Privacy policy

This is a translation: in case of differences, the Italian text prevails. Italiano

Last updated: 1 November 2026

This policy explains how Roccafortebio società semplice agricola (“we”) processes the personal data of those who visit roccafortebio.it, make a purchase or contact us, as required by Article 13 of Regulation (EU) 2016/679 (GDPR).

Data controller

Roccafortebio società semplice agricola
Registered office: Contrada Serrafina snc, 94015 Piazza Armerina (EN)
VAT no. and tax code 01241760865
Email: info@roccafortebio.it
PEC: roccafortebio@pec.it
Phone: +39 329 706 6845

What data we process

Browsing data: IP address, browser and device type, pages visited, date and time. They are collected automatically by the systems that run and protect the website.
Form data: date, country, city, address, postcode, province, name, notes, number of people, departure point, how many people?, phone (WhatsApp), email and message.
WhatsApp messages: your number, your profile name and what you write to us, including attachments.
Emails and phone calls: your email address or your number, and what you write or tell us.
Order data: first and last name, delivery and billing address, email, phone, products, amounts and chosen delivery method. If you have a product shipped to another person, their data are used only for the delivery.

In your messages, write only what the request requires: no health data or other special categories of data, such as religious beliefs or political opinions.

Why we use the data and on what legal basis

For each use we state the legal basis, i.e. the point of Article 6(1) GDPR that permits it.

Replying to your requests and, if you ask, preparing a quote or an offer for you: pre-contractual measures taken at your request (point b).
Managing the contract arising from the request: performance of the contract (point b).
Managing the order, i.e. payment, delivery, customer support, withdrawal and warranty: performance of the contract (point b) and legal obligations (point c).
Replying to other messages, for example a report or a job application: legitimate interest in replying to those who write to us (point f).
Complying with legal obligations, for example tax and accounting obligations: legal obligation (point c).
Protecting the website from abuse and automated programs: legitimate interest in security (point f).
Asserting or defending a right: legitimate interest (point f).

Mandatory and optional data

Providing your data is your choice: without the data we need, however, we cannot reply to you.

In the form you must fill in the date, the number of people and your phone (WhatsApp); the other fields are optional.

The data needed for the order are mandatory: without them, we cannot complete or deliver it.

When we ask for your consent, giving it is optional: if you say no, the website and the service still work.

How and for how long we keep the data

We process data electronically and, when necessary, on paper. Only authorised persons can see them, and we protect them with appropriate security measures.

The website has a password-protected restricted area from which Roccafortebio società semplice agricola updates its content. Visitors to the website do not access it and do not receive its cookies.

Browsing data are kept by the provider that hosts the website for as long as needed for security, according to its own rules.
Requests and messages that do not lead to a contract are kept for as long as needed to reply and to follow up the negotiation, and in any case no longer than 6 months from the last contact.
To protect the form and the restricted area from abuse, the website briefly keeps, for no more than 48 hours, a fingerprint of the IP address calculated with a secret key, which does not contain the address in plain text.
If a contract arises from the request, we keep the data for its entire duration and then for 10 years, as required by law for accounting and tax records (Article 2220 of the Italian Civil Code).
Withdrawal and warranty requests are kept together with the order documents.

Who receives the data

Data are neither sold nor disseminated. They may be received only by the following parties, each for its own part:

persons authorised by Roccafortebio società semplice agricola, bound by confidentiality;
OnlinePerTutti.com (T.H.K. Consulting Limited, Hong Kong), which built and manages the website: it processes data on our behalf, solely for the technical management of the website;
Cloudflare, Inc. (United States), which hosts and protects the website and provides the technical tools described on this page: it processes data on behalf of OnlinePerTutti.com, as its supplier;
the courier delivering the parcel, which receives the recipient's name, address and phone number;
WhatsApp Ireland Limited, if you write to us on WhatsApp: it processes messages as an independent controller (WhatsApp privacy policy);
the accountant and other advisers, banks and public authorities, when required by law or by the contract.

Data outside the European Union

Some of the suppliers listed are based outside the European Union, for example in the United States, and may process part of the data there. They do so with the safeguards provided for by the GDPR (Articles 44-46):

for US companies participating in the EU-U.S. Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795);
in other cases, the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914).

OnlinePerTutti.com (T.H.K. Consulting Limited) is based in Hong Kong, which is not covered by an adequacy decision of the European Commission. The data are stored on the systems of the suppliers listed above: T.H.K. Consulting Limited accesses them only for the technical management of the website, on our behalf.

For information on these safeguards, or a copy of them, write to info@roccafortebio.it.

Your rights

At any time you can ask us:

to see your data and obtain a copy (access, Article 15 GDPR);
to correct or complete them (rectification, Article 16);
to erase them, when they are no longer needed or the law does not require us to keep them (erasure, Article 17);
to restrict their use (restriction, Article 18);
to receive them in a machine-readable format, to transfer them elsewhere (portability, Article 20);
to object to their use based on our legitimate interest and, at any time, to their use for marketing purposes (objection, Article 21).

If you have given us your consent, you can withdraw it whenever you wish: withdrawal does not affect what we did before (Article 7(3)).

To exercise your rights, write to info@roccafortebio.it or to the certified email address (PEC) roccafortebio@pec.it. We will reply within one month. In more complex cases the deadline may be extended by a further two months: in that case we will inform you within the first month (Article 12(3)).

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22).

Complaint to the Garante

If you believe that your data are processed in a way that does not comply with the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it (Article 77 GDPR).

Which cookies and similar tools the website uses, and how you can manage them, is explained in the cookie policy.

Changes to this policy

This policy may change, for example if the website adds a feature or a regulation changes. The version in force is always this page, with the date at the top.