How we process your personal data, in accordance with the GDPR and Italian legislation.
Last updated: 5 October 2026
1. Data controller
The data controller for personal data is:
Azienda Agricola Mangiaracina Carlo («Tunnaliva») Via Alessandro Volta, 5, 91021 Campobello di Mazara (Sicilia), Italia VAT number 02093670814 Tax code MNGCRL60T28B521D Italian business register (REA) TP-145366 Certified email (PEC): carlo.mangiaracina@pec.agritel.it Email: info@tunnaliva.com
For questions about personal data, contact the controller using the details above.
2. What data we collect
Order and account data: first name, surname, delivery and billing address, email, telephone number, and where applicable VAT number/tax code for invoicing.
Payment data: handled by the provider selected at checkout (Stripe and PayPal, depending on the available method). We do not store full card details or payment account credentials. We receive the outcome and transaction references needed to manage orders and refunds.
Contact data: the content of the messages sent through the contact form, by email or via WhatsApp.
Browsing data: technical information for security and operation and, when enabled, aggregate statistics without cookies or individual identifiers. Viewed-product history is not retained between visits.
AI assistant: if you use it, an artificial intelligence service provider processes your messages to answer your questions. Do not enter sensitive information or payment details. Browser conversation history is deleted when you close the tab; you can always ask a person for assistance.
Newsletter: email address, requested topics, language, source and dates of the request, confirmation and any withdrawal. The service also records deliveries, message opens and link clicks to measure newsletter performance; the management system displays aggregated campaign statistics.
Availability alerts: email, requested product and size, language, account identifier where applicable, request and confirmation dates, and technical delivery outcomes.
3. Purposes and legal bases
Order, delivery and billing data are required to perform the contract or meet legal obligations: without them we cannot complete your purchase. The newsletter and AI assistant are optional; you may buy without using them. The assistant suggests products and does not determine rights or refunds. Payment fraud checks are handled by the payment provider.
Fulfilment of orders and management of the contractual relationship — legal basis: performance of a contract (Art. 6.1.b GDPR).
Tax and accounting obligations (invoicing, retention of documents) — legal basis: legal obligation (Art. 6.1.c GDPR).
Customer support and replies to enquiries — legal basis: performance of pre-contractual measures / legitimate interest (Art. 6.1.b/f GDPR).
Newsletter — legal basis: consent (Art. 6(1)(a) GDPR), optional and withdrawable at any time. Subscription takes effect after confirmation using the emailed link. You can unsubscribe in your account preferences or using the link at the bottom of each newsletter.
Site security and fraud prevention — legal basis: legitimate interest (Art. 6.1.f GDPR).
Availability alerts — at your optional request and with your consent (Article 6(1)(a) GDPR), we send one email when your chosen size becomes available again. Guests must confirm their email address. This does not subscribe you to the newsletter. Cancel through the email link, the button shown after activation while signed in, or by contacting us.
4. Methods and place of processing
Data is processed using IT tools and appropriate security measures. The servers and providers used are located in the European Union or guarantee an adequate level of protection (see sections 5 and 6).
5. Recipients and external processors
Within the limits of the purposes indicated above, data may be disclosed to:
Payment providers (Stripe and PayPal) — transactions, refunds and fraud prevention, according to the method selected at checkout and their respective privacy notices.
Couriers — the recipient’s name, address and telephone number, for delivery and for despatch notifications.
IT service providers — hosting, content delivery and store maintenance; they process data needed to operate the website and security logs.
Email service providers — sending service communications and receiving support requests.
Accountant and advisers, for tax and accounting obligations.
Competent authorities, where required by law.
AI assistant providers — processing messages and generating answers, only if you use the service.
Newsletter providers — subscription management, message delivery, unsubscribing and measurement of deliveries, opens and clicks. They receive the email address, preferences and interaction data needed for the service.
Providers processing data on our behalf are appointed as processors under Article 28 GDPR. You may ask the controller for information about the recipients of your data. We do not sell personal data to third parties.
Optional Google videos
Pages on this website may feature videos hosted on YouTube or Google Drive, services provided by Google Ireland Limited. The player loads only after explicit consent in the video panel, separately from marketing consent. Before your choice, the panel uses only a photograph hosted on our website. After activation, Google receives your IP address, browser data and viewing information; it may use cookies and local storage to operate its service. The provider’s policies describe the data, retention periods and any transfers outside the European Economic Area.
Your choice is not saved: reloading the page requires consent again. “Close video” withdraws consent and removes the player; rejecting optional cookies also disconnects it. Withdrawal does not undo earlier processing or erase data already held by Google. The link to watch on the external website opens the service indicated, which is subject to its own policies.
Some providers may process data outside the EU. In such cases the transfer takes place on the basis of appropriate safeguards (e.g. the European Commission’s Standard Contractual Clauses).
Optional advertising and measurement
With your consent we may use the Meta Pixel from Meta Platforms Ireland Limited to measure public-page visits, attribute campaigns and personalise advertising. Data includes IP address, browser, page URL and online identifiers. The legal basis is consent, which you can withdraw using Cookie preferences in the footer. Meta may combine this data with your account information and process it outside the European Economic Area as described in its policy. Our Cookie Policy explains the tools, retention periods and withdrawal.
Order and invoicing data: for as long as required by tax obligations (generally 10 years).
Account data: for as long as the account remains active.
Contact messages: for as long as necessary to handle the enquiry.
Newsletter consent: until it is withdrawn.
Availability alerts: unconfirmed requests expire after 48 hours; active requests end after notification, cancellation or a maximum of 180 days. Email addresses and request references are deleted from the alert system within 30 days of closure. Delivered messages remain in your mailbox according to your settings.
8. Your rights
As a data subject you may exercise at any time the rights provided for by Articles 15–22 GDPR: access, rectification, erasure, restriction, portability, objection to processing and withdrawal of consent. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali.
9. How to exercise your rights
Write to info@tunnaliva.com: we will reply within the time limits laid down by law.
We respond without undue delay, normally within one month of your request. For complex requests, this may be extended by two further months: we explain the reasons within the first month. Requests are normally free of charge. Erasure does not cover data we must retain to meet legal obligations or protect legal rights; we may request only information necessary to verify your identity.
10. Changes to this policy
We may update this policy over time. The version in force is always published on this page, together with the date of the last update.
