Privacy Policy

Data Controller

• Azienda Agricola Saiani Francesco

• Registered Office: Via Terre Nere 16, Chizzola di Ala (TN), Italy

• VAT Number: 01582850226

• Privacy Contact Email: info@eleviumtrentodoc.com

• DPO: Francesco Saiani

• Last Updated: 16 February 2026

​

1. Introduction and Scope

This Privacy Policy provides clear and transparent information on how personal data is collected, used, stored, and protected when users visit or make purchases through the e‑commerce website operated by the Data Controller. All processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national laws.

This Policy applies to all communication channels managed by the Data Controller (website, email, newsletter, telephone).

 

2. Categories of Data Processed and Purposes

Categories of Data Processed

• Identification and contact details — e.g., first and last name, shipping and billing address, email, phone number. Purpose: fulfillment of the sales contract, delivery, and customer support.

• Payment and billing data — e.g., information necessary for issuing invoices; sensitive card data is handled exclusively by payment providers. Purpose: payment processing and compliance with tax obligations.

• Order and commercial relationship data — e.g., order history, purchased products, delivery notes. Purpose: order management, warranty handling, and after‑sales support.

• Browsing and technical data — e.g., IP address, pages visited, log data collected via cookies and similar technologies. Purpose: site functionality, security, aggregated analytics.

• Marketing and profiling data — e.g., newsletter subscriptions, expressed preferences, data used for remarketing campaigns on advertising platforms. Purpose: sending promotional communications and personalized offers (only with prior consent).

• Legal Basis for Processing: Processing is carried out on performance of a contract, legal obligations, data subject’s consent (for marketing activities, non‑essential analytics, and profiling), legitimate interest of the Data Controller (for security and fraud prevention) within the limits established by the GDPR.

 

3. Data Retention and International Transfers

Indicative Retention Periods

• Accounting and tax data: retained for the period required by tax law (e.g., 10 years).

• Order‑related data and customer history: retained for a period consistent with contractual and legal obligations (e.g., 10 years unless otherwise necessary).

• Marketing data and consent records: retained until consent is withdrawn or for a duration indicated by the data subject; if not withdrawn, retained for a reasonable period (e.g., 2 years from the last interaction).

• Browsing data and cookies: retention varies depending on the type of cookie and provider settings.

• Transfers Outside the EU: If data must be transferred to non‑EU countries, the Data Controller will implement the appropriate safeguards required by the GDPR (Standard Contractual Clauses, adequacy decisions, or other suitable safeguards) and will inform data subjects of the measures adopted.

 

4. Data Recipients and Third‑Party Responsibilities

Data may be disclosed to service providers acting on behalf of the Data Controller and operating as Data Processors. These include: website and hosting platforms, payment service providers, delivery couriers, email marketing services, analytics tools, and advertising platforms. Such parties are bound by contractual obligations ensuring the protection of personal data.

 

5. Data Subject Rights and How to Exercise Them

Data subjects may exercise their rights under the GDPR: access, rectification, erasure, restriction of processing, objection, data portability, and withdrawal of consent.

Requests may be sent to info@eleviumtrentodoc.com or addressed to DPO Francesco Saiani. Requests will be handled within the time limits established by the GDPR.

Data subjects may also lodge a complaint with the Italian Data Protection Authority.

 

6. Security and Personal Data Breaches

The Data Controller implements appropriate technical and organizational measures to protect personal data (authorized access controls, encryption of sensitive information, backups, HTTPS, software updates).

In the event of a personal data breach, the Data Controller will follow the procedures required by the GDPR and notify the Data Protection Authority and affected individuals when mandated by law.