Privacy notice

Version dated 1 November 2026. This notice describes personal data processing in connection with the La Màgia website under Regulation (EU) 2016/679 (GDPR).

Controller and contact

The controller is Barin Anna Maria – Azienda Agricola La Màgia, Via Grossetana 1, 58036 Sticciano Scalo (GR), Italy, VAT no. 01495500538. For information and data protection requests: info@aziendalamagia.it; +39 379 127 0440.

Data, purposes and legal bases

Enquiries: we use your name, email, optional business name, subject and message to reply and handle product or service enquiries. The basis is steps requested before a contract (Article 6(1)(b) GDPR), or our legitimate interest in handling other correspondence (Article 6(1)(f)). Account, order and delivery information is processed to perform a contract or take pre-contractual steps. Administrative and tax records are processed to meet legal obligations (Article 6(1)(c)). Payment services process transaction information under their own privacy notices; we receive the information needed to verify payment and manage orders. Never send card numbers through contact forms. IP addresses, browser information, server requests and event records support website operation and security on the basis of legitimate interests and any applicable legal obligations.

Required and optional information

Browsing data may be collected automatically. Fields marked as required are necessary to answer or provide the requested service; optional fields may be left blank. Sending an enquiry does not subscribe you to marketing. The English and German versions are information catalogues: online purchases are offered through the Italian website, with delivery to Italian addresses only.

Possible future newsletter, analytics and advertising

At the date of this notice, the new website has no newsletter service, Google Analytics or Meta/Google advertising tools integrated. Before activating them, we will update the information on purposes, providers, data, retention and transfers and collect specific, optional and withdrawable consent where required. Refusing marketing will not prevent contact or purchases. Newsletter consent will be separate from analytics and advertising choices and, where applicable, tracking of email opens. Information about WhatsApp enquiry or update channels will be provided before joining; the provider's privacy notice also applies.

Recipients and external services

Authorised staff and, where necessary, hosting, maintenance, email and payment providers, advisers and couriers may process data under the responsibilities applicable to their services. GLS, BRT and SDA may be used for shipping. Pages may load Google Maps and Unsplash images, communicating technical data such as IP addresses and request information. See the Google and Unsplash privacy notices. Facebook, Instagram and WhatsApp links lead to services with their own notices. Transfers outside the EEA require an appropriate basis and safeguards under Chapter V GDPR; contact the controller for information about the providers and safeguards actually used.

Retention

Enquiry data is kept to handle the correspondence and follow-up, then deleted when no longer needed, subject to documented needs to protect legal rights. Account information is retained for the relationship and further periods justified by law or legal claims. Accounting records are normally kept for ten years, in accordance with applicable law. Technical data is retained proportionately to operation, security and incident management. Cookie lifetimes are described in the cookie notice.

Rights and complaints

Where the GDPR applies, you may request access, rectification, erasure, restriction and portability, object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing. Erasure may be limited by legal retention duties or other legal conditions. Send requests to info@aziendalamagia.it. We respond without undue delay, normally within one month; any permitted extension will be explained. You may complain to the Italian data protection authority, Garante per la protezione dei dati personali, and seek a judicial remedy.

Cookies, updates and spam prevention

Read the cookie notice for technologies and preferences. This notice will be updated when processing changes. Local form protection uses a hidden field, time checks and limits on repeated submissions. A keyed IP fingerprint is retained temporarily for these limits, without storing the clear-text IP in that counter. The blocking period is 15 minutes from the last counted attempt. Anti-replay tickets last two hours; expired records are removed by WordPress scheduled tasks. These controls are not used for advertising. Google reCAPTCHA v3 is prepared but disabled until the controller enters and enables the keys. When enabled, it is called on protected form submission and may send IP, browser and device data to Google and use cookies or similar technologies. Before public activation, the controller must update this notice and check the actual configuration, transfers, terms and consent management. Google's privacy notice and terms apply.

Privacy notice · Cookies and preferences · Google Privacy · Google Terms · Unsplash Privacy · Garante Privacy