Privacy Policy

Last updated: October 2026

This Privacy Policy explains how personal data are collected and processed through the website www.cookingclassborgoponeta.it, in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable Italian data protection legislation.

1. Data Controller

The Data Controller is:

BORGO PONETA SOCIETÀ SEMPLICE AGRICOLA
VAT No. IT06783330480
Strada di Poneta 70
50121 Barberino Val D’Elsa (FI), Italy

Email: info@borgoponeta.it

2. Personal Data We Process

Depending on how you use the website, we may process:

  • name and surname;

  • email address;

  • telephone number;

  • selected experience;

  • booking date and time;

  • number and age category of participants;

  • booking and payment status;

  • information voluntarily entered in booking forms, contact forms or messages;

  • dietary requirements, allergies or intolerances, where voluntarily provided;

  • information relating to accommodation where a multi-day experience is booked;

  • technical information relating to website access and navigation;

  • referring website, referral source or campaign information;

  • information relating to online payment transactions;

  • communications exchanged in connection with a booking or enquiry.

3. Booking Management and Provision of Services

Personal data are processed in order to:

  • receive and manage booking requests;

  • review, approve or decline booking requests;

  • communicate with customers regarding their booking;

  • organise and provide cooking classes;

  • manage accommodation where included in the selected experience;

  • manage participant numbers and dietary requirements;

  • process payments and refunds;

  • respond to customer requests;

  • manage administrative matters connected with the service.

The legal basis is the performance of a contract or steps taken at the customer’s request prior to entering into a contract pursuant to Article 6(1)(b) GDPR.

4. Online Booking System – Amelia

The website uses Amelia to manage online booking requests.

When a booking request is submitted, information entered into the booking form is stored in the website’s WordPress database.

This may include:

  • name and surname;

  • email address;

  • telephone number;

  • selected experience;

  • selected date and time;

  • number of participants;

  • booking status;

  • payment status;

  • additional information voluntarily provided by the customer.

A booking request initially has Pending status.

The booking is confirmed only after it has been reviewed and manually approved by Borgo Poneta and the customer receives confirmation.

These data are processed to manage the reservation and provide the requested service.

5. Online Payments – Nexi

The website uses Nexi for online payment processing.

Payment is required in advance for applicable bookings.

When a customer makes an online payment, payment-card and transaction information is processed securely through Nexi’s payment infrastructure.

Full payment-card details are not stored in the website’s WordPress database.

The website may receive and retain information necessary to identify and manage the transaction, such as:

  • transaction identifier;

  • payment amount;

  • payment status;

  • date and time of payment;

  • technical information required to associate the payment with the relevant booking.

Nexi processes payment-related personal data according to its own privacy and data-protection documentation and applicable payment-services legislation.

6. Contact Forms and Enquiries

If you contact Borgo Poneta through the website, by email or through a contact form, the information provided will be processed in order to respond to your request.

Where the request relates to a possible booking or service, the legal basis is Article 6(1)(b) GDPR.

For general enquiries, processing may be based on the legitimate interest of the Data Controller in responding to communications received pursuant to Article 6(1)(f) GDPR.

7. Dietary Requirements, Allergies and Intolerances

Customers may voluntarily provide information concerning allergies, food intolerances or dietary requirements.

Such information may constitute special categories of personal data within the meaning of Article 9 GDPR.

These data are processed only where necessary to organise and provide the requested experience safely and appropriately.

Customers should provide only information relevant to this purpose.

Such information is not used for marketing or unrelated purposes.

8. Accommodation and Multi-Day Experiences

Certain experiences offered through the website include accommodation and multiple cooking classes.

Where such an experience is booked, personal data may be processed to:

  • manage accommodation reservations;

  • coordinate arrival and departure;

  • organise the cooking-class schedule;

  • manage meals and included services;

  • communicate practical information concerning the stay.

The legal basis is Article 6(1)(b) GDPR.

9. Booking Source and Referral Tracking

The website may record information relating to how a customer reached the website or booking process.

This may include:

  • referring website;

  • referral domain;

  • campaign or UTM parameters;

  • booking source;

  • referral type.

This information may be associated with the relevant booking.

It is used for internal administrative, statistical and commercial purposes, including:

  • identifying the source of a booking;

  • evaluating referral and promotional channels;

  • identifying, where applicable, a commercial partner associated with a booking;

  • determining commissions or commercial attribution where applicable.

Where technically possible, booking-source information may be transmitted through the booking flow without persistent cookies.

Where the relevant cookie consent has been provided, the website may also use a first-party attribution cookie to remember the booking source across future visits.

This information is not used for behavioural advertising or cross-site profiling.

10. Website Analytics – SlimStat

The website uses SlimStat Analytics in a privacy-oriented configuration.

In particular:

  • IP addresses are masked;

  • browser fingerprinting is disabled;

  • SlimStat does not set its own tracking cookie;

  • statistical information is stored locally in the website’s WordPress database;

  • analytics data are retained for a maximum of 420 days;

  • archived records are not retained after the applicable retention period;

  • geographic information is limited to country-level data.

SlimStat may process page views, referring websites, browser/device information, operating system, country of origin and technical navigation information.

These data are used to understand website usage, evaluate traffic sources, identify technical issues and improve the website.

11. Hosting – Aruba

The website and its database are hosted through services provided by Aruba S.p.A.

Personal and technical data processed through the website may therefore be stored on the hosting infrastructure used to operate the website.

The hosting provider may process data where necessary for:

  • website and database hosting;

  • security;

  • backups;

  • maintenance;

  • technical operation.

Where applicable, providers processing personal data on behalf of the Data Controller act as processors pursuant to Article 28 GDPR.

12. Email Communications

The website uses email services for communications concerning:

  • booking requests and confirmations;

  • booking approvals or refusals;

  • booking changes and cancellations;

  • payment or refund information;

  • customer enquiries;

  • accommodation-related communications;

  • other service-related communications.

The main email address used by the Data Controller is:

info@borgoponeta.it

13. Technical and Security Data

Technical data may be processed to ensure correct website operation, prevent misuse or unauthorised access, diagnose technical problems and maintain website, booking and payment-system security.

The legal basis is the legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR.

14. Legal, Accounting and Administrative Obligations

Personal data may be processed where necessary to comply with applicable legal, tax, accounting or administrative obligations.

The legal basis is Article 6(1)(c) GDPR.

15. Provision of Personal Data

Information marked as mandatory during booking is necessary to process the booking request and provide the requested service.

Payment information required to complete the online payment is necessary where prepayment applies.

Failure to provide required information may make it impossible to submit or complete the booking.

Optional information is provided voluntarily.

16. Recipients of Personal Data

Personal data may be accessed or processed, where necessary, by:

  • persons authorised by the Data Controller;

  • Aruba S.p.A. and other technical providers;

  • website developers and maintenance providers;

  • booking-management software providers;

  • Nexi and other providers involved in processing payments;

  • email and communication providers;

  • accountants and professional advisers;

  • competent public authorities where required by law.

Personal data are not sold to third parties.

17. International Data Transfers

Some technical or service providers may process personal data outside the European Economic Area.

Where such transfers occur, they are carried out in accordance with Chapter V GDPR using appropriate legal safeguards.

18. Data Retention

Personal data are retained only for as long as necessary.

In particular:

  • booking data are retained for the period necessary to manage reservations and subsequent administrative, accounting or legal requirements;

  • payment and accounting records are retained for the periods required by applicable law;

  • contact enquiries are retained only for the period reasonably necessary to respond;

  • SlimStat data are retained for a maximum of 420 days;

  • booking-source information may remain associated with the relevant booking;

  • technical/security logs are retained only as reasonably necessary.

Data may be retained longer where necessary for the establishment, exercise or defence of legal claims.

19. Cookies and Similar Technologies

The website uses cookies and similar technologies for technical, booking-related, statistical, payment and other purposes.

SlimStat is configured not to set its own tracking cookie.

Booking-source information may, where technically possible, be transmitted without persistent cookies.

Nexi may use technical cookies or similar technologies necessary to securely process online payments.

Where consent is required for optional technologies, they are activated only after the relevant consent has been provided.

Further information is available in the website’s Cookie Policy.

20. Embedded Content and Third-Party Services

The website may include third-party content such as maps, review widgets, payment interfaces, external media or other embedded services.

Such providers may use cookies or similar technologies.

Where consent is required, non-essential third-party technologies should only be activated after the relevant consent has been provided.

21. Automated Decision-Making

The website does not carry out automated decision-making producing legal effects or similarly significant effects within the meaning of Article 22 GDPR.

22. Rights of Data Subjects

Under Articles 15 to 22 GDPR, where applicable, users may have the right to:

  • access their personal data;

  • request correction;

  • request erasure;

  • request restriction;

  • object to processing based on legitimate interests;

  • request data portability;

  • withdraw consent where processing is based on consent.

Requests may be sent to:

info@borgoponeta.it

23. Right to Lodge a Complaint

Users have the right to lodge a complaint with the competent supervisory authority.

In Italy, this is:

Garante per la Protezione dei Dati Personali

24. Changes to this Privacy Policy

This Privacy Policy may be updated to reflect changes to the website, services, payment systems, technologies, providers or applicable law.

The latest version will always be published on this page.