Privacy Policy
Last updated: 12 October 2026
This Privacy Policy explains how we collect and use personal data when you visit www.toppetta.it, book a table, request a wine tasting, contact us or buy from our online shop. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended).
1. Data controller
Tenuta Poggio alla Sala Società Agricola S.r.l., VAT no. (P.IVA) 01560930529, Via delle Chiane, 3, SP30, 53045 Montepulciano (SI), Italy. Email: in**@******ta.it; telephone +39 0578 757110.
You can contact us about data protection at in**@******ta.it.
2. What data we collect and why
2.1 Restaurant table bookings
When you use the “Book your table” form we collect: name, email address, telephone number, number of people, date and time, your message and your confirmation that you have read this policy. We use this data to handle your booking request, confirm it and contact you about it.
Legal basis: steps taken at your request before entering into a contract, and performance of that contract (Art. 6(1)(b) GDPR). If you tell us about allergies or dietary needs in the message, we use that information only to prepare your visit, on the basis of your explicit consent (Art. 9(2)(a) GDPR).
2.2 Wine tasting requests
When you use the “Wine tasting” form we collect: name, email address, number of people, preferred date, your message and your confirmation that you have read this policy. We use this data to arrange the tasting and reply to you. Legal basis: pre-contractual steps and performance of a contract (Art. 6(1)(b) GDPR).
2.3 Contact form and email
When you use the contact form we collect: name, surname, email address, telephone number (optional), your message and your confirmation that you have read this policy. If you write to us by email or call us, we process the data you give us. We use this data to answer your request. Legal basis: our legitimate interest in replying to enquiries (Art. 6(1)(f) GDPR), or pre-contractual steps where your request concerns a purchase or a booking (Art. 6(1)(b)).
2.4 Online shop orders
When you order from our shop we collect the data needed to process and deliver your order: name, billing and delivery address, email address, telephone number, the products ordered, any order notes, and payment information. We may also keep a record of the channel through which you reached our site (WooCommerce order attribution), but only if you have consented to statistics cookies.
Payment is currently by bank transfer: we receive your payment details from your bank when you pay. We do not store payment card data. If you have a customer account, we also process your login details and your order history.
Legal basis: performance of the sales contract (Art. 6(1)(b) GDPR) and compliance with our tax and accounting obligations (Art. 6(1)(c) GDPR).
2.5 Age verification
Because we sell wine, the site asks you to confirm that you are of legal drinking age (18 or over). We store only your answer, in a cookie on your device (“age_gate”), so that we do not ask again. Legal basis: compliance with legal obligations on the sale of alcohol and our legitimate interest in not addressing minors (Art. 6(1)(c) and (f) GDPR).
2.6 Browsing data, security and anti-spam
Our web server automatically records technical data such as your IP address, browser type, the pages requested and the date and time, in order to deliver the site and keep it secure. Our forms are protected by CleanTalk Anti-Spam, which checks form submissions and some browser information (for example, the time taken to fill in a form) for signs of automated spam. Legal basis: our legitimate interest in the security of the site and in protecting it from abuse (Art. 6(1)(f) GDPR).
2.7 Analytics (only with your consent)
With your consent, we use Google Analytics 4 to understand how the site is used (for example, pages visited and how visitors arrive) and WooCommerce order attribution to see which channels lead to orders. These tools are loaded only after you click “Accept” or enable “Statistics” in the cookie banner. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via “Manage consent”. For more information, see our Cookie Policy.
2.8 Maps and fonts
Some pages include a Google Maps map. The map is loaded only after you give your consent, and Google then receives your IP address and may set cookies. Some fonts on the site are loaded from Google Fonts, which also receives your IP address when the page loads. Legal basis: your consent for Google Maps (Art. 6(1)(a) GDPR); our legitimate interest in displaying the site correctly for Google Fonts (Art. 6(1)(f) GDPR).
3. Is providing data mandatory?
Fields marked as required in our forms and at checkout are needed to handle your request or order; without them we cannot process it. Other fields are optional. Consent to analytics cookies is entirely optional and does not affect your use of the site.
4. How long we keep your data
- Booking and tasting requests: for the time needed to manage the booking, and then for up to 12 months.
- Contact requests: for the time needed to reply, and then for up to 12 months.
- Orders and invoices: 10 years, as required by Italian tax and accounting law (Art. 2220 Civil Code).
- Server and security logs: up to 6 months.
- Analytics data (Google Analytics): up to 14 months.
- Cookies: see the expiry periods in our Cookie Policy.
5. Who receives your data
Your data is processed by our authorised staff and by the following service providers acting as data processors on our behalf, or as independent controllers where indicated:
- Website hosting and email: our hosting provider, located in the EU.
- Website development and maintenance: IT service providers who maintain the website, when they need access to it.
- CleanTalk Inc. (anti-spam).
- Google Ireland Limited (Google Analytics, Google Maps, Google Fonts).
- Couriers we use for delivery, to deliver your orders.
- Banks, to process payments (independent controllers).
- Our accountant and tax advisers, and public authorities where required by law.
We do not sell your personal data, and we do not use it for automated decision-making or profiling.
6. Transfers outside the European Union
Some providers (Google, CleanTalk) may process data outside the European Economic Area, including in the United States. In that case, transfers rely on an adequacy decision (for example, the EU–US Data Privacy Framework, for providers certified under it) or on the European Commission’s Standard Contractual Clauses (Art. 45–46 GDPR).
7. Your rights
You have the right to:
- access your personal data and obtain a copy of it (Art. 15 GDPR);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on our legitimate interests (Art. 21);
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).
To exercise your rights, write to in**@******ta.it. We will reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.
8. Minors
Our site and our shop are intended for adults of legal drinking age (18 or over). We do not knowingly collect data from minors. If you believe a minor has sent us personal data, please contact us and we will delete it.
9. Security
We use appropriate technical and organisational measures to protect your data, including an encrypted (HTTPS) connection, access restricted to authorised staff, and anti-spam protection.
10. Changes to this policy
We may update this Privacy Policy when our services or the law change. The date at the top shows the latest version. We will tell you about significant changes on the site.
