1. Data Controller

Ristorante Crotto Valtellina
Via Fiume, 11 – 21046 Malnate (VA)
Phone: +39 0332 427258
Email: info@crottovaltellina.it

The Controller ensures compliance with personal data protection regulations (EU Regulation 2016/679 – GDPR).

2. Types of Data Processed

The website may collect and process the following types of data:

• Browsing data: IP address, browser type, operating system, time spent, pages visited (automatically collected through analytics tools).
• Data voluntarily provided by the user: name, surname, email address, shipping/billing address, and phone number during registration or purchase via WooCommerce.
• Cookies and tracking tools: the site uses technical and analytical cookies (Google Analytics, Google Tag Manager) and third-party cookies (Google Maps).

For more information, please refer to the Cookie Policy.

3. Purpose of Processing

Personal data are processed for the following purposes:

1. Provision of website services, in particular:
   • management of online orders and purchases through WooCommerce;
   • creation and management of user accounts.
2. Compliance with legal obligations (fiscal, accounting, contractual).
3. Anonymous statistical analysis of site usage (via Google Analytics).
4. Security and improvement of online services.

4. Legal Basis for Processing

The legal bases for data processing are as follows:

• Performance of a contract or pre-contractual measures (Art. 6, para. 1, lett. b GDPR) for orders and account registration.
• Compliance with legal obligations (Art. 6, para. 1, lett. c GDPR).
• Legitimate interest of the Controller (Art. 6, para. 1, lett. f GDPR) for anonymous statistical analysis and website security.

5. Data Processing Methods

Data are processed electronically and digitally, with appropriate security measures in place to ensure confidentiality and integrity.

No automated decision-making or profiling is carried out for commercial purposes.

6. Data Retention

• Order and billing data are kept for the period required by legal and tax obligations (normally 10 years).
• User account data are stored until a deletion request is made.
• Anonymous browsing data (e.g., Google Analytics) are retained according to service settings, typically for 14 months.

7. Data Communication and Disclosure

Data may be communicated to:

• technical service providers (hosting, maintenance, WooCommerce, email providers);
• consultants and professionals (accountants, tax consultants);
• public authorities within the limits set by law.

Data are not disclosed to unspecified third parties.

8. Data Transfer Abroad

Some data may be processed by service providers located outside the European Union (e.g., Google LLC for Analytics and Maps).

In such cases, the transfer is carried out in compliance with Articles 44–46 of the GDPR, based on standard contractual clauses or other adequate safeguards.

9. Data Subject Rights

Users may exercise their rights under Articles 15–22 of the GDPR at any time, including:

• right of access to personal data;
• right to rectification or erasure;
• right to restriction or objection to processing;
• right to data portability.

To exercise these rights, please contact: info@crottovaltellina.it

The website uses technical, analytical, and third-party cookies (Google Analytics, Google Tag Manager, Google Maps).

For more details on the types of cookies used, their purposes, and how to manage consent, please refer to the table below.

11. Updates

This Privacy Policy may be subject to changes and updates over time.

The latest update was made on November 11, 2025.