Privacy Policy

PRIVACY POLICY PURSUANT TO ARTICLE 13 OF EUROPEAN REGULATION 2016/679

Please read the following privacy notice carefully. It has been prepared pursuant to Article 13 of the General Data Protection Regulation (hereinafter also referred to as the “GDPR”) and provides all details regarding the processing of your data collected through the website https://www.vinicum.com/it/ (hereinafter also referred to as the “website”).

Personal Data are processed by the Data Controller in accordance with applicable legislation. In particular, in order to ensure the security of your data, taking into account the state of the art and the costs of implementation, as well as the nature, scope, context and purposes of the processing, and the risk of varying likelihood and severity for the rights and freedoms of our users, we have adopted appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

Data Controller

The Data Controller is GIV S.p.A., with registered office at Villa Belvedere, Calmasino – Bardolino (VR), hereinafter (“GIV” or the “Data Controller”). The Data Controller can be contacted at: support@vinicum.com.

PURPOSES OF PERSONAL DATA PROCESSING AND LEGAL BASIS

Contractual purposes

The Personal Data provided will be used for the purposes of assistance, management, performance and/or conclusion of the sales contract. The legal basis for the processing of your data is the performance of a contract or the taking of steps prior to entering into a contract (Article 6(1)(b) GDPR).

The provision of your personal data for this purpose is optional; however, failure to provide such data will prevent us from providing the relevant service.

Administrative and accounting purposes

Following a purchase, your data will be processed for administrative and accounting purposes related to order management, as well as to comply with obligations laid down by applicable legislation. The legal basis for the processing of your data is compliance with a legal obligation (Article 6(1)(c) GDPR).

Marketing purposes

Personal Data will be processed, subject to your freely given consent, for the purpose of sending you commercial communications relating to offers and products. The legal basis for the processing of your data is your freely given consent (Article 6(1)(a) GDPR).

Account creation

Your data will be processed in order to create a personal account, allowing you to make purchases through our e-commerce website. The legal basis for the processing of your data is the performance of a contract or the taking of steps prior to entering into a contract (Article 6(1)(b) GDPR).

Tracking pixels

GIV S.p.A. newsletters contain tracking pixels. Email tracking pixels (or tracking pixels) consist of images, often transparent and extremely small in size—just one pixel—which are not directly embedded in the email concerned but are hosted on remote servers. When an email containing a tracking pixel is opened, HTML code automatically triggers a command that sends a request to the sender’s server. In response to this request, the image is downloaded by the recipient’s email client (specific software or a browser) and stored in the memory of the data subject’s device so that it can be “displayed” in the body of the email. This technical process allows the sender to obtain information as to whether the messages sent have been opened and viewed. The legal basis for the processing of your data is your freely given consent (Article 6(1)(a) GDPR).

Legal defence

The processing is necessary for the establishment, exercise or defence of legal claims. The legal basis for the processing of your data is legitimate interest (Article 6(1)(f) GDPR).

RETENTION PERIODS AND CATEGORIES OF DATA PROCESSED

For the purposes of direct marketing and monitoring commercial communications, the Data Controller will process personal data until consent is withdrawn and, in any event, for a maximum period of 24 months from the date on which consent was given.

COMMUNICATION AND DISCLOSURE OF PERSONAL DATA

Personal Data are processed by the Data Controller and its personnel, or by parties delegated and/or appointed by the Data Controller to carry out activities strictly related to the pursuit of the stated purposes, acting as Data Processors. Special categories of data may be disclosed to:

law enforcement agencies or judicial and/or administrative authorities, in accordance with the law and following a formal request from such parties, or where there are reasonable grounds to believe that the disclosure of such data is reasonably necessary to (1) investigate, prevent or take action regarding suspected unlawful activities or assist state supervisory and regulatory authorities; (2) defend against any claim or allegation by third parties, or protect the security of the website and the company; or (3) exercise or protect the rights, property or safety of the Data Controller, companies belonging to the same group, its affiliates, its customers, its employees or any other party;

public or private parties that may access Personal Data pursuant to provisions of law, regulations or European Union legislation, within the limits laid down by such rules.

Personal Data will not be transferred outside the European Economic Area.

RIGHTS OF THE DATA SUBJECT

In accordance with the GDPR, the Data Subject has the right to request from the Data Controller access to their personal data, or the rectification or erasure of such data, or restriction of processing concerning them; they also have the right to object to the processing of such data and the right to request data portability, as provided for under Articles 15–21 of the GDPR.

Requests may be sent by email to support@vinicum.com.

The Data Controller, or any person appointed by it, will fulfil the request within 30 days from the date of receipt. Where the response is complex, this period may be extended by a further 30 days, subject to timely notification to the Data Subject.
If you consider it appropriate to exercise your rights, you may lodge a complaint with the competent supervisory authority, namely the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), based at Piazza Venezia 11, Rome.

REVISION

This privacy notice was published in October 2026 and may be amended over time, including in connection with the possible entry into force of new sector-specific legislation, the updating or provision of new services, or technological developments.