Privacy
policy

This is the English version, provided so that our international visitors can read it. The official document is the Italian Privacy Policy, kept up to date and published by iubenda. Where the two texts differ, the Italian one prevails. We check the Italian version every day and update this page when it changes.

Who is responsible for your data

The data controller is Giorgio Brunozzi, sole trader, trading as Azienda Agraria Brunozzi.

• Registered address: Fraz. Turrita, Loc. Madonna Alta 77/B, 06036 Montefalco (PG), Italy
• Winery and shop: Loc. Colle Arfuso 2, 06036 Montefalco (PG), Italy
• VAT no. IT02843470549 · Tax code and Business Register no. BRNGRG86T05D653J · REA PG-244914
• Email: info@aziendagrariabrunozzi.it · Certified email (PEC): giorgio.brunozzi@pec.agritel.it
• Phone and WhatsApp: +39 328 954 9774

There is no Data Protection Officer: this is a one-person farm, and the person who answers you is the same one who reads your email.

The short version

We ask for as little as possible, we ask for it openly, and we never sell it to anyone. Nothing on this site tracks you before you have said yes. If you want your data deleted, one email is enough — no forms, no ticket numbers.

The newsletter — “Letters from Colle Arfuso”

What we collect: your email address, your first name if you give it, the language of the page you signed up from.

Why: to send you the letters — harvest, new oil, Enosafari dates.

Legal basis: your consent (Art. 6(1)(a) GDPR). We use double opt-in: after signing up you receive an email and nothing happens until you confirm it. That confirmation is our proof that it was really you.

Who else sees it: Brevo, our email provider (Sendinblue SAS, France), acting as our processor. A copy is also written to a register file on our own server at SiteGround.

How long: until you unsubscribe. Every letter has an unsubscribe link at the bottom, and it works immediately.

The waiting list

When a wine or an oil is sold out you can ask to be told when it is back. What we collect: your email, your name if you give it, and which product you are waiting for. Why: to write to you once, when it returns. Legal basis: your consent. Who else sees it: Brevo. How long: until the product returns and we have told you, or until you ask us to remove you.

Trade and partner enquiries

What we collect: name, email, phone number, website and the message you write. Why: to answer you and, if it goes well, to work together. Legal basis: steps taken at your request before a possible contract (Art. 6(1)(b) GDPR). Who else sees it: Brevo, plus a register file on our server. How long: for as long as the business relationship lasts, or two years from the last contact if nothing comes of it.

Photos and video of your visit

During the Enosafari we take photos and shoot video, and at the end of the day the keepsake is yours. Before your visit you receive the photo and video release.

What we collect: your name, your email, the date of your visit and the choice you made — yes or no to publication.

Why: to send you your photos, and to be able to prove that you agreed (or did not agree) to them being published.

Legal basis: your consent, which you can withdraw at any time by writing to us.

Who else sees it: the record stays in register files on our server; Brevo sends the emails.

How long: for as long as we use the images, and in any case for as long as we may need to prove that consent was given.

Children never appear online, whatever the adults choose. That is our rule and it has no exceptions.

Buying wine and oil

The shop runs on Shopify (Shopify International Ltd., Ireland), which acts as our processor. The basket, the checkout and the payment all happen on Shopify’s systems.

What we collect: the name, address, email and phone number needed to ship your order and issue the invoice, plus what you bought. We never see your card details — they are handled directly by the payment providers and never reach us.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR), and a legal obligation for the accounting records (Art. 6(1)(c)).

How long: ten years for invoices and accounting documents, as Italian law requires.

Booking an experience

Bookings for the Enosafari and the other visits are handled by Regiondo (Regiondo GmbH, Munich, Germany), acting as our processor. The booking form, the payment and the confirmation email are theirs. We receive the name, email, phone number, number of guests and any notes you leave — allergies, for example — so that we can organise your day properly.

Legal basis: performance of the contract. Information about allergies or intolerances is used only to prepare your food, and only if you choose to tell us.

How long: as long as the booking system keeps it, plus the ten years required for accounting.

Gift vouchers

When someone buys a gift voucher we receive the buyer’s name, email and phone number from the booking system, and we send the voucher by email. Legal basis: performance of the contract. How long: until the voucher expires, plus the accounting period.

When you simply write to us

If you email, phone or write on WhatsApp, we keep what you wrote for as long as it takes to answer you and to keep a sensible record of the conversation. Legal basis: our legitimate interest in replying to you (Art. 6(1)(f) GDPR).

Measuring how the site is used

We use Google Analytics 4 to know which pages are read and which are ignored. It only starts after you have accepted it in the cookie banner: until then the script sits on the page switched off. We look at totals, never at individuals.

Legal basis: your consent. You can change your mind at any time from “Cookie preferences” at the bottom of every page.

Details of every cookie are in the Cookie Policy.

What happens even without cookies

Type fonts. The lettering is served from our own server. Until 4 August 2026 it came from Google Fonts, which meant your IP address reached Google on every page you opened even if you had refused all cookies. The font files now live on this site: nothing leaves.

Server logs. Our hosting provider, SiteGround (Bulgaria and the United States), records the usual technical information — IP address, browser, time of the request — to keep the site running and to defend it from attacks. Legal basis: our legitimate interest in the security of the site. These logs are kept for a short period and are not used to build a profile of anyone.

Who we share your data with

Only with the companies that make the site work, each of them bound by a data processing agreement: Brevo (email), Shopify (shop and payments), Regiondo (bookings), Google (analytics), iubenda (consent management), SiteGround (hosting). Beyond that, only where the law requires it — our accountant, the tax authorities.

We do not sell your data, we do not swap it, and we do not hand it to advertisers. Not as a promise: there is simply no such thing in the way this farm works.

Data leaving Europe

Some of these providers are based outside the European Union or use servers there — Google and Shopify in particular. Those transfers rely on the safeguards the law provides: the European Commission’s Standard Contractual Clauses and, for the United States, the EU–US Data Privacy Framework.

What you can ask us to do

Under Articles 15 to 22 GDPR you have the right to:

• ask what data we hold about you and get a copy of it;
• have it corrected if it is wrong;
• have it deleted;
• ask us to stop using it for a while, or object to our using it;
• receive it in a portable format, or have it sent to someone else;
• withdraw a consent you gave, at any time, without giving a reason and without it affecting what happened before.

One email to info@aziendagrariabrunozzi.it is enough. We answer within a month, and normally much sooner.

If you think we have got it wrong, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority in the country where you live.

Children

This site sells alcohol and is not aimed at people under 18. We do not knowingly collect data from minors. If a child has sent us something, write to us and we will delete it.

Changes

When the Italian policy changes, this page is updated to match. The date below tells you when it was last touched.

Last updated: 4 August 2026.