Information on the processing of personal data, pursuant to Article 13, EU Regulation No. 2016/679 - "GENERAL DATA PROTECTION REGULATION" (hereinafter "GDPR") and Legislative Decree No. 196/2003, supplemented by Legislative Decree No. 101/2018. With this information notice, we would like to inform you of the manner in which the companies L''ASTEMIA and TENUTE DEL VINO (hereinafter also collectively referred to as the Companies or Joint Owners) process your personal data, which you provided while browsing the company website. Where not specified, all articles of law cited in this document refer to the GDPR. 1) Data controller Joint data controllers are the companies - L''ASTEMIA S.R.L., with registered office in Via Crosia 40 in Barolo (CN - 12069) and VAT no.: 03203200047 - TENUTE DEL VINO S.R.L., with registered office in Via Alba, 26 in Barolo (CN - 12069) and VAT no.: 02929850044, who have signed a co-ownership agreement. 2) Appointment of DPO Since the co-owners do not fall under the cases indicated in Art. 37 of the GDPR, nor under those indicated in the various interpretations of the Data Protection Authority, they did not consider it necessary to appoint a Data Protection Officer. 3) Subject of the processing 1 Navigation data The Information Technology (IT) systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users who connect to the website, the URI (Uniform Resource Identifier) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and IT environment. 2 Data provided voluntarily by the user The optional, explicit and voluntary sending of electronic mail to the addresses indicated on this website, the filling in of an information request form or the sending of a message via Whatsapp chat entail the subsequent acquisition of the sender's address and/or telephone number, necessary in order to reply to requests, as well as any other personal data included in the request. The processing of information concerning you will be based on principles of correctness, lawfulness, transparency and protection of confidentiality and will be processed and stored with IT tools for the time strictly necessary to achieve the purposes for which it was collected. Specific security measures are observed to prevent the loss of data, unlawful or incorrect use and unauthorised access. 3 Cookies Cookies are small text files that the websites visited send to the user's terminal, where they are stored, to be retransmitted to the same websites on the next visit. The type of cookies and their management is set out in the relevant policy, which can be found on the company website and managed by means of a specific banner, which in any case allows you to enable/disable cookies individually Users may choose to enable or disable cookies by adjusting the settings on their browsers according to the instructions made available by the relevant providers at the links indicated below: Chrome Firefox Safari Internet Explorer/Edge OperaRev. 04/2025 TENUTE DEL VINO 4 Newsletter The website provides for subscribing to the newsletter of the Joint Owners through the appropriate form. Please review the related information sheet. 4) Purpose of the processing, legal basis, nature of the provision. The purpose of the processing referred to in point 3.1 is to obtain anonymous statistical information on the use of the site and to check its correct functioning. The data could be used to ascertain responsibility in the event of hypothetical computer crimes to the detriment of the website. The processing is lawful pursuant to Art. 6, paragraph 1, letter b) and (f) of the GDPR. The provision of data is compulsory, otherwise it will be impossible to manage contractual aspects correctly. The purpose of the processing referred to in point 3.2 is always connected and/or instrumental to the consultation of the website, (any use that is different and/or conflicting with that of the Data Subject is therefore excluded). In particular, the processing in question is limited to answering the questions posed by the data subject. This processing is legitimate pursuant to Art. 6, paragraph 1, letter b) and does not require the express consent of the data subject. The provision of data is optional, however, refusal to provide personal data relevant to the purpose of collection will make it impossible to obtain what has been requested. The purpose of the processing referred to in point 3.3 is the improvement of the user's browsing experience and the collection of aggregate information for statistical purposes. The provision of data is optional, but the management of cookies is left to the functionality of browsers. 5) Processing method, processing duration The processing of your personal data in relation to point 3.1 is carried out by means of the operations indicated in Art. 4 no. 2) GDPR, namely: collection, recording, organisation, use, deletion. Your personal data is subject to electronic and/or automated processing, and is deleted immediately after processing. The processing of your personal data in relation to point 3.2 is carried out by means of the operations indicated in Art. 4 no. 2) GDPR, namely: collection, recording, organisation, use, deletion. Your personal data is subject to electronic and/or automated processing, and is deleted once the purpose for which they were provided has been fulfilled. Your personal data will in any case not be subject to dissemination. The processing of your personal data in connection with point 3.3 takes place in accordance with the rules and methods of those who provide the various services, and is indicated in the dedicated information notices set out in point 3.3. The expiry date of the cookies is defined by you, via the navigation tool. In any case, it is not longer than 6 months. 6) Data Communication Without the need for express consent (ex art. 6 lett. b), c) of the GDPR), the Joint Owners may communicate your data to Supervisory Bodies, Judicial Authorities, insurance companies for the provision of insurance services, as well as to those subjects to whom communication is compulsory by law for the fulfilment of the aforementioned purposes. These subjects will process the data in their capacity as autonomous data controllers. Your data will not be disclosed. 7) Data transfer to non-EU countries The data provided under point 3) is stored electronically on dedicated company servers, provided by external data controllers, or in Cloud platforms adopted by the Joint Owners. It is in any case understood that the Data Controller, should it become necessary, shall have the right to move the servers also outside the EU, for example in the case of use of Cloud services. In this case, the Data Controller assures you as of now that the transfer of data outside the EU will take place in compliance with the applicable legal provisions, subject to the stipulation of the standard contractual clauses provided for by the European Commission. 8) Rights of the data subject As a data subject, you enjoy the rights set out in Articles 15, 16, 17, 18, 19, 20, 21 and 22 of the GDPR. In detail: Right of access Right to correct Right to erasure ("right to be forgotten") Right to restriction of processing Right to Obligation to notify in case of correction or erasure of personal data or restriction of processing Right to data portability Right to object Rights relating to automated decision-making concerning natural persons, including profilingRev. 04/2025 TENUTE DEL VINO 9) Procedures for exercising the rights of the data subject You may exercise your rights at any time by sending: - a registered letter with acknowledgement of receipt addressed to the Data Controller, referred to in point 1) - an e-mail to privacy@astemia.it L''ASTEMIA S.R.L. TENUTE DEL VINO S.R.L