Information for the processing of personal data

1. Data Controller

The Data Controller is Tenuta Castelnuovo Tancredi, Località Castelnuovo Tancredi n. 93, 53022 Buonconvento (SI), Italy, VAT no. 01063340523, e-mail amministrazione@castelnuovotancredi.it, certified e-mail (PEC) tenutacastelnuovotancredi@pec.it (the “Data Controller”).

2. Personal data we collect and how

We collect personal data when you send us one of the forms available on this website:

• Stay request form: name, e-mail, telephone number, dates of stay, number of guests, message.
• General enquiry form and footer message form: name, e-mail and the content of your message.
• Tasting booking form: contact details, requested date and any notes you provide.
• Wine and olive oil order form: contact details, shipping address and products ordered.
• Retreat request form: contact details, details of the event you wish to organise, message.

When a form is submitted, the request is sent by e-mail to our administration office and is also stored in the database of the website, together with your IP address and the page of the website from which you sent it. Please do not include in free-text fields data that is not necessary for your request, in particular data revealing health conditions or religious beliefs, unless strictly needed (for example, food allergies for a tasting or a stay).

3. Purposes and legal bases

• Answering your enquiry, taking steps at your request before a contract, and performing the contract (stays, tastings, retreats, sale of products and services, shipping of orders). Legal basis: art. 6(1)(b) GDPR. Providing the data requested is necessary; without it we cannot handle your request.
• Accounting, invoicing, tax and other legal obligations. Legal basis: art. 6(1)(c) GDPR.
• Website security, prevention of abuse and spam, and defence of our legal rights, which is why we store your IP address and the page of origin of each request. Legal basis: legitimate interest, art. 6(1)(f) GDPR.
• Statistics on the use of the website through Google Analytics, see section 6.

4. Who may receive your data

Data are processed by employees and collaborators of the Data Controller, authorised for this purpose. For operational and technical needs strictly connected to the purposes above, they may be communicated to:

• Confagricoltura di Siena and/or other professionals in charge of our accounting, tax and management obligations;
• public administrations and authorities, to fulfil legal obligations;
• banks, financial and credit institutions, where needed to carry out payments and economic activity;
• couriers and carriers, for the delivery of wine and olive oil orders;
• providers of hosting, e-mail and IT services that make the website, its database and our mailbox work, acting as data processors;
• Google (Google Analytics and Google Maps) and the provider of the external availability calendar (Open Web Calendar), see section 6.

Your data are not disclosed to the public and are not sold.

5. Storage period

• Requests that do not lead to a contract: up to 24 months from the last contact.
• Data relating to concluded contracts, orders and invoices: for the time required by tax and accounting law (generally 10 years).
• Requests stored in the website database, including the IP address and the page of origin: for the same period as the request they relate to.

At the end of these periods data are deleted or anonymised, unless storage is needed to defend a legal claim.

6. Third-party services: Google Analytics, Google Maps, Open Web Calendar

This website uses Google Analytics to collect statistical information on how the site is used (pages visited, time spent, approximate location, device and browser), Google Maps to show where the estate is, and an external availability calendar (Open Web Calendar) to show the availability of our properties. These services may set cookies or similar technologies and receive technical data, such as your IP address, when you load the relevant page. Where required, analytics cookies are used only with your consent, which you can give or refuse through the cookie banner and change at any time. For more information see Google’s privacy policy (policies.google.com/privacy) and that of the calendar provider. Data processed by Google may be transferred outside the European Economic Area on the basis of the safeguards provided by the GDPR (such as the EU-US Data Privacy Framework or standard contractual clauses).

7. Your rights

At any time you can write to the Data Controller at the contacts above to exercise your rights under articles 15-22 GDPR: access, rectification, erasure, restriction of processing, objection, data portability, and withdrawal of consent (without affecting the lawfulness of processing carried out before withdrawal).

If you believe your data have been processed unlawfully, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of your country of residence.

Last updated: October 2026.