 6(1)(b) of the Regulation, that is, providing the service the user has requested.

When booking an experience through the website, the following data entered by the user in the booking form will be collected:

• first name and surname;
• email address and, optionally, telephone number;
• chosen experience, date and time, number and age bracket of participants;
• any note the user chooses to add, for example about allergies (see below);
• the payment method used: its type and, for cards, the brand and the last four digits.

Payment card and PayPal details are neither collected nor stored by the Business. They are entered by the user directly in the payment form of Stripe Payments Europe, Ltd. (Ireland), which is embedded in the website and acts as an independent controller for its own legal obligations and as a processor on behalf of the Business. If the user chooses PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) also processes the data as an independent controller.

When a booking is made more than seven days before the experience, nothing is charged at the time of booking: with the user’s authorisation, the payment method is saved with Stripe so that the deposit can be charged automatically seven days before the date, when free cancellation ends. When a booking is made less than seven days before the experience, the deposit is charged immediately. The saved payment method is used only for the deposit of that booking, not for future purchases, and is removed from Stripe if the booking is cancelled. The Business only receives from Stripe the outcome of each payment and the details of the payment method listed above.

The confirmation email contains a personal link through which the user can view the booking, add it to their calendar, pay a deposit whose automatic charge did not go through, and cancel it. Anyone holding the link can see the details of the booking, so it should not be shared.

When filling in the contact form in the section of the website named “Contact us”, the following data entered by the user will be collected:

• first name and surname;
• email address;
• the topic of the request and, where given, the dates and the number of guests;
• any data contained in the free-text message.

The request is delivered by email to the Business, and a confirmation is sent to the user. It is not stored on the website.

Allergies and dietary requirements

The booking form includes an optional field in which the user may report allergies, intolerances or dietary requirements, their own or those of the other participants. This information constitutes health data under Article 9 of the Regulation and is processed solely to allow the Business to prepare meals safely.

Providing it is entirely optional. The processing is based on the explicit consent of the data subject under Article 9(2)(a) of the Regulation, collected through a dedicated tick box, separate from any other statement, when the booking is submitted. Consent may be withdrawn at any time, on the understanding that withdrawal means the Business can no longer take those indications into account.

This data is accessible only to the family members and staff responsible for preparing meals, is not disclosed to any third party and is not used for any other purpose. It is deleted within seven days of the date of the booked experience.

Other than the above, users are asked never to enter or send “special categories of data” or “health data”, as defined by applicable law, through the tools available on the website, and in particular in the free-text fields of the contact form. Any such data, if provided, will be deleted immediately.

Personal data voluntarily provided by users is processed solely for purposes strictly connected to and instrumental in fulfilling the obligations arising from present and future relationships with the Business, such as:

4.1 to allow browsing of the website, to ensure that it functions correctly and securely, and to establish liability in the event of computer crimes against it. The legal basis for this processing is Article 6(1)(f) of the Regulation, that is, the legitimate interest of the Controller in providing the service securely and protecting its infrastructure;

4.2 to allow the performance of the booking contract concluded through the website, including the automatic charge of the deposit with the payment method saved by the user, the handling of a charge that does not go through, and the balance. Data is used to send the emails connected with the booking: the confirmation, a reminder before free cancellation ends, a notice if the deposit could not be charged, a message the day before the experience and any cancellation notice. The Business does not store payment card details. The legal basis for this processing is Article 6(1)(b) of the Regulation, that is, performance of a contract to which the data subject is party;

4.3 to take account of any allergies, intolerances or dietary requirements reported, in order to prepare meals safely. The legal basis for this processing is Article 9(2)(a) of the Regulation, that is, the explicit consent of the data subject;

4.4 to allow a booking to be amended or cancelled, including through the personal link in the confirmation email, for which only the data strictly necessary will be processed. The legal basis for this processing is Article 6(1)(b) of the Regulation, that is, providing the service the user has requested;

4.5 to answer questions submitted through the section of the website named “Contact us”, for which only the data strictly necessary will be processed. The legal basis for this processing is Article 6(1)(b) of the Regulation, that is, providing the service the user has requested;

4.6 to send, the day after the experience, a single email thanking the user and inviting them to leave a review. The legal basis for this processing is Article 6(1)(f) of the Regulation, that is, the legitimate interest of the Controller in receiving feedback on the service provided. The user may object at any time, before or after receiving it, by writing to the Controller;

4.7 for administrative record-keeping and to comply with obligations laid down by civil and tax law, by regulations and by EU legislation. The legal basis for this processing is Article 6(1)(c) of the Regulation, that is, compliance with a legal obligation to which the Controller is subject.

As noted above, providing certain personal data is necessary in order to browse the website or to receive the other services expressly requested by the user.

In addition to the personal data provided directly by users, the computer systems and software procedures that operate the website indirectly acquire certain personal data whose transmission is inherent in the use of internet communication protocols. That data is processed only for as long as is technically necessary to keep the website running securely and to establish liability in the event of computer crimes against it.

Failure to provide personal data, or providing it in part or inaccurately, may make it impossible to perform the service requested where that data is necessary. Failure to provide optional data has no consequence.

Personal data is processed electronically and/or on paper, in accordance with the principles laid down by data protection law. Processing takes place with every technical and organisational security measure appropriate to the risks to the fundamental rights and freedoms of the data subject.

Data is processed at the Business’s operating premises and at any other location where the parties involved in the processing are based.

Processing operations are carried out only by persons authorised by the Business and by the Controller to access the information, who are properly instructed on data protection and appointed as persons in charge of the processing.

Personal data is kept for as long as the service is provided and for no longer than is necessary for the purposes for which it was collected. In particular:

• browsing data is kept for as long as is technically necessary for the security and functioning of the website; the IP addresses recorded to block repeated attempts are deleted automatically after a short period;
• data contained in contact requests is kept for as long as is necessary to deal with the request and, thereafter, for no more than twelve months;
• allergy and dietary information is deleted within seven days of the date of the booked experience;
• the payment method saved with Stripe is removed if the booking is cancelled; Stripe keeps its own payment records under the obligations that apply to it;
• booking data is kept for the duration of the relationship and, thereafter, for the ten-year ordinary limitation period, to protect against possible disputes;
• tax and accounting records are kept for ten years, as required by tax and civil law.

Once those periods have elapsed, data is deleted or irreversibly anonymised.

Personal data collected for the purposes set out above may be disclosed to third parties, and in particular:

7.1 to the technical service providers the Business relies on to operate the website and the services offered through it, appointed as processors under Article 28 of the Regulation, namely: Vercel Inc. (hosting, content delivery and visit statistics), Neon, Inc. (database, with data stored in the European Union), Resend, Inc. (sending of emails) and Stripe Payments Europe, Ltd. (payments), the latter also acting as an independent controller as described in section 3;

7.2 to staff and collaborators specifically appointed as persons in charge of the processing and within the scope of their duties, who act under the direct authority of the Controller and receive appropriate operational and security instructions;

7.3 to public authorities and government bodies for the purposes of complying with legal obligations, and for the investigation, ascertainment and prosecution of administrative, fiscal, accounting, tax and criminal offences;

7.4 to companies providing IT services and the development and maintenance of software and of the website.

The list of these parties is kept up to date and may be obtained free of charge by writing to the Controller at the contact details given in section 2 of this policy.

Some of the technical service providers the Business relies on to operate the website, to send email and to process payments are established outside the European Economic Area, or use infrastructure located outside it. Personal data may therefore be transferred to those countries.

The website is hosted and served by Vercel Inc., and emails are sent through Resend, Inc., both established in the United States. The database is provided by Neon, Inc., also established in the United States, but the data is stored in the European Union (Frankfurt, Germany). Payments are handled by Stripe Payments Europe, Ltd., established in the European Union, whose group companies outside the Union may access the data for technical support purposes.

Any such transfer takes place only where one of the safeguards provided for in Chapter V of the Regulation is in place, and in particular on the basis of an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for providers certified under it, or of the standard contractual clauses adopted by the European Commission, accompanied where necessary by supplementary measures.

Data subjects may obtain a copy of the safeguards in place, as well as an up-to-date list of the providers involved, by writing to the Controller at the contact details given in section 2 of this policy.

This Privacy Policy covers only the processing of personal data carried out through this website and the tools available on it. It does not cover other websites the user may visit through links published here, whose operators act as independent controllers. Users are therefore asked to read the privacy policies of third-party services carefully before using them.

The pages of the experiences show a map provided by Google Maps (Google Ireland Limited), to explain where to meet. When the map is displayed, Google receives the IP address of the device and processes it under its own privacy policy. Links to WhatsApp, TikTok, Google Maps directions and Google reviews are ordinary links: no data is sent to those services unless the user selects them.

Articles 12, 15, 16, 17, 18, 19, 20, 21, 22 and 34 of the Regulation give data subjects a number of specific rights.

Data subjects may exercise their rights against the Controller or the processor at any time. In particular, the data subject may obtain:

• a) confirmation as to whether or not personal data concerning them exists, even if not yet recorded, and communication of that data in intelligible form;
• b) information on the purposes and methods of the processing;
• c) information on the categories of personal data concerned;
• d) the identifying details of the controller and, where appointed, of the processor;
• e) the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
• f) where possible, the envisaged retention period, or if that is not possible, the criteria used to determine it;
• g) the updating, rectification or, where they have an interest in it, the integration and restriction of their personal data;
• h) the erasure, anonymisation or blocking of data processed unlawfully or in order to comply with a legal obligation under EU or Italian law, including data whose retention is not necessary for the purposes for which it was collected or subsequently processed (the “right to be forgotten”);
• i) the withdrawal of consent, where the processing is based on Article 6(1)(a) or on Article 9(2)(a) of the GDPR, at any time and without affecting the lawfulness of processing carried out before withdrawal;
• j) the restriction of processing, in the cases provided for by the Regulation;
• k) notification of any personal data breach, where it is likely to result in a high risk to the rights and freedoms of natural persons, unless the Controller has implemented technical and organisational measures rendering the data unintelligible to anyone not authorised to access it, or has subsequently taken measures ensuring that the high risk is no longer likely to materialise, or such notification would involve disproportionate effort;
• l) not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The Business carries out no automated decision-making and no profiling;
• m) to receive, in a structured, commonly used and machine-readable format, the personal data provided to the Controller, and to transmit it to another controller, at any time, including after the end of any relationship with the Controller, and where technically feasible to have it transmitted directly.

Data subjects also have the right to object at any time, in whole or in part, under Article 21 of the Regulation:

• on legitimate grounds, to the processing of personal data concerning them, even where relevant to the purpose of collection;
• to the processing of personal data concerning them carried out under Article 6(1)(e) (“processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”) or Article 6(1)(f) (“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party”) of the GDPR, including profiling based on those provisions;
• to the processing of personal data concerning them for the purposes of direct marketing, including profiling to the extent that it is related to such marketing.

Data subjects who believe that the processing concerning them infringes the law have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or of the alleged infringement. The Italian supervisory authority is the Garante per la protezione dei dati personali, whose contact details are published on its website: www.garanteprivacy.it

The rights listed above may be exercised by an informal request to the Controller or to the processor, including through a person in charge of the processing, which will be answered without undue delay and in any event within one month, extendable by a further month, of receipt.

Requests may also be sent by registered post to the Business’s registered office or to the following email address: agricolo1@legalmail.it

Where processing is based on consent, the user always has the right to withdraw it. Withdrawal does not affect processing carried out by the Business or the Controller up to that point, and may prevent the Business from pursuing the purposes requested by the user.

The Business reserves the right to amend this policy to reflect any regulatory, organisational or technological changes that may come into effect over time. Where it is amended, the new version will be published on the Business’s website, and users are therefore invited to review this page periodically.

Cookies are small text files sent to the user by the website being visited. They are stored on the user’s device, allowing the website to recognise users and remember certain information about them, in order to provide or improve the service offered.

There are several types of cookie. Some are necessary in order to browse the website; others serve different purposes, such as internal security, system administration, statistical analysis, understanding which sections of the site interest users most, or offering a personalised visit.

This website does not use profiling cookies. The above applies both to the user’s computer and to any other device used to connect to the site.

Technical cookies are those used solely to carry out the transmission of a communication over an electronic communications network, or as strictly necessary for the provider of an information society service explicitly requested by the user to provide that service.

They are not used for any further purpose and are normally installed directly by the owner or operator of the website.

Technical cookies fall into the following types:

• navigation or session cookies, which allow the website to be browsed and used normally (for example, making a purchase or authenticating to access restricted areas);
• analytics cookies, which may be treated as technical cookies, and therefore installed without the user’s consent, only where they are used directly by the site operator to collect information in aggregate form, the IP address is rendered non-identifying, and the data is neither combined with other information nor passed to third parties for their own purposes. Outside those conditions, analytics tools require the user’s prior consent;
• functionality cookies, which allow the user to browse according to a set of chosen criteria (for example language, or the items selected for purchase) in order to improve the service provided.

Disabling cookies may limit the ability to use the website and prevent full use of its features and services. A description of the cookies used on this website is set out below.

The legal basis for this processing is Article 6(1)(b) of the GDPR, that is, allowing the user to receive the service requested.

The cookies that Google may set when the map is displayed are not technical: they are used only with the user’s consent, under Article 122 of the Italian Privacy Code (Legislative Decree 196/2003) and Article 6(1)(a) of the GDPR. Consent can be withdrawn at any time, as explained in section 14.

This website uses no profiling cookies. The only technologies that store information on the user’s device are the following.

• Your cookie choice: a technical cookie of this website, vdd_consent, remembers for six months whether the user accepted or rejected the map cookies, so that the banner is not shown at every visit. After six months the choice is asked again.
• Payments (Stripe): the payment form is provided by Stripe and is loaded only when the user reaches the payment step of a booking. Stripe may then store technical identifiers on the device, such as the __stripe_mid and __stripe_sid cookies, used solely to prevent fraud and to process the payment securely. They are technical cookies, strictly necessary for the payment service requested by the user.
• Map (Google Maps): the map on the pages of the experiences is loaded only with the user’s consent, given with “Accept” in the cookie banner or with “Show map” on the map itself. Without consent the map is not loaded and no data is sent to Google; the “Get directions” link remains available. Once the map is displayed, Google may set its own cookies on the device, under its own cookie policy.
• Staff area: a technical session cookie is used only in the reserved area through which the Business manages bookings. It is never set for visitors to the website.

Visit statistics (Vercel Web Analytics): to know how many people visit the website and which pages they read, the website uses Vercel Web Analytics, provided by Vercel Inc., the company that hosts the website. It uses no cookies and stores nothing on the user’s device. A visit is recognised by a code derived from the request, which is discarded after 24 hours and is not associated with the IP address. For each page viewed it records the page, the referring website, the approximate location (country, region and city), the type of device, the operating system and the browser, and it is used only for aggregated statistics that do not identify the user. The pages of the staff area and the personal booking pages are excluded. The legal basis for this processing is Article 6(1)(f) of the Regulation, that is, the legitimate interest of the Controller in understanding how the website is used in order to improve it.

The website hosts no share buttons, embedded videos or social media widgets. The links to the Business’s social media profiles are ordinary hyperlinks: they install no cookies and send no data to those platforms unless the user selects them.

This list will be updated before any further tool that stores information on the user’s device, or any further statistical measurement tool, is introduced.

The user can change or withdraw their choice at any time with the “Cookie settings” link at the bottom of every page. After withdrawal the map is no longer loaded; cookies that Google has already set remain on the device until they expire or are deleted from the browser settings, as described below.

Most browsers accept cookies automatically, but users can normally change their settings to disable this. It is possible to block all types of cookie, or to accept only some and disable others. The “Options” or “Preferences” section of the browser menu allows users to refuse cookies and other tracking technologies, and to be notified by the browser when they are activated. The “Help” section of the toolbar available in most browsers offers further guidance.

You can also select your browser from the list below and follow the instructions.