Privacy notice
We use your data to serve you: orders, deliveries, visits and, only if you wish, our news. We sell it to nobody.
Updated on
Who handles your data
The data controller is Società Agricola Grosjean Vins s.s., Frazione Ollignan 2, 11020 Quart (AO), Italy. VAT number and tax code 00536390073, REA AO-47726.
Email info@grosjeanvins.it, phone +39 0165 775791, WhatsApp +39 379 1289169, certified email (PEC) grosjeanvins@pec.it (official matters only). We have no data protection officer (DPO): it isn’t required for our business. For any question about your data, write to the email above.
What data, why and for how long
| What for | What data | Legal basis | How long |
|---|---|---|---|
| Orders, delivery and collection | name, email, phone, address, products, payment outcome, age declaration | contract (GDPR art. 6.1.b); tax obligations (art. 6.1.c) | 10 years, by law (Italian Civil Code, art. 2220) |
| Invoice | tax code or VAT number, company name, e-invoicing code | legal obligation (art. 6.1.c) | 10 years |
| Visit bookings | name, email or phone, country, number of guests, notes | contract (art. 6.1.b) | 24 months after the visit; then only anonymous figures |
| Allergies written in the notes | what you choose to tell us | your explicit consent (art. 9.2.a) | until the day after the visit |
| Gift vouchers | the buyer; name, email and message for the recipient | contract (art. 6.1.b) | until the voucher expires; the order 10 years |
| Adopt a Cru | name on the plate, address, renewal payments | contract (art. 6.1.b) | for the whole adoption; then 10 years for tax data |
| Customer area (when it is active) | email, sign-in codes, passkeys | contract (art. 6.1.b) | codes a few minutes; the profile until you ask us to delete it |
| Withdrawal and complaints | what you write in the form or email | legal obligation (art. 6.1.c) | together with the order |
| Newsletter, unfinished order, thank-you after the visit | email, name, language, date and wording of the consent | your consent (art. 6.1.a), withdrawable in every email | until you withdraw it; the proof of consent also after |
| Reviews | name as you write it, rating, text, link to the order | your choice to publish it (art. 6.1.a) | until you ask us to remove it |
| Messages, calls, WhatsApp | what you write or tell us | answering your request (art. 6.1.b) | the time to answer you, at most 24 months |
| Website security | IP address, browser, pages requested (technical logs) | legitimate interest in protecting the site (art. 6.1.f) | a few days, at our hosting provider |
Customer details, orders and bookings also go into our internal management system, so we can serve you better when you write or visit. We make no automated decisions about you. Stripe uses automatic fraud checks that sometimes block a payment: if that happens, write to us.
The data for orders and bookings is necessary: without it we can’t ship or welcome you. Newsletter and reviews are optional.
The site is not meant for people under 18.
Analytics and advertising
We count visits and pages with Vercel Web Analytics and measure loading speed with Vercel Speed Insights, in aggregate: no cookies and no data that could identify you, and the IP address is not kept (legitimate interest in improving the site, art. 6.1.f). Google Analytics 4 (analytics) and the Meta pixel (advertising) start only if you accept them in the cookie banner (consent, art. 6.1.a): they see the pages you visit, where you come from and purchases. You can change your mind at any time from “Cookie preferences” at the bottom of every page; details on the cookies page.
The e-Label pages (the QR code on the label) collect no personal data: we count scans by country without keeping the IP address.
Who receives the data
Only those we need to work with, each for their part:
- Vercel (hosts the site) and Neon (database, servers in Frankfurt);
- Google (Google Analytics 4) and Meta (pixel), only if you accept them in the cookie banner;
- Stripe (payments) and, if you choose them, PayPal, Satispay, Apple Pay and Google Pay, which also handle payment data as independent controllers;
- Brevo (sending emails, France);
- GLS Italy and, for shipments in the European Union, Mail Boxes Etc. (All Service snc, Alba) with its couriers (deliveries: name, address, phone, email);
- Google Workspace (the winery’s email) and WhatsApp if you write to us there;
- the portals you book through (for example Winearound, GetYourGuide, Airbnb), which pass us the booking as independent controllers;
- our accountant and advisers, for tax obligations; the authorities, when the law requires it.
Providers handle the data on our behalf, under a contract (GDPR art. 28). Inside the winery only the people working on orders and visits see it.
Data outside the European Union
Some providers (Vercel, Stripe, Google, Meta) are based or have servers in the United States. The transfer relies on the EU-US Data Privacy Framework, the European Commission’s adequacy decision, and where needed on the standard contractual clauses approved by the Commission.
Your rights
You can ask us at any time to see your data, correct it, delete it, restrict its use, receive it in a file or object to its use; you can withdraw a consent whenever you like, without affecting what was done before (GDPR, articles 15-22). Write to us: we answer within one month. Data the law obliges us to keep (invoices, for example) stays for the time required.
If you think we misuse your data you can complain to the Italian data protection authority or to the authority of the country where you live.
Changes
If we change how we use data we update this page and the date at the top; for important changes we write to you.