Privacy Policy

The Data Controller is:
Antico Granaio Food S.r.l.
Via Vico II La Martella, 5, 75100 Matera (MT), Italy
VAT: IT01410620775
Email: info@anticogranaio.eu

For any request regarding the processing of your personal data, please contact us at the email address above.

We collect the following categories of personal data:

Data you provide:
- Identity data: name, surname, email address, phone number
- Shipping data: full postal address
- Billing data: tax code, VAT number (where applicable)
- Account credentials: email and password (encrypted with bcrypt)

Data collected automatically:
- Browsing data: IP address, browser type, operating system, pages visited
- Technical cookies and, with your consent, analytics and marketing cookies (see Cookie Policy)

Payment data:
Credit card details are handled directly by Stripe and PayPal. We do not store card numbers or sensitive payment data on our servers.

Your data is processed for the following purposes:

a) Contract performance (Art. 6.1.b GDPR):
- Order management and fulfilment
- Payment processing
- Order status and shipping notifications
- Customer account management
- After-sales support, returns and refunds

b) Legal obligation (Art. 6.1.c GDPR):
- Tax and accounting compliance
- Order record retention for tax purposes

c) Consent (Art. 6.1.a GDPR):
- Newsletters, promotions and marketing communications (only with explicit consent)
- Analytics and marketing cookies

d) Legitimate interest (Art. 6.1.f GDPR):
- Fraud prevention
- Website and user experience improvement
- IT security

Your personal data may be shared with:
- Couriers (for order delivery)
- Stripe and PayPal (for payment processing)
- Hosting provider (for web service delivery)
- Email services (for transactional and, with consent, promotional communications)

We never sell, rent or share your personal data with third parties for their own marketing purposes without your explicit consent. Data is not transferred outside the European Economic Area (EEA), except to GDPR-compliant providers (e.g. Stripe, based in the USA, adheres to the Data Privacy Framework).

Personal data is retained only for as long as necessary:
- Order and billing data: 10 years (Italian tax obligations)
- Account data: until you delete your account
- Browsing data and logs: up to 24 months
- Marketing data (newsletter): until you withdraw consent
- Cookies: see Cookie Policy for specific durations

Under Articles 15–22 of the GDPR, you have the right to:
- Access: confirm whether your data is being processed and obtain a copy
- Rectification: correct inaccurate or incomplete data
- Erasure ("right to be forgotten"): request deletion of your data, subject to legal limits
- Restriction: limit processing in certain circumstances
- Portability: receive your data in a structured format and transfer it to another controller
- Objection: object to processing on legitimate grounds, including direct marketing
- Withdraw consent: withdraw consent at any time without affecting the lawfulness of prior processing

To exercise your rights, email info@anticogranaio.eu. We will respond within 30 days.

You also have the right to lodge a complaint with the Italian Data Protection Authority: www.garanteprivacy.it.

We implement appropriate technical and organisational measures to protect personal data, including: HTTPS/SSL encryption, bcrypt-hashed passwords, CSRF protection, role-based data access, and regular backups.

The Data Controller reserves the right to update this Privacy Policy. Any changes will be published on this page with the updated date. We encourage you to review this page periodically.