Privacy & Cookie Policy

Pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR). Last updated: 02/10/2026.

1. Data controller

The data controller is Azienda Agricola Villa Crine di Venturini Giovanni Battista, with registered office in San Pietro in Cariano (Verona), and operating premises at Via della Contea 46, 37029 Pedemonte (VR), Italy, tax code/VAT number 01525270235.

For information or to exercise your rights, you can write to info@villacrine.it.

2. Data processed, purposes and legal bases

We process the data you provide to us by email, by phone, via WhatsApp, through the online booking or when subscribing to the newsletter: first name, last name, email address, phone number (if you provide it), WhatsApp profile name, the content of your request and messages, and the information needed to arrange an appointment.

• Answering information and wine purchase requests; managing bookings for visits and tastings: Art. 6(1)(b) GDPR (pre-contractual measures or contract requested by the data subject).
• Complying with accounting, tax and legal obligations: Art. 6(1)(c) GDPR (legal obligation).
• Sending the newsletter with updates on vintages, events and tastings: Art. 6(1)(a) GDPR (consent, which you can withdraw at any time).
• Ensuring the security and operation of the website (technical logs): Art. 6(1)(f) GDPR (legitimate interest in protecting our systems).

3. Recipients and third-party services

Your data is accessible to authorised personnel and to the following providers:

• Cloudflare, Inc.: hosting and delivery of the website; Turnstile service, which protects the newsletter form from abuse and automated traffic;
• Aruba S.p.A.: email service;
• Brevo: newsletter management. Brevo may use sub-processors, whose up-to-date list is published by the provider: https://www.brevo.com/legal/termsofuse/;
• Cal.com, Inc.: online booking of tastings.

Data may be disclosed to public authorities where required by law. It is not made public. Links to social networks and the WhatsApp button are external links: the relevant operator (for WhatsApp, WhatsApp Ireland Limited) processes data in accordance with its own privacy notice when you decide to visit them or to write to us. When you write to us on WhatsApp we receive your phone number, your profile name and the content of your messages; any transfers outside the EU carried out by WhatsApp are governed by its privacy notice.

4. Transfers outside the EU

Some providers may process data outside the European Economic Area. In such cases the transfer takes place on the basis of the following safeguards.

• Cloudflare: United States and global server network. Safeguard: EU-US Data Privacy Framework (verified on 2 October 2026); DPA with Standard Contractual Clauses.
• Cal.com: United States. Safeguard: EU-US Data Privacy Framework (verified on 2 October 2026).
• Brevo: European Union (France); some technical sub-processors are also located in the United States. Safeguard: Standard Contractual Clauses included in Brevo's DPA and, for the individual sub-processors, certification under the EU-US Data Privacy Framework.
• Aruba: Italy. Not applicable (processing within the European Economic Area).

You can obtain a copy of the safeguards by writing to info@villacrine.it.

5. Provision of data and retention

Data marked as mandatory in the forms is needed to handle your request or booking; without it we may be unable to reply or to complete the service. All other data is optional.

• Requests by email, phone and WhatsApp: [24] months from the last contact, unless legal obligations apply or it is necessary to defend a legal claim.
• Accounting and tax data: 10 years, as required by law.
• Newsletter: until you withdraw consent or unsubscribe; afterwards we keep only the proof of consent for as long as needed to protect our rights.
• Bookings on Cal.com: [24] months, in addition to the periods set out in the provider's privacy notice.
• Technical logs: [30-90] days, according to Cloudflare's settings.

6. Your rights

You can ask the controller for access to your data, rectification, erasure and restriction of processing; you can object to processing based on legitimate interest and, where the conditions are met, request data portability.

If processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

To exercise your rights, write to info@villacrine.it.

7. Automated decision-making and profiling

The controller does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you, and does not carry out profiling. Cloudflare Turnstile may perform automated checks to distinguish real users from automated programs, in accordance with the provider's procedures.

Cookies and similar technologies

8. Managing your preferences

You can accept, reject or customise non-essential cookies through the panel shown on the website. You can reopen it at any time from the "Manage cookie preferences" link at the bottom of every page and change your choice as easily as you made it.

9. Cookies and services used

Necessary (no consent required)

• villacrine_cookie_consent (Villa Crine): stores your cookie preferences. Duration: 182 days.
• [any other items found with the Application tab: name, provider, purpose, duration]

Statistics

Currently not used. If we activate traffic analysis tools in the future, we will do so only with your consent and will update this notice.

Marketing and external services (only with consent)

• Newsletter subscription (with Turnstile protection), Brevo and Cloudflare: management of the subscription and mailings; protection of the form from abuse.
• Booking of tastings, Cal.com: management of online bookings.

External services may set cookies or similar technologies according to their own privacy notices, which we invite you to read.