Privacy Policy

1. Data Controller

FRANTOIO MANESTRINI DI NICOLETTA MANESTRINI
Via Paolo ed Enrico Avanzi 7, 25080 Soiano del Lago (BS)
Email: info@manestrini.it

2. Types of data collected

During browsing the following data may be collected:

• Navigation data (IP, browser, pages visited, access time)
• Voluntarily provided data (name, email, message via form)
• Technical identifiers (cookies, session ID)
• Advertising identifiers (if analytics or advertising services are active)

3. Purposes and legal basis of processing

The table summarises the main processing purposes, categories of data, legal basis and retention criteria applicable to the website.

External technical resources and fonts

The website may use external technical resources, such as fonts, stylesheets or libraries loaded from third-party providers, necessary for the proper graphic display and operation of the interface. Loading these resources may involve transmitting technical data to the provider, such as IP address, browser information, requested URL and referrer. Listed domains/providers: fonts.googleapis.com, fonts.gstatic.com, Font Awesome / Fonticons. These resources are not normally cookies and are not used, by themselves, for analytics or marketing purposes.

Contact form

Legal basis: Art. 6(1)(b) GDPR — pre-contractual measures at the request of the data subject.

Form data (name, email, message) is processed to respond to the request. It is not publicly disclosed and may be processed by technical providers or authorised persons supporting the Controller in website and communication management, where necessary and under GDPR-compliant arrangements. Retention: 24 months from last contact.

Newsletter and commercial communications

Legal basis: Art. 6(1)(a) GDPR — explicit consent of the data subject.

With explicit consent, contact data is used for newsletters and commercial communications. Subscription via double opt-in. Revocable at any time.

For the technical management of subscriptions, the Controller uses Mailchimp / Intuit, which may process personal data on behalf of the Controller.

Reserved area and user registration

Legal basis: Art. 6(1)(b) GDPR — performance of contract.

Registration data is retained until account deletion or user request.

4. Third-party services

The website uses the following third-party services that may process data on behalf of or independently from the Controller:

Google Analytics 4 — Google Ireland Limited / Google LLC

Web visit analytics service. Data processed: sessions, pages visited, anonymous data. Legal basis: Art. 6(1)(a) GDPR (consent). Extra-EU transfer with adequate safeguards (EU-US DPF). Privacy Policy

Google Tag Manager — Google Ireland Limited / Google LLC

Conditional tracking script management. Does not collect its own data but enables conditional tag loading based on consent. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Privacy Policy

Google Maps — Google Ireland Limited / Google LLC

Embedded geographic maps. Data: IP, map interactions. Legal basis: Art. 6(1)(a) GDPR (consent). Extra-EU transfer. Privacy Policy

Meta Pixel — Meta Platforms Ireland Limited / Meta Platforms, Inc.

Conversion tracking and remarketing for Facebook/Instagram. Data: user actions, device identifiers. Legal basis: Art. 6(1)(a) GDPR (consent). Privacy Policy

Mailchimp / Intuit — mailchimp.com

Newsletter management: subscription collection, delivery, consent proof. Legal basis: Art. 6(1)(a) GDPR. Privacy policy

WooCommerce Order Attribution / Sourcebuster (manestrini.it)

Cookie: sbjs_current, sbjs_current_add, sbjs_first, sbjs_first_add, sbjs_migrations, sbjs_session, sbjs_udata

5. Transfer of data outside the EU

Some providers transfer data outside the EU with the following safeguards:

• European Commission adequacy decisions (Art. 45 GDPR)
• Standard contractual clauses (Art. 46 GDPR)
• EU-US Data Privacy Framework, where applicable

6. Data retention

Personal data is retained for the following periods:

• Navigation data and technical logs: 12 months
• Contact data (form): 24 months from last contact
• Account registration data: until deletion or user request
• Tax/billing data (e-commerce): 10 years due to legal obligations
• Third-party cookies: according to the respective provider policy

7. Data security and data breach

The Controller adopts adequate technical and organisational measures (Art. 32 GDPR). In the event of a data breach with risk for data subjects, the Controller notifies the supervisory authority within 72 hours (Art. 33 GDPR) and, where necessary, the data subjects (Art. 34 GDPR).

8. Rights of the data subject

Pursuant to Arts. 15-22 GDPR, you have the right to:

• Access your personal data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure — right to be forgotten (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time (Art. 7)

To exercise your rights: info@manestrini.it

9. Supervisory authority

You may lodge a complaint with the competent supervisory authority:

In Italy: Garante per la Protezione dei Dati Personali — www.garanteprivacy.it

10. Definitions

Personal data

Any information identifying a natural person (Art. 4 no. 1 GDPR)

Data Controller

Entity determining purposes and means of processing (Art. 4 no. 7 GDPR)

Data Processor

Entity processing data on behalf of the Controller (Art. 28 GDPR)

Data subject

The natural person to whom the data relates (Art. 4 no. 1 GDPR)

Processing

Any operation on personal data (Art. 4 no. 2 GDPR)

Consent

Freely given, specific, informed indication of agreement (Art. 4 no. 11 GDPR)

Data breach

Security breach leading to loss or unauthorised access to data (Art. 4 no. 12 GDPR)

11. Changes to this policy

This policy may be updated at any time. The date shown at the top indicates the current version.

For cookie details please refer to the Cookie Policy.