Whatsapp

+39 3398081551

1. Introduction

This information is provided pursuant to Articles 13 and 14 of EU Regulation 2016/679, known as GDPR, to users who consult the website masseriapansa.it and use the related services, including the online store.

This policy concerns the processing of personal data carried out through the website. For specific information on the use of cookies and other tracking tools, please refer to the separate privacy policy. Cookie Policy, accessible via the dedicated link on the site.

2. Data controller

The Data Controller is: Alberto Stracca Pansa, operating under the commercial name Masseria Pansa

Site: Via Valignani, 4 – 65012 Cepagatti (PE) – Italy
Tax code/VAT number: 02243160682

E-mail: masseria.pansa@gmail.com
PEC: masseria.pansa@pec.it

The Data Controller may be contacted for any information regarding the processing of personal data and to exercise the rights provided by law.

3. Types of data processed

The following categories of personal data may be processed through the site:

  • identifying data, such as name and surname;
  • contact information, such as email address and telephone number;
  • billing and shipping address;
  • tax code, VAT number and other tax data, when necessary;
  • information relating to orders, products purchased, amounts and shipments;
  • data entered voluntarily in contact forms or in communications sent to the Data Controller;
  • technical and browsing data, such as IP address, date and time of access, type of device, browser used, and security logs;
  • information relating to the preferences and consents expressed by the user;
  • any data necessary for managing requests, disputes, or after-sales assistance.

Users are advised not to submit unnecessary personal data through the site's forms, particularly data belonging to special categories pursuant to Article 9 of the GDPR.

4. Purposes and legal bases of the processing

A. Navigation and operation of the site

Technical and navigation data are processed for:

  • allow the site to function correctly;
  • ensure system security;
  • prevent abuse, unauthorized access and fraudulent activity;
  • diagnose technical problems.

The legal basis is the Data Controller's legitimate interest in the security, integrity, and proper functioning of the site, pursuant to Article 6, paragraph 1, letter f), of the GDPR.

B. Purchase and order management

Personal data are processed for:

  • allow for order registration and management;
  • check product availability;
  • manage payment;
  • arrange shipping and delivery;
  • send communications relating to the order;
  • provide pre-contractual and post-sales assistance;
  • manage any returns, refunds, complaints and disputes.

The legal basis is the performance of a contract or pre-contractual measures requested by the data subject, pursuant to Article 6, paragraph 1, letter b), of the GDPR.

Providing the data marked as mandatory is necessary to complete and manage your purchase. Failure to provide it may prevent your order from being completed.

C. Administrative, accounting and tax obligations

Data relating to purchases and transactions are processed to fulfill obligations under civil, tax, accounting, and administrative regulations.

The legal basis is the fulfillment of a legal obligation pursuant to Article 6, paragraph 1, letter c), of the GDPR.

D. Payments

Payments are handled via PayPal and WooPayments (Card)

The complete card or payment instrument data is processed directly by the payment service provider, according to their terms and conditions. The website owner generally receives only the information necessary to verify the payment, such as the transaction result, amount, and reference.

The payment provider may act as an independent data controller for the activities under its jurisdiction.

E. Shipping and delivery of products

The data required for delivery, such as name, address, and telephone number, may be communicated to the courier or supplier responsible for shipping.

The legal basis is the performance of the contract, pursuant to Article 6, paragraph 1, letter b), of the GDPR.

F. Requests for information and assistance

Data transmitted via email, contact forms, or other channels is processed to respond to user requests and provide assistance.

The legal basis is:

  • the execution of pre-contractual or contractual measures, when the request concerns a purchase;
  • the legitimate interest of the Data Controller in responding to communications received, in other cases.

G. Protection of rights and prevention of fraud

The data may be processed for:

  • prevent fraud and illicit use of the site;
  • to ascertain, exercise or defend a right;
  • manage disputes and requests from the competent authorities.

The legal basis is the Data Controller's legitimate interest in protecting its rights and ensuring the security of its business, pursuant to Article 6, paragraph 1, letter f), of the GDPR.

H. Promotional communications

If the site allows subscription to a newsletter or the sending of promotional communications, the data will be used for these purposes exclusively on the basis of the interested party's consent, except in cases expressly permitted by law.

The legal basis is consent, pursuant to Article 6, paragraph 1, letter a), of the GDPR.

Consent may be revoked at any time using the link provided in communications or by writing to the Data Controller. Revocation does not affect the lawfulness of the processing carried out before its revocation.

This section may be deleted if newsletters or promotional communications are not sent.

5. Processing methods and security measures

Personal data is processed using computerized tools and, where necessary, on paper, according to the principles of lawfulness, fairness, transparency, data minimization, and storage limitation.

The Data Controller adopts appropriate technical and organizational measures to protect data from loss, destruction, alteration, unauthorized access, or unlawful processing.

However, no computer system can guarantee absolute security. Users are therefore advised to use strong passwords and not share them with third parties.

6. Data recipients

Personal data may be disclosed, to the extent necessary, to the following categories of subjects:

  • personnel and collaborators authorized by the Owner;
  • website hosting and maintenance service providers;
  • suppliers of the e-commerce platform and related plugins;
  • payment service providers;
  • couriers and logistics operators;
  • accountants, tax, legal and technical consultants;
  • email, backup, and IT security service providers;
  • public bodies, judicial or administrative authorities, in the cases provided for by law;
  • other technical providers indicated in the Cookie Policy, where applicable.

These entities process the data, as applicable, as data processors pursuant to Article 28 GDPR or as independent data controllers.

Personal data will not be disclosed unless required by law.

7. Data transfers outside the European Economic Area

Some technical providers may be based in or use infrastructure located outside the European Economic Area.

In such cases, the transfer will take place in compliance with Articles 44 et seq. of the GDPR, on the basis of an adequacy decision by the European Commission, standard contractual clauses, or other guarantees provided by applicable law.

Further information on the transfers made by individual providers can be requested from the Data Controller or consulted in the information notices for the respective services.

This section should be verified based on the services actually used by the site.

8. Retention periods

Personal data are stored for different periods depending on the purpose for which they were collected:

  • data relating to orders, invoices, and accounting and tax obligations: for the period required by applicable legislation, normally up to ten years, except for further periods necessary in the event of checks or disputes;
  • data relating to order management and shipping: for the time necessary to execute the contract and, subsequently, for the management of guarantees, complaints and defense of rights;
  • requests for information without contractual follow-up: for the time necessary to respond and, indicatively, no longer than 24 months, unless further needs arise;
  • data used for promotional purposes: until consent is revoked or, in any case, for the period established by the Data Controller based on proportionality criteria;
  • Technical data and security logs: for the period necessary for the security and technical management of the site, unless further retention is required for investigations or legal obligations;
  • consent records: for the period necessary to demonstrate the correct acquisition of consent and to protect the Data Controller.

Upon expiration of the respective periods, the data will be deleted, anonymized, or retained exclusively when required by law.

9. Cookies and other tracking tools

Information relating to cookies, tracking tools, third-party services and the ways in which the user can express or modify their preferences are contained in the separate Cookie Policy of the site.

The site owner remains required to provide access to a cookie policy consistent with the services actually installed, even when the page and banner are generated via a plugin. 

10. Rights of the interested party

The interested party may exercise, in the cases provided for by Articles 15 to 22 of the GDPR, the following rights:

  • obtain confirmation as to whether or not personal data is being processed;
  • obtain access to data and information relating to the processing;
  • request the rectification of inaccurate data or the integration of incomplete data;
  • request the deletion of data, when the conditions established by law apply;
  • request the limitation of processing;
  • receive the data in a structured, commonly used and machine-readable format, where applicable;
  • object to processing based on legitimate interest;
  • object at any time to processing for direct marketing purposes;
  • withdraw consent, without prejudice to the lawfulness of the processing prior to the withdrawal;
  • not to be subject to a decision based solely on automated processing which produces legal effects concerning you or significantly affects you, except where provided for by law.

The right to erasure does not apply when retention is necessary to comply with a legal obligation, establish or defend a right, or for other reasons provided for by the GDPR. Data subjects' rights and the methods of exercising them are governed by Articles 15-22 of the Regulation. 

11. How to exercise your rights

Requests can be sent to:

masseria.pansa@gmail.com

The Data Controller may request the information necessary to verify the applicant's identity.

Feedback will be provided within the timeframes established by applicable legislation.

12. Right to complain

If you believe the processing of your personal data violates the law, you may file a complaint with:

Guarantor for the protection of personal data

Furthermore, the possibility of appealing to the competent judicial authority remains intact.

13. Automated decision-making processes

Unless otherwise indicated, the site does not adopt decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect the data subject.

14. Changes to the information

The Data Controller may update this policy to reflect regulatory, technical, or organizational changes.

The updated version will be posted on this page with the revision date indicated.

Last updated: July 2026

Categories