Last updated: 14 August 2026
This Privacy Policy describes how personal data of users visiting www.laguarda.com is processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”).
1. Data Controller
LA GUARDA AGRITURISMO IN CANTINA
Via G. Zanardelli, 49 – 25080 Castrezzone di Muscoline (BS), Italy
E-mail: info@laguarda.com
Any request concerning the processing of personal data may be sent to the e-mail address above.
2. Categories of data collected
The Data Controller processes the following categories of personal data, provided directly by the user or collected automatically during browsing:
- Identity and contact data: first name, last name, e-mail address, telephone number;
- Billing and shipping data: billing address, shipping address;
- Payment data: information relating to the payment method used, processed directly by the payment service providers (the Data Controller does not come into possession of full card details);
- Access credentials: username and password, where the user registers or signs in through third-party services;
- Usage and browsing data: IP address, browser and device type, operating system, pages visited, referring URL, date and time of access, session duration;
- Data collected through cookies and other tracking technologies, as detailed in the Cookie Policy.
Providing the data marked as mandatory in the forms on the site is necessary in order to obtain the requested service; failure to provide it makes it impossible to fulfil the request. Providing any other data is optional.
3. Purposes and legal bases of processing
Personal data is processed for the following purposes:
| Purpose | Legal basis |
|---|---|
| Responding to enquiries sent through the contact form or by e-mail | Pre-contractual measures at the request of the data subject / legitimate interest (Art. 6(1)(b) and (f) GDPR) |
| Online sale of products and services, order, payment and shipping management | Performance of a contract (Art. 6(1)(b) GDPR) |
| Tax, accounting and administrative obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Sending newsletters and promotional communications | Consent of the data subject (Art. 6(1)(a) GDPR), withdrawable at any time |
| Publication and moderation of comments on the site | Consent of the data subject (Art. 6(1)(a) GDPR) |
| User registration and authentication, including through third-party accounts | Performance of a contract / consent (Art. 6(1)(b) and (a) GDPR) |
| Management of technical infrastructure, site security and spam protection | Legitimate interest of the Data Controller in the proper functioning and security of the site (Art. 6(1)(f) GDPR) |
| Statistical analysis of site usage | Consent of the data subject given through the cookie banner (Art. 6(1)(a) GDPR) |
| Interaction with social networks and external platforms, embedded content, advertising profiling | Consent of the data subject given through the cookie banner (Art. 6(1)(a) GDPR) |
| Establishment, exercise or defence of legal claims | Legitimate interest of the Data Controller (Art. 6(1)(f) GDPR) |
4. Methods of processing
Processing is carried out using IT and electronic tools, following logic strictly related to the purposes indicated above, and adopting technical and organisational measures appropriate to ensure the security, integrity and confidentiality of the data, as well as to prevent unauthorised access, loss, destruction or disclosure.
Data is processed by the Data Controller’s authorised personnel and by the service providers listed in section 6, appointed as Data Processors pursuant to Art. 28 GDPR where applicable.
5. Retention period
Personal data is retained for no longer than is necessary to achieve the purposes for which it was collected and, in particular:
- data relating to enquiries and contacts: up to 24 months from the last contact;
- data relating to orders, contracts and invoicing: 10 years from the end of the relationship, in accordance with civil and tax law obligations;
- data processed for newsletter purposes: until consent is withdrawn or the user unsubscribes;
- comments published on the site: until the data subject requests their deletion;
- data collected through cookies and tracking technologies: for the durations set out in the Cookie Policy.
At the end of the periods indicated, data is deleted or irreversibly anonymised, save where further retention is required to comply with legal obligations or to defend a legal claim.
6. Recipients of the data and third-party services
Personal data may be disclosed to parties providing services necessary to the operation of the site. The services used, the data processed and the relevant providers are listed below.
6.1 Hosting and infrastructure
- SiteGround Hosting – hosting of the website and backend infrastructure. Data processed: usage data, IP address, tracking technologies. Provider: SiteGround Spain S.L. – Privacy policy
- WordPress.com – platform and site management services. Data processed: first name, last name, e-mail, telephone number, billing and shipping address, payment information. Provider: Automattic Inc. (USA) – Privacy policy
6.2 Contact, newsletter and contact management
- Contact form – managed directly by the Data Controller. Data processed: first name, last name, e-mail and any other data freely entered in the message.
- Mailchimp (including the sign-up widget on the site) – mailing list management and newsletter delivery. Data processed: first name, last name, e-mail. Provider: Intuit Inc. (USA) – Privacy policy
6.3 Payments
- PayPal – payment processing. Data processed: first name, last name, usage data, payment information, service login credentials, tracking technologies. Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A. – Privacy policy
- Stripe – payment processing. Data processed: first name, last name, e-mail, usage data, tracking technologies. Provider: Stripe Payments Europe Ltd. – Privacy policy
The Data Controller neither collects nor stores full payment instrument details, which are processed directly by the payment providers acting as independent data controllers.
6.4 Registration, authentication and comments
- WordPress.com Single Sign On – user registration and authentication. Data processed: tracking technologies and further data as specified in the service’s privacy policy. Provider: Automattic Inc. (USA) – Privacy policy
- Facebook account access – access to third-party service accounts. Permissions requested: e-mail, usage data, device information, tracking technologies. Provider: Meta Platforms Ireland Ltd. – Privacy policy
- Comment system – managed directly by the Data Controller. Data processed: name, e-mail, IP address and the content of the comment.
6.5 Security and spam protection
- Akismet – spam filtering on comments. Data processed: data communicated in order to use the service, including IP address. Provider: Automattic Inc. (USA) – Privacy policy
- Google reCAPTCHA – protection of forms against automated submissions. Data processed: usage data, IP address, tracking technologies. Provider: Google Ireland Ltd. – Privacy policy
- hCaptcha – protection of forms against automated submissions. Data processed: data communicated in order to use the service. Provider: Intuition Machines Inc. (USA) – Privacy policy
6.6 Statistics and analytics
- Google Analytics 4 – statistical analysis of site usage. Data processed: usage data, number of users, session statistics, tracking technologies. Provider: Google Ireland Ltd. – Privacy policy
- WordPress Stats (Jetpack) – site access statistics. Data processed: usage data, tracking technologies. Provider: Automattic Inc. (USA) – Privacy policy
- WooCommerce Order Attribution Tracking – tracking of order source. Data processed: usage data, pageviews, referring URL, tracking technologies. Provider: Automattic Inc. (USA) – Privacy policy
6.7 Social networks, external content and advertising
- Facebook Like button and social widgets – interaction with the social network. Data processed: usage data, tracking technologies. Provider: Meta Platforms Ireland Ltd. – Privacy policy
- LinkedIn button and social widgets – interaction with the social network. Data processed: usage data, tracking technologies. Provider: LinkedIn Ireland Unlimited Company – Privacy policy
- ShareThis – content sharing and advertising. Data processed: usage data, tracking technologies. Provider: ShareThis Inc. (USA) – Privacy policy
- Google Fonts – display of typographic content from external platforms. Data processed: usage data, IP address. Provider: Google Ireland Ltd. – Privacy policy
Data may also be disclosed to professional advisers (accountants, lawyers), banking institutions, couriers and shipping companies, as well as to public authorities where required by law.
7. Transfers outside the EU
Some of the providers listed above are established in, or use servers located in, countries outside the European Economic Area, in particular the United States of America. In such cases, transfers take place on the basis of the safeguards set out in Chapter V of the GDPR, such as the adequacy decision relating to the EU–U.S. Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission, together with supplementary measures where necessary.
Users may request a copy of the safeguards adopted by writing to info@laguarda.com.
8. Cookies and tracking technologies
The site uses technical cookies, which are necessary for its operation, and — subject to the user’s consent — analytics, profiling and third-party cookies. Users may give, change or withdraw their preferences at any time through the consent banner and the consent management panel available on the site.
For a full list of the cookies used, their purposes and durations, please refer to the Cookie Policy.
9. Rights of the data subject
In relation to the data processed, users may exercise at any time the rights set out in Articles 15 to 22 of the GDPR, and in particular:
- right of access: to obtain confirmation that processing is taking place and to receive a copy of the data;
- right to rectification: to have inaccurate data corrected or incomplete data completed;
- right to erasure (“right to be forgotten”): to have data deleted in the cases provided for by law;
- right to restriction: to obtain restriction of processing in the cases provided for;
- right to data portability: to receive the data provided in a structured, commonly used format and to transmit it to another controller;
- right to object: to object to processing based on legitimate interest, and to object at any time and without giving reasons to processing for direct marketing purposes;
- right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- right not to be subject to automated decision-making producing legal effects or similarly significantly affecting the individual.
Requests may be sent to info@laguarda.com. The Data Controller will respond within one month of receipt, extendable by a further two months in particularly complex cases.
To unsubscribe from the newsletter, simply use the unsubscribe link at the bottom of each communication.
10. Complaints to the supervisory authority
Data subjects who consider that the processing of their data infringes the GDPR have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it) or to bring proceedings before the competent courts.
11. Children’s data
The site is not intended for children under the age of 14, and the Data Controller does not knowingly collect personal data relating to children below that age. Should data belonging to a child be found to have been collected without valid consent, it will be deleted without undue delay.
12. Changes to this Privacy Policy
The Data Controller reserves the right to amend this Privacy Policy at any time, notifying users by publishing the updated version on this page. Users are therefore invited to consult it regularly, referring to the last-updated date shown at the top. Where changes concern processing based on consent, the Data Controller will obtain consent again where necessary.
This document is an English translation provided for convenience. In the event of any discrepancy, the Italian version shall prevail.