This is a courtesy translation. In case of any discrepancy between this version and the Italian version, the Italian version shall prevail.
Last updated: 23 September 2026
Information notice on the processing of personal data pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR)
1. Introduction
This notice, provided pursuant to Articles 13 and 14 GDPR, refers to the website https://enotecapanevino.it/ (the “Site”) and is provided by PaNeVino di Paolo Nembri, registered office at Piazzale XVI Luglio 18, 27040 San Damiano al Colle (PV), Italy, Tax Code/VAT No. 12804100969, Pavia Chamber of Commerce REA No. 310275, as Data Controller (hereinafter “PaNeVino”).
The Site is owned by PaNeVino, which is also the holder of the corresponding domain name.
In this notice, definitions in the singular also include the plural, and vice versa.
In compliance with the GDPR, with this notice we wish to inform you that PaNeVino will process the personal data provided and collected through the Site as described below.
2. Types of data processed, purposes and legal bases of processing
PaNeVino will process the personal data collected and/or provided through the Site in the manner and for the purposes described in this section.
2.1 Registration on the Site
i. Data processed. When a person decides to register on the Site, regardless of whether they make a purchase, PaNeVino may collect the following categories of personal data relating to them: first name, surname, e-mail address.
ii. Purpose of processing. The data collected under this paragraph will be collected and processed to allow a data subject to register on the Site by creating an account and, after registration, to access their reserved area on the Site and use the online services offered by PaNeVino to registered users.
iii. Legal basis. The legal basis for the processing described in this paragraph is the need to perform a contract, pursuant to Article 6(1)(b) GDPR, since registration is necessary to create an account on the Site. Registration is not required to make purchases, which can also be completed as a guest.
iv. Need to provide data. Providing the data mentioned in this paragraph is necessary and, failing this, it will not be possible to register on the Site. It is nevertheless still possible to purchase PaNeVino products as a guest.
v. Retention period. The data provided when registering on the Site will be retained by PaNeVino until the account is deleted by the data subject to whom they refer. This period may be extended where necessary to comply with a legal obligation to which PaNeVino is subject or to protect a right of PaNeVino before a competent authority.
2.2 Purchases through the Site
i. Data processed. When a data subject places a purchase order through the Site, PaNeVino will process the following categories of personal data:
For further information on the processing of data relating to users' payment cards or PayPal and Satispay accounts, please see paragraph 3 below.
ii. Purpose of processing. The data mentioned in this paragraph will be processed to allow the conclusion of the purchase contract and the correct performance of the related operations, including the shipment of the products purchased by data subjects (and, where required by sector regulations, to fulfil tax obligations).
iii. Legal basis. The legal basis for the processing is the need to perform the contract entered into by the specific user when purchasing a PaNeVino product on the Site (Article 6(1)(b) GDPR).
iv. Need to provide data. Providing the data mentioned in this paragraph is necessary and, failing this, it will not be possible to purchase PaNeVino products through the Site.
v. Retention period. PaNeVino will retain the data processed to allow the purchase of its products through the Site for a maximum of 10 (ten) years from the purchase, without prejudice to the possibility of extending this period where necessary to comply with a legal obligation to which PaNeVino is subject or to protect a right of PaNeVino before a competent authority.
2.3 Marketing activities
i. Data processed. Some of the personal data provided by a user when registering on the Site or when purchasing a product through the Site, such as: e-mail address, telephone number and postal address.
ii. Purpose of processing. PaNeVino may process the personal data mentioned in this paragraph to carry out marketing activities, which may take the following forms:
a) limited to PaNeVino customers, sending e-mail messages – to the contact details provided in the context of a purchase through the Site or upon registration – relating to products similar to those purchased through the Site (so-called soft spam);
b) sending promotional newsletters, carrying out market research, including research aimed at assessing user satisfaction, and sending advertising material relating to PaNeVino products and/or services, including through automated systems such as e-mail and/or push notifications, or through traditional means (e.g. paper mail or brochures) (marketing purposes), also relating to products not similar to those purchased by a customer through the Site or addressed to users who are not yet PaNeVino customers. Such promotional messages and communications may relate not only to PaNeVino products but also to products of companies belonging to the same group as PaNeVino. In this regard, however, PaNeVino will not share data subjects' data with such companies but will itself send the communications and messages relating to their products. In this case the legal basis for the processing is the consent of the data subjects to this type of activity.
iii. Legal bases of processing. The legal bases for PaNeVino's processing of personal data for direct marketing purposes are, respectively:
a) PaNeVino's legitimate interest in the case of communications relating to products similar to those purchased by its customers on the Site (soft spam), pursuant to Article 6(1)(f) GDPR and Article 130(4) of Italian Legislative Decree 196/2003 (“Privacy Code”). Users may object to the processing as described in the following paragraph;
b) the consent of data subjects in the case of promotional messages sent to data subjects who are not PaNeVino customers or relating to products not similar to those already purchased by a PaNeVino customer (Article 6(1)(a) GDPR).
Data subjects may object at any time to the processing of their personal data for this purpose as follows:
If you wish to delete your registration on the Site, you can send an e-mail to the Data Controller at enotecapanevino@gmail.com from the e-mail address with which you registered on the Site.
In addition, users registered on the Site can always check and manage their consents from their account page.
iv. Need to provide data. Providing the data referred to in this paragraph, as well as giving consent to its processing where required, is optional, and failure to do so will not affect either a user's registration on the Site or the completion of a purchase through it.
v. Retention period. Data processed for direct marketing purposes will be retained for 24 (twenty-four) months from their provision and from the giving of consent to their processing, where required. At the end of this period, PaNeVino will request renewal of consent to the processing of such data. PaNeVino may extend this retention period where necessary to comply with a legal obligation incumbent on PaNeVino or to protect a right of PaNeVino before a competent authority.
2.4 Profiling
i. Data processed. Data provided when registering on the Site or when making a purchase on it, and data relating to the preferences and purchasing habits of Site users.
ii. Purpose of processing. The personal data mentioned in this paragraph may be processed by PaNeVino to carry out profiling activities, i.e. to analyse the preferences and consumption habits of data subjects by recording the type and frequency of their purchases, in order to send personalised advertising material or promotional communications from PaNeVino and to present data subjects with products of specific interest to them.
iii. Legal basis. The legal basis for the profiling activities carried out by PaNeVino is the consent of data subjects pursuant to Article 6(1)(a) GDPR.
iv. Need to provide data. Providing the data described in this section, as well as giving consent to its processing, is optional; failing this, PaNeVino will not be able to send personalised promotional messages and communications to data subjects. Failure to consent to the processing will not affect a data subject's ability to register on the Site and/or make purchases through it.
v. Retention period. Data processed for profiling purposes will be retained for 12 (twelve) months from their provision and from the giving of consent to their processing, where required. At the end of this period, PaNeVino will request renewal of consent to the processing of such data. PaNeVino may extend this retention period where necessary to comply with a legal obligation incumbent on PaNeVino or to protect a right of PaNeVino before a competent authority.
Users registered on the Site can always check and manage their consents from their account page.
2.5 Data provided when contacting us
i. Data processed. PaNeVino may process the personal data provided by data subjects (e.g. first name, surname, contact details, any other information contained in their requests) when they decide to contact the controller using the contact details on the Site (e.g. e-mail, WhatsApp, paper mail), in the context of customer care or for any other request relating to PaNeVino's products and activities.
ii. Purpose of processing. PaNeVino will process the personal data referred to in this paragraph solely to respond to requests submitted by data subjects.
iii. Legal bases of processing. The legal bases for the processing described in this paragraph are:
a) the need to perform a purchase contract, in the case of data subjects who contact PaNeVino for customer care (Article 6(1)(b) GDPR);
b) the consent of data subjects, where they contact PaNeVino for any other kind of information (Article 6(1)(a) GDPR). In particular, the fact that a data subject decides to contact PaNeVino by submitting a request will be considered an unambiguous affirmative action equivalent to consent within the meaning of Article 4(11) GDPR.
iv. Need to provide data. Providing the data referred to in this paragraph is optional but, failing this, PaNeVino will not be able to follow up on the requests submitted by data subjects.
v. Retention period. The data processed as described in this paragraph will be retained for the period strictly necessary to respond to data subjects' requests. PaNeVino may extend this period where necessary to comply with legal obligations to which it is subject or to protect a right of PaNeVino before a competent authority.
2.6 Browsing data
When a user visits the Site, PaNeVino collects the following browsing data:
This information is collected for the proper functioning, management, maintenance and improvement of the Site, to ensure that data subjects browse securely and to establish liability in the event of cyber-security breaches. It is also used to allow PaNeVino to obtain statistical analyses of the use of the Site, with the possibility of analysing the data in aggregate form, and to allow users to receive promotional advertisements in line with their wishes and interests.
The processing of browsing data is also necessary to allow purchases to be made through the Site.
Site users are always free to decide whether to provide their browsing data, for example by choosing to disable cookies through their browser settings. However, refusing to provide information necessary for browsing may make it impossible to carry out activities strictly connected with browsing and, therefore, also to consult and interact with our Site and to make purchases through it.
This data is retained only for the time strictly necessary for the purposes for which it is collected.
Browsing data is collected through the use of cookies. To learn more about how cookies work and how to enable and disable them, please see our cookie policy.
2.7 Plug-ins and social media interaction
The Site allows interaction with third-party websites and social networks (Google, Instagram, Facebook) through hyperlinks, share buttons, social plug-ins and other similar tools.
When accessing an area of the Site provided with such tools, the Internet browser will connect data subjects directly to the servers of the third-party sites concerned, thereby transferring their personal data to the operators of such sites.
The data will be transferred on the basis of the data subjects' consent, expressed unambiguously when they click on a specific hyperlink, plug-in button or other similar tool.
Depending on the specific agreements with the operators of such third-party sites, PaNeVino may act as independent controller or joint controller with regard to such data transfers. For the privacy protection methods and the processing of personal data collected by the operators of the third-party sites with which the described interactions take place, please refer to the relevant sites.
3. Payment card data. Use of PayPal and Satispay
To make a payment with one of the types of payment card indicated on the Site, the user enters the confidential payment card data directly on a page that communicates via a secure encryption protocol with the payment service provider (acting as independent controller), without passing through PaNeVino's server, which will therefore not process such data in any way. The data will be acquired in encrypted format.
Purchases on the Site can also be made using the PayPal payment instrument. In this case, the user will be directed to a page outside the Site, where they will enter the personal data requested by PayPal – acting as independent controller – to complete the purchase procedure. The personal data does not pass through PaNeVino's server, which will therefore not process such data in any way.
Payments on the Site can also be made via Satispay. In this case, the payment is completed through the Satispay app, and Satispay acts as independent controller; PaNeVino has no access to the data of the payment instruments linked to the user's Satispay account.
With regard to the processing of payment card data and of the data requested by PayPal or Satispay, please note that this is necessary to allow the conclusion of the online purchase contract with PaNeVino. Failure to provide such data will therefore not allow users to complete the online purchase process.
4. Methods of processing
The personal data of data subjects will mainly be processed using electronic or otherwise automated means, in a manner and with tools suitable to guarantee the security and confidentiality of the data in accordance with the GDPR. In particular, all technical, IT, organisational, logistical and procedural security measures necessary to guarantee the minimum level of data protection required by law will be adopted, allowing access only to persons authorised to process data by PaNeVino or by the processors appointed by PaNeVino.
The information acquired and the methods of processing will be relevant and not excessive in relation to the type of services provided. The data will also be managed and protected in environments to which access is constantly monitored.
5. Communication and disclosure of data
The personal data of data subjects processed under this notice may be communicated:
Data relating to data subjects will not be disclosed, except in anonymous and aggregate form, for statistical or research purposes.
6. Transfer of data outside the EEA
PaNeVino will not transfer the personal data of data subjects to countries outside the European Economic Area (“EEA”), which includes, in addition to the EU Member States, Norway, Liechtenstein and Iceland.
Should this be necessary to pursue the purposes of the processing described in this notice, PaNeVino guarantees that any transfers of data outside the EEA will take place in such a way as to guarantee full protection of the data subjects' rights and freedoms. Where no adequacy decision has been adopted by the European Commission with regard to the third country of destination, data transfers will be carried out by adopting the safeguards provided for by Articles 46 et seq. GDPR, including the standard contractual clauses approved by the European Commission, and a careful assessment of the legislation of the third country of destination.
7. Data Controller
PaNeVino, as Data Controller, can be contacted at the following details:
Address: Piazzale XVI Luglio 18, 27040, San Damiano al Colle (PV), Italy
Email: enotecapanevino@gmail.com
8. Rights of the data subject
Pursuant to Article 13 GDPR, PaNeVino informs you that you have the following rights in relation to your personal data:
9. Protection of your rights
To protect your rights and your personal data, you may at any time lodge a complaint with the competent supervisory authority (for Italy, the Garante per la protezione dei dati personali – Piazza Venezia, 11 - 00187 Rome; Tel. +39 06 696771; e-mail protocollo@gpdp.it) or bring an action before the competent national courts.
Without prejudice to this right, we always invite you to contact us to exercise your rights by writing to enotecapanevino@gmail.com.
10. Changes
PaNeVino reserves the right to make changes to this notice at any time, giving appropriate notice to Site users and in any case guaranteeing adequate and similar protection of personal data. In order to view any changes, you are invited to consult this notice regularly.
In any case, should PaNeVino make substantial changes to this notice (e.g. processing of personal data for different and additional purposes), it will inform data subjects by e-mail.
