🛡️ Privacy Notice under Italian Legislative Decree 196/03 and EU Regulation 679/2016
Under Article 13 of Legislative Decree 196/03 and, following the entry into force of EU Regulation no. 679/2016, in accordance with Article 13 of that European Regulation, we wish to inform you of the following:
📌 Purposes of the processing
Your personal data, freely provided by you and obtained by us in connection with the activity carried out by:
Corrado Spata
Via Piano Ellera, 4 – Pedara (CT) 95030
Italian VAT number: 06003920870
Italian tax code: SPTCRD94C18C351O
will be processed lawfully and fairly for the following purposes:
– contact forms for information requests
– email for replies and for sending commercial communications
– social networks for information requests
– telephone calls to arrange an appointment at our premises
The data processed is up to date, relevant, complete and not excessive in relation to the purposes listed above, for which it is collected and subsequently processed.
🛒 Purchases through the online shop
The online shop is not yet open to customers in Italy: at present it serves customers in the Sigonella area and runs in English. Those ordering from Italy use the other channels shown on the site — WhatsApp, email and the contact form — described in the next section. This section applies to anyone who completes a purchase in the online shop.
For anyone placing an order on the online shop, the data needed to fulfil it is collected: first and last name, delivery address, town, postcode, email address and, where given, telephone number. The order details are also kept: products, quantities, amount, date and payment status.
Purpose. This data is used to carry out the purchase: to prepare and deliver the order, collect payment, send the communications concerning the order itself, and meet the accounting and tax obligations arising from it. It is not used to send commercial communications without separate consent.
Legal basis. Performance of the contract to which the data subject is party, under Article 6(1)(b) of EU Regulation 679/2016, and compliance with legal obligations under point (c) of the same article. Registration is not required in order to buy: the order can be completed as a guest.
Automated messages. On order confirmation and at every change of status, emails are sent to the address given by the customer. These are not promotional messages but service messages, necessary in order to carry out the order.
📱 Orders and enquiries by WhatsApp, telephone and contact form
If you prefer, you can order, ask for information or book a farm visit by writing on WhatsApp, calling or using the contact form on this site.
Data processed. On WhatsApp: your phone number, your name or profile name, the content of your messages and whatever is needed to prepare the order. By telephone: your number and the details given by voice, such as name, place and time of delivery and quantity. From the contact form: name, email address and the text of your message.
Purpose. To answer your enquiry, take your order, arrange and make the delivery, and handle farm visit bookings.
Legal basis. Performance of the contract, or steps taken at your request before entering into a contract, under Article 6(1)(b) of EU Regulation 679/2016.
WhatsApp. The number you write to is a telephone line answered by a person. Messages stay in the app's chat history until they are deleted. WhatsApp is a service of Meta Platforms Ireland Limited, which processes the data needed to run the service as an independent controller, under its own privacy policy: that processing is not under our control. If you prefer not to use WhatsApp, you can call, write by email or use the contact form.
Contact form. Messages sent through the form are not stored on this site: they are delivered by email to the data controller's mailbox and kept there.
Retention. Messages and contact details are kept for as long as is needed to deal with your enquiry and to manage the relationship with you as a customer. Documents concerning purchases and payments are kept for the periods required by law, set out below.
💳 Payments for orders placed in the online shop
Orders completed in the online shop are paid with PayPal. Orders taken on WhatsApp or by telephone are instead paid in cash on delivery: they do not go through PayPal, the site processes no payment data, and the seller neither receives nor keeps any bank or card details.
When paying with PayPal, the buyer is taken to PayPal’s systems, which processes the payment data as an independent controller under its own privacy policy. The seller neither receives nor stores payment card details: it receives only the outcome of the transaction and its identifier.
⭐ Product reviews
Anyone who has bought a product in the online shop can leave a review: a rating from one to five stars and free text. Only those who have bought can do so, and each review is marked as a verified purchase.
Data processed: the name given when ordering or chosen in your profile, the text of the review, the rating and the date. The email address is stored with the review but is not published.
Purpose: to publish the review on the product page, so that people considering a purchase can read it. It is the purpose for which the review is written.
Legal basis: the consent of the data subject, given by voluntarily submitting the review (art. 6(1)(a) of Regulation (EU) 2016/679).
The review is public: the name, the rating and the text are visible to anyone visiting the product page, and can be read and indexed by search engines.
How long: the review stays published until the person who wrote it asks for its removal, or for as long as the product remains in the catalogue.
How to have it removed: you can ask at any time for your own review to be changed or removed by writing to info@ailov.it. Reviews are not removed for being critical: you can ask for yours to be removed, not for someone else's.
💬 Testimonials published on the site
On the site's home page we publish testimonials from people who have bought our products. These are not the online shop reviews described in the previous section: those are written by the customer on the product page, while these we collect ourselves, usually in the conversation in which the order was placed.
Data processed: the name or initials given by the person, the text of the testimonial and the date it was given. A photograph is published only if the person has given a further, separate consent for the image.
Purpose: to show on the site the experience of those who have already bought, to those who are considering a purchase.
Legal basis: the consent of the person concerned (art. 6(1)(a) of Regulation (EU) 2016/679), given specifically for this publication. It is a different consent from the one given when sending a shop review: a review is public on the product page because that is where it is written, while appearing on the home page is a further use and must be consented to separately.
How we check them: before publishing a testimonial we verify that whoever wrote it really did order, against our own orders. We keep a record of where the testimonial and the consent were collected. We do not publish testimonials that do not come from a real customer.
How long: the testimonial stays published until the person withdraws consent or asks for its removal.
How to have it removed: you can withdraw your consent or ask for your testimonial to be removed at any time by writing to info@ailov.it. Withdrawal does not affect the lawfulness of publication that took place beforehand.
🍪 Shop cookies and third-party services
Simply visiting the pages of this site sets no shop cookie. When you add a product to the cart, WooCommerce sets three, all technical, needed to keep the cart and your session together from one page to the next: wp_woocommerce_session_… (two days), woocommerce_cart_hash, woocommerce_items_in_cart (until the browser is closed). At checkout the cart is also held in the browser’s local storage. Without this information an order could not be completed, so no consent is required; it is not used to profile visitors and does not follow you to other sites.
The shop and checkout pages also call on third-party services: PayPal for payment and Google reCAPTCHA as protection against automated form submissions. These services may process the IP address and technical device data under their own privacy notices.
WooCommerce can also record where the visit that led to the order came from, for example the site or the search you arrived from. This feature is switched off: the shop does not collect that data.
🔐 Security of access to the site
To protect the site against automated login attempts, failed logins are recorded together with the IP address, the date and time and the username used. After a number of failed attempts the address is temporarily blocked; in the same way, the number of password reset requests that can be sent from the same address is limited.
These data are used for this purpose only: they are not used for other purposes, are not disclosed to third parties and do not leave the site. The legal basis is the Controller’s legitimate interest in protecting the site, the data of those who use it and the continuity of the service. The log is kept for a maximum of twelve months, after which the oldest records are deleted automatically.
⏳ Retention of order data
Order data is kept for as long as accounting and tax obligations require, consistently with the retention periods set out below.
🛠️ How the data is processed
The data will be processed, with the necessary security and confidentiality, in the following ways: data collected from the data subject; data collected and recorded for specified, explicit and legitimate purposes; data used in further processing operations compatible with those purposes; processing carried out with the aid of electronic and automated tools (data collected electronically, directly from the data subject).
⚖️ Legal basis of the processing
The legal basis for processing your personal data is your registration on the website https://www.ailov.it.
✅ Legitimate interests pursued by the data controller
The legitimate interests pursued by the data controller in processing the data consist in the need to respect and honour the contractual obligations entered into between the parties.
Under Article 6, the lawfulness of the processing is based on the consent expressly given by the data subject and documented in writing.
Whether providing the data is mandatory or optional, and the consequences of refusing: providing your data is mandatory in order for the data controller to supply the services requested.
If you refuse, it will therefore be impossible to complete the registration process, and the system owner will not be able to fulfil its contractual obligations.
👥 Disclosure of data to third parties
Your personal data will be processed by the data controller, by the data processors it appoints and by strictly authorised persons. Your personal data is not disseminated.
Your personal data will not be publicly disseminated.
🗂️ Retention periods
Your personal data will be kept for 10 years from the end of the service or product supply relationship, in the electronic archives owned by Corrado Spata.
🌍 Transfer of data to third countries or international organisations
The data controller does not transfer, and does not intend to transfer, your personal data to a third country or to an international organisation.
👤 Data controller and data processor
📧 The data controller is Corrado Spata. Contact details of the data controller, email: info@ailov.it
The data subject may at any time exercise the rights reserved to them under Article 7, reproduced here in full:
Article 7 of Legislative Decree 196/2003 and Article 15 of EU Regulation 679/2016 – Right of access to personal data and other rights –
“The data subject has the right to obtain confirmation as to whether or not personal data concerning them exists, even if not yet recorded, and to have it communicated in intelligible form.
The data subject has the right to be informed of: the source of the personal data; the purposes and methods of the processing; the logic applied where the processing is carried out with the aid of electronic tools; the identifying details of the data controller, of the data processor and of the representative designated under Article 5(2); the entities or categories of entity to whom the personal data may be communicated or who may become aware of it as designated representative in the territory of the State, as data processors or as authorised persons.
The data subject has the right to obtain:
- the updating, rectification or, where there is an interest, the integration of the data;
- the erasure, anonymisation or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which it was collected or subsequently processed;
- confirmation that the operations referred to in points a) (updating, correction, addition) and b) (erasure, anonymisation, blocking) have been notified, including as regards their content, to those to whom the data was communicated or disclosed, except where doing so proves impossible or would involve a manifestly disproportionate effort compared with the right being protected.
The data subject has the right to object, in whole or in part: on legitimate grounds, to the processing of personal data concerning them, even where relevant to the purpose of collection; and to the processing of personal data concerning them for the purpose of sending advertising or direct-sale material, for market research or for commercial communication.”
In particular, the data subject may at any time ask the data controller for access to their personal data, for its rectification or erasure, or for the restriction of the processing concerning them, and may object to that processing; they also have the right to data portability. The data subject has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal, and the right to lodge a complaint with a supervisory authority. These rights may be exercised by writing to info@ailov.it.