Privacy Policy



This notice, made under the current national and EU legislation on the processing of personal data, covers the website (also “Site” below).
The policy is intended for all persons who access the Site (below also “Users” or, individually, “User”) and is made only for the data acquired as a result of consultation of the Site. This policy also does not refer to other websites that may be reachable and accessible by the user through the hyperlinks (links) that may be contained in the Site.
The “owner” of the data processing, relating to persons identified or identifiable who access this Site is TENUTA CANTO TO MORAY SRL, C.F./ P.IVA 02359010515, in person of the legal representative pro tempore, based in CASTIGLION FIBOCCHI (AR), VIA SETTEPONTI 53.
The computer systems and computer programs used to operate the site collect some personal data whose transmission is implicit in the use of Internet communication protocols (e.g. IP addresses or domain names of the computers used by users connecting to the site, the URI-Uniform Resource Identifier addresses of the requested resources, time of the request, method used in submitting the request to the server, file size obtained in response, numeric code about the status of the response rendered by the server -good end, error, etc.- and other parameters related to the operating system and the user’s computer environment). Although this information is not collected to be associated with identified stakeholders, by their nature they could, through processing and associations with data held by third parties, allow to identify users.
This data is used for the sole purpose of obtaining statistical information not associated with any identifying data of the user on the use of the site and to check that it is working correctly and is deleted immediately after processing. The data could be used to ascertain liability in case of hypothetical cybercrime against the Site.


Per la sola consultazione del sito non è richiesto alcun conferimento di dati personali da parte dell’utente.

Tuttavia, eventuali contatti con il titolare del trattamento, o l’invio facoltativo, esplicito e spontaneo di messaggi, di posta elettronica o tradizionale, ai recapiti indicati sul sito comportano la successiva acquisizione dell’indirizzo, anche e-mail, del mittente o della relativa numerazione telefonica, necessari per rispondere alle richieste, nonché di eventuali altri dati personali inseriti nelle relative comunicazioni.

Tali dati saranno utilizzati al solo fine di dar seguito alla richiesta dell’utente e potranno essere comunicati a terzi solo nel caso in cui ciò sia necessario a tal fine.

Per l’utilizzo della sezione del sito dedicata all’e-commerce (acquisti on-line) verrà, invece, richiesto all’interessato di fornire i seguenti dati: email; nome; cognome; numero di telefono; indirizzo; nazione; CAP; città; ragione sociale; Codice Fiscale/Partita IVA; provincia; indirizzo di fatturazione; indirizzo di spedizione; numero civico. Dettagli each type of data collected is provided in the dedicated sections of this privacy policy or through specific informational texts displayed before the data is collected.

The processing of such data is necessary for the execution of a contract of which the person is a part or to carry out pre-contractual measures taken at your request (art. It is not the first time that the European Parliament has been involved in this debate. , when the person can reasonably expect treatment to take place for this purpose).

The processing of data for the purpose of sending newsletters or promotional communications via e-mail will, on the other hand, be carried out only where the user has expressed his specific consent for that purpose.


Payment management services allow this website to process payments by credit card, bank transfer or other tools. The data used for payment is acquired directly from the requested payment service provider without being treated by this Website in any way.

Some of these services may also allow scheduled messages to be sent to you, such as emails containing invoices or payment notifications.

The Treatment Holder uses the payment service provided by PayPal Inc (Paypal) for the e-commerce platform, which allows you to make online payments and is invited to consult the privacy policy at the following link (Privacy Policy) for more information.


The Owner treats Personal Data relating to you if one of the following conditions is true:

– You have given consent for one or more specific purposes; Note: In some jurisdictions, the Holder may be authorized to process Personal Data without the consent of you or another of the legal bases specified below, until you opt out of such treatment. However, this is not applicable if the processing of Personal Data is regulated by European Personal Data Protection Legislation;

– treatment is necessary for the execution of a contract with you and/or the implementation of pre-contractual measures;

– treatment is necessary to fulfil a legal obligation to which the Holder is subject;

– treatment is necessary for the execution of a public interest task or for the exercise of public powers of which the Holder is invested;

– treatment is necessary for the pursuit of the legitimate interest of the Holder or third parties.

However, it is always possible to ask the Owner to clarify the concrete legal basis of each treatment and in particular to specify whether the treatment is based on the law, provided for by a contract or necessary to conclude a contract.


Treatments related to the services of the Site take place at the aforementioned headquarters of the Owner. The data is processed through the servers of the site’s hosting service provider, which is currently Aruba spa.


The processing of the data will take place, by the staff appointed by the owner with procedures, technical and IT tools suitable to protect the confidentiality and security of your data and consists of their collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, dissemination, destruction of the same including the combination of two or more of those activities.


The Owner will use the data provided voluntarily by the User to fulfill the user’s requests.

You are not required to provide your personal information, but if you refuse, the Holder may not be able to comply with your requests.


Personal data will be stored in a form that allows the identification of the user for a period of time no more than the achievement of the purposes for which it is treated, and in any case in accordance with the legal obligations relating to the time of retention of data (tax assessments and prescription terms for the exercise of rights).

In particular, personal data will be retained until you request the deletion of your data. In some cases, personal data that may prove the management of the services and the exercise of its rights may be retained.


For the purposes of this information and within the limits of this strictly necessary, the data will be processed by the Owner and his employees, employees and/or specially appointed employees.

As part of its activity and for the purposes mentioned above, the Holder will be able to use services provided by third parties operating on his behalf and according to his instructions, as those responsible for the treatment (or self-employed owner): these are persons who provide the owner with processing or instrumental services (e.g. IT services for the operation of the site), of which the user can request a complete and up-to-date list by contacting the Owner, e-mail

With the exception of specific legal obligations, the data is not intended for dissemination.


If necessary, for technical and operational reasons, the Holder reserves the right to transfer personal data to countries outside the European Union or international organisations for which there are decisions of adequacy of the European Commission, that is, on the basis of adequate guarantees provided by the country in which the data is to be transferred or on the basis of the specific exemptions provided by the EU Regulation 2016/679.


Under articles. 15 and ss. of the GDPR and the current legislation, you are entitled, in addition to filing a complaint with the Data Protection Authority and withdrawing at any time the consent you may have given, to:

(a) obtain confirmation of whether or not personal data exists and their communication in an intelligible form, receiving it in a structured, common and readable format with the possibility of transmitting it to another holder (“Right to portability”);

(b) obtain information: (i) on the origin of personal data, on the purpose and manner of processing, on the logic applied in the case of treatment carried out with the help of electronic instruments; (ii) on the identifying details of the controller, the Processing Manager and the Data Protection Officer; (iii) on the subjects or categories of subjects to whom the data may be disclosed or who may become aware of them as a designated representative on the territory of the State, of managers or appointees.

c) obtain the updating, rectification or integration of the data concerning it or, in the event of a dispute about the correctness of the data, the limitation of the processing of the data for the time necessary for the appropriate verifications, (ii) the anonymous transformation or the blocking of the data processed in violation of the law, including those whose preservation is necessary in relation to the purposes for which the data was collected or subsequently processed, (iii) the claim that the transactions referred to in the preceding points have also been made aware of their content, of those to whom the data has been disclosed or disseminated, unless such compliance is impossible or involves the use of means manifestly disproportionate to the protected right.

(i) to oppose, in all or part (i) the processing of the data concerning it, although relevant to the purpose of the collection, (ii) to the processing of personal data concerning it, provided for commercial information or the sending of advertising or direct sales material or for the completion of market research or commercial communication.

(e) obtain cancellation without unjustified delay (“Right to be forgotten”) if the data is no longer necessary in relation to the purposes for which it has been collected or otherwise processed, has been treated unlawfully or if the User (i) requests it or (ii) opposes all or part of the treatment.

(f) to obtain the limitation of treatment in the event that the data (i) is treated illegally but the User opposes the deletion of the data, (ii) is necessary for the User to ascertain, exercise or defend a right, (iii) an assessment of the legitimate reasons for treatment by the Holder is pending.

The rights above may be exercised with a request to the Holder, the e-mail address or, with reference to the rights sub d), also by means of a special link at the bottom of any e-mail to promotional or informative content.