Skip to content
MISCASALE FARM · MONTABONE, MONFERRATO
FARMMISCASALE
Search
Basket 0

Privacy notice

Notice under Article 13 of Regulation (EU) 2016/679 · version of 14 October 2026

This notice explains how personal data is processed when you visit the Miscasale website, request information, create an account or purchase from our shop. The terms of purchase are described separately in the terms of sale.

1. Data controller and contact details

The data controller is Azienda Agricola Miscasale Società Semplice Agricola, Regione Miscasale 6, 14040 Montabone (AT), Italy, tax code and VAT number 01611300052. For matters relating to your data and to exercise your rights, you can write to info@miscasale.com or to the company’s registered office; telephone 0141 762534; certified email (PEC) miscasale.ssa@pec.it.

2. Data we process and purposes

  • Requests for information and assistance: name, contact details and the content of communications, to reply to you and handle your request. The legal basis is taking pre-contractual steps or performing the contract when the request concerns a purchase; for other communications relevant to our business, it is the legitimate interest in responding and managing relations with data subjects while respecting their rights.
  • Purchases and deliveries: identifying details, email, telephone, billing and delivery addresses, products ordered, amounts, payment outcome and references and, if you choose collection at a market, the market and your preferred date. We use these to manage the order, deliver or prepare it for collection, provide assistance and issue refunds. The legal basis is performance of the contract and pre-contractual steps.
  • Administrative and tax requirements: the data needed to document transactions and fulfil legal obligations. The commercial sales document, including shipping, is placed in the parcel. The legal basis is compliance with legal obligations.
  • Optional account: profile details and credentials, processed to enable access and viewing of purchases. The legal basis is performance of the service requested. You can also purchase without creating an account.
  • Withdrawal, complaints and protection of rights: identifying and contact details, order references, the content and date of requests and the related replies. The bases are the contract, relevant legal obligations and, where necessary, the legitimate interest in establishing, exercising or defending a legal claim.
  • Product reviews: if you choose to write a review, we process the name you give, your email address, the rating, the text, the date and the link to your order, in order to check that you bought the product and to publish the review. Only the name you give, the rating, the text and the date appear on the website; your email address is not published. The legal basis is the consent you give by submitting the review: you can ask us to remove it at any time.
  • Invitation to leave a review: only if you choose this by ticking the box when you place your order, a few days after shipping we send you a single email inviting you to review the products you bought. The legal basis is consent, which you can withdraw at any time by replying to the email or writing to info@miscasale.com.
  • Visit statistics: the website uses Google Analytics to understand visits and how the website is used. Analytics is activated only after consent to the statistics category, which you can withdraw at any time from the cookie preferences. The legal basis is consent.
  • Operation and security: technical browsing data, IP addresses, access events and information needed to prevent abuse and maintain the service. The relevant bases are provision of the service requested and the legitimate interest in security, as necessary and proportionate.

There is currently no active newsletter. Purchasing does not subscribe you to promotional communications. Any new promotional processing will be accompanied by the required information and choices before it starts.

3. Required and optional data

Required data is indicated on the forms. If you do not provide the data essential for an order or delivery, we cannot perform that service. You can choose whether to create an account. Do not enter special categories of data, such as health information, or other people’s data in free-text fields unless necessary and you are authorised to disclose it.

For processing necessary for the contract or required by law, we do not ask for mandatory general consent. Any optional consents remain separate and can be withdrawn.

4. Who may receive the data

Orders and assistance are managed directly by the company; the website’s IT management is handled internally by the managing partner. Data is accessible to authorised people within the company to the extent required by their duties. It may be shared, for their respective activities, with hosting and technical support providers, payment service providers, couriers, appointed administrative or professional advisers, and authorities where required by law. Data protection roles depend on the service and the relevant agreements; when a provider processes data on our behalf, the relationship is governed as required by Article 28 GDPR.

  • Keliweb: hosting for the website and business email accounts. Shop communications are prepared by WordPress through the installed email plugin; replies are also handled manually by the company. Keliweb information.
  • PayPal and Google Pay: handling the chosen payment and related checks. The services receive the data necessary for the transaction and process further data under their own notices. Miscasale receives the information needed to verify and manage the payment, without using the data for further incompatible purposes. PayPal privacy notice and Google Payments privacy notice.
  • Bartolini/BRT, DPD group, and SDA/Poste Italiane: data needed for delivery and related communications.
  • Google: Analytics for statistics, Search Console to monitor the website’s presence in search results and Merchant Center to publish and manage product information. Google privacy notice.
  • CookieYes: recording and managing cookie choices on the website. CookieYes privacy notice.
  • Trustindex: the box showing the reviews published on our Google profile is provided by Trustindex (Budapest, Hungary), which loads scripts and images from its own servers to display it and therefore receives your IP address and technical browser data. Trustindex privacy policy.

Accounting is handled by Coldiretti, to which we normally send aggregated sales and receipts data rather than lists of named customers. When a specific requirement calls for documents containing personal data, we disclose only what is strictly necessary.

You can request the current list of providers acting on our behalf at info@miscasale.com.

5. Retention

We retain data for as long as necessary for the applicable purposes and obligations. On 12 September 2026, the company adopted a quarterly manual reviewprocedure. The following thresholds identify data to be reviewed: they are not automatic deletion deadlines.

  • Information requests not followed by a purchase: review after 12 months from the last reply; data no longer needed is deleted after first checking that there are no ongoing relationships or outstanding matters.
  • Inactive accounts: review after 24 months from the last verifiable activity, taking account of logins and purchases. The absence of an activity date is not treated as evidence of inactivity. We assess closure of a profile that is no longer needed and any advance notice, retaining separately any documents still required.
  • Unpaid or failed orders: review after 90 days from creation. Before removing data, we check for payments, transactions requiring clarification, assistance, disputes or documents that must be retained.
  • Accounting and tax documents: 10 years where mandatory, starting as provided by the applicable rule, subject to further obligations or documented needs relating to inspections and disputes. This period does not automatically extend to all account information or logs.
  • Contractual information, withdrawal, complaints and refunds: retention to manage the relationship and for as long as necessary for relevant obligations and to protect rights within the applicable limitation periods. Closing an account does not entail deletion of tax documents or contractual evidence that is still required.
  • Technical email logs: kept for 14 days for diagnostics and then deleted automatically. Communications needed for the contract or obligations are kept in the relevant archive, separate from logs.

At each review, any further retention is justified and a new assessment is scheduled. The check also includes emails and local copies.

Access logs and backup copies are kept by the hosting provider for the period set by its security procedures and then overwritten. Google Analytics statistics data is kept for the period set in the Google account, up to a maximum of 14 months. Records of cookie choices are kept for as long as needed to demonstrate the preference expressed.

6. External services and transfers

Some providers, such as Google and PayPal, may process data outside the European Economic Area. In these cases the transfer is based on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for certified providers, or on the standard contractual clauses approved by the Commission. You can ask about the safeguards applied by writing to info@miscasale.com. Our relationship with Keliweb, which hosts the website, is governed by its data processing agreement.

7. Cookies, statistics and links

Information about cookies and the choices available is in thecookie notice. Google Analytics and any related measurement tools are activated only with your consent. Search Console and Merchant Center are used to manage the website’s presence in search results and the product listings.

Links to YouTube, Google Maps and social media open external services with their own notices. On the new website, videos and maps are presented as explicit links, without automatically loading their embedded players or maps.

8. Your rights

In the cases and within the limits provided for by Articles 15–22 GDPR, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interest on grounds relating to your situation and, where applicable, to direct marketing. You may withdraw consent without affecting the lawfulness of processing carried out before withdrawal.

Write to info@miscasale.com. We respond within the required time limits, normally within one month; any justified extensions are communicated in accordance with Article 12 GDPR. We may request the proportionate information needed to verify your identity. Erasure may be limited by legal obligations and other applicable exceptions.

You may lodge a complaint with the Italian Data Protection Authority or the competent authority and use the other remedies available.

9. Automated decisions and updates

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. Payment services may carry out their own fraud checks on transactions under their respective privacy notices.

This notice will be updated when services and processing change; the version date appears at the start.