PRIVACY POLICY

• 1) Introduction
• 2) Data controller
• 3) Personal data we collect
• 4) Purposes and legal bases for processing
• 5) Newsletter
• 6) Cookies and website tracking
• 7) Google reCAPTCHA
• 8) Security of personal data
• 9) Disclosure of personal data
• 10) International data transfers
• 11) Data retention
• 12) Provision of data
• 13) Your data protection rights
• 14) Changes to this Privacy Policy
• 15) Legal references

1) Introduction

Protecting your personal data is important to us. We process data in accordance with Regulation (EU) 2016/679 (GDPR), Italian Legislative Decree No. 196/2003, as amended, and applicable rules on cookies and electronic communications.
This policy covers our website, B2B online shop, contact requests, baking course registrations and newsletters.

2) Data controller

MOLINO MERANO SRL
Industrial Zone 7
39011 Lana (BZ), Italy
Tax identification and VAT number: 00683450217
Email: info@molinomerano.it

3) Personal data we collect

Depending on the services used, we process in particular:
- names, addresses, email addresses and telephone numbers;
- company name, business activity, VAT number and business contact details;
- registration and account details, technically protected login credentials;
- orders, delivery, billing and payment information;
- for courses, name, address, email and telephone number;
- newsletter subscriptions, consent records, opening, click and interest data;
- technical access and usage data, such as IP address, browser information and online identifiers.
During registration, users may also be asked how they heard about our company.

4) Purposes and legal bases for processing

When you visit our website we process technical information needed to operate and secure it (Article 6(1)(f) GDPR).
Our online shop serves business customers (B2B). An account is required to order; guest checkout is not available. We process registration, company, address and order data to manage accounts, contracts and deliveries. Legal bases are Article 6(1)(b) GDPR for contracts with data subjects and Article 6(1)(f) GDPR for contacts at corporate customers. Statutory tax and accounting processing is based on Article 6(1)(c) GDPR. Marketing consent is optional.
Credit card and PayPal are available for payment. Required payment data is provided to the payment providers involved; PayPal processes certain data as an independent controller.
For private customers registering for baking courses or events, we process name, address, email and telephone number for organisation and performance (Article 6(1)(b) GDPR).
Contact requests by form, email or phone are handled under Article 6(1)(b) GDPR if contract-related and otherwise Article 6(1)(f) GDPR (legitimate interest in responding).

5) Newsletter

We use ActiveCampaign and a double opt-in process with subscription confirmation. We process contact information, consent records and opening, click and interest data to send, analyse and improve communications. Consent-based processing relies on Article 6(1)(a) GDPR and applicable Italian electronic marketing rules.
Consent may be withdrawn at any time for the future, including via the unsubscribe link. According to the information provided, we do not email promotional messages to existing customers without a newsletter subscription.

6) Cookies and website tracking

Our site uses strictly necessary cookies and similar technologies, for example for login, sessions and shopping baskets. We also use Google Analytics 4 for website analytics, Google Ads for online advertising and Meta Pixel to measure campaigns on Facebook and Instagram. Technical data, online identifiers, page views and interactions may be processed.
Where consent is required, these technologies may only be used after valid consent (Article 6(1)(a) GDPR together with Article 122 of the Italian Data Protection Code). Consent must be withdrawable at any time for the future. Our separate Cookie Policy provides details on providers, cookies and retention periods.

7) Google reCAPTCHA

We use Google reCAPTCHA to protect registration against automated submissions and misuse. Technical information about the device, request and site interactions may be processed. Article 6(1)(f) GDPR (legitimate security interest) may apply, subject to additional rules governing technologies on users’ devices.

8) Security of personal data

We implement appropriate technical and organisational measures under Article 32 GDPR to protect personal data against loss and unauthorised access.

9) Disclosure of personal data

Where necessary, data may be disclosed to authorised providers and recipients for IT, accounting, payments, deliveries and communications. Systems and services used include ActiveCampaign, ERGO, Odoo, PayPal and the Google and Meta services described above. Competent public authorities may receive data where required by law. Disclosures must have an appropriate legal basis.

10) International data transfers

International providers such as ActiveCampaign, Google and Meta may process or receive personal data outside the European Economic Area. Transfers are subject to Articles 44 et seq. GDPR. Depending on the recipient, adequacy decisions (including the EU–US Data Privacy Framework for certified organisations) or other appropriate safeguards may apply.

11) Data retention

We retain data only as long as required for the relevant purpose or legal obligations. Orders, invoices and accounting records are subject to statutory retention periods. Newsletter data is generally used until unsubscribe or withdrawal of consent; necessary evidence may be kept longer. Retention for accounts, enquiries, technical data and marketing data depends on the purpose and legal requirements. Account deletion can be requested using our contact details, subject to statutory retention duties.

12) Provision of data

Some data is necessary for B2B accounts, orders, payments and course registration; without it, the service may not be available. Newsletters and consent-based marketing tracking are voluntary.

13) Your data protection rights

Where applicable under the GDPR, you have rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20) and objection (Article 21). You may object to direct marketing at any time and withdraw consent for the future, without affecting the lawfulness of previous processing. Article 22 GDPR protects against certain solely automated decisions; according to the information provided, no decisions producing legal or similarly significant effects are taken.
To exercise your rights: info@molinomerano.it. You may also complain to the Italian supervisory authority, Garante per la protezione dei dati personali: www.garanteprivacy.it.

14) Changes to this Privacy Policy

We may update this policy when our website, processing activities or legal requirements change. The current version will be published on our website.

15) Legal references

This policy reflects in particular the GDPR, the Italian Data Protection Code and applicable electronic communications rules. Updated: November 2026.