Privacy Policy

Privacy Notice pursuant to Art. 13 of the EU GDPR and the UK GDPR.

Controller: Tenute Ruffino S.r.l. Società Agricola ("we", "us" or "Ruffino") with Headquarters in Via Poggio al Mandorlo 1, Loc. Quarate, Bagno a Ripoli (FI), email: tenuteruffino@ruffino.it.

We collect and process your personal information with utmost care, and in compliance with the EU GDPR and UK GDPR and other applicable data protection laws (collectively, "Privacy Laws").

This Privacy Policy applies to the:

• Ruffino Website https://www.ruffino.it/ ("Ruffino.it Website");
• Ruffino Wine Club Website https://wineclub.ruffino.it ("Wine Club Website"); (hereinafter together "Ruffino's Websites").

This Privacy Policy explains what kind of personal information we collect, how we use it, for how long we store it, who we might share it with, and your rights in relation to the information we collect. We may also collect information on your internet browsing through cookies and other tracking technologies. Please see the cookie policy is available here https://www.ruffino.it/pages/cookies-policy for the Ruffino.it Website and here https://wineclub.ruffino.it/en/cookie-policy/ for Wine Club Website.

This Privacy Policy applies also to the processing of the personal data related to Ruffino Wine Club. The Ruffino Wine Club is an initiative that offers exclusive advantages and discounts to registered members, who earn points through the purchase of the Ruffino products or services. The Wine Club Terms and Conditions are available here: https://wineclub.ruffino.it/en/wine-club-terms/. The initiative is open only to individuals of legal age.

This Privacy Policy should be read in conjunction with the Terms of Use of the Ruffino's Websites, Terms and Conditions of Experience Reservation, Terms of Sale, and Terms and Conditions of Ruffino Wine Club

This Privacy Policy describes the data processing activities carried out in the context of browsing the Ruffino's Websites; the registration and participation to the Ruffino Wine Club; online purchase of Ruffino's products; promotional activities and newsletter related to the Ruffino world.

Within this Privacy Policy, we will address the following topics:

1. What personal information do we collect and how do we collect it?
2. Why do we collect your personal information and what is the legal basis for processing?
3. How long do we keep your personal information?
4. Who do we share personal information with?
5. How is personal information secured?
6. How can I exercise my privacy rights?
7. How can I contact Ruffino?
8. Minors.

This Privacy Policy was last updated on October 2024.

We invite you to regularly review this Privacy Policy in order to acknowledge any updates on collection and conditions of processing your personal data.

Before submitting any personal data, please read this Privacy Policy carefully to understand how we process your personal data and the features of said processing.

By accessing or using Ruffino's Websites, you confirm that you have read this Privacy Policy and that you understand how we collect, process, use and disclose your personal data as herein described.

1. What personal information do we collect and how do we collect it?

We collect information directly from you or from other sources, as below specified.

• Personal Information you provide us.

User information: We process data such as your first and last name, date of birth, country of residence and your contact information (e.g. telephone number, address and email address). Your email, together with a password of your choice, will be registered to allow you to access your personal account.

Purchase information: Within your account you will have access to a dedicated channel for sales and reservations. We can process data (e.g. date of purchase, purchase amount) related to your purchases of wines or other Ruffino products (such as oil, accessories, etc.) carried out through our online shop within your personal area, your reservations for tastings, dinners at the restaurant Tre Rane or overnights stay at Casa Ruffino of Poggio Casciano. Moreover, we may process data related to purchases of wines or other products carried out at the Enoteca of Tenuta Poggio Casciano, if related to your Ruffino Wine Club Card.

Wine Club: We may process additional data related to your registration and participation in the Ruffino Wine Club, such as products included in in your favourites list, payment methods and details (e.g. date, amount) and information relating to purchase shipments, including shipping addresses, contact details (e.g. telephone number) to be communicated to the couriers and any data relating to complaints or after-sales service (e.g. order numbers). This information enables us to process and fulfil purchases and reservations for you.

• Personal Information automatically collected.

While you visit Ruffino Websites, we automatically collect information through cookies and other tracking technologies.

Technical information: We process certain information when you visit or use any of Ruffino's Websites, including your Internet Protocol (IP) address, login information, browser type and version, device IDs, operating system and platform, device settings (e.g. language and time zone), and information relating to your mobile operator or Internet Service Provider (ISP). This information helps ensure content on Ruffino's Websites is presented effectively for you and for your device.

For more specific information on the cookies and other tracking technologies we use, please refer to our Cookie Policy here https://www.ruffino.it/pages/cookies-policy for the Ruffino.it Website and here https://wineclub.ruffino.it/en/cookie-policy/ for Wine Club Website.

2. Why do we collect your personal information and what is the legal basis for processing?

We process your data for the following purposes; for each of them we state the data processed and the legal basis that legitimises our processing:

When we rely on our legitimate interest as legal basis for the processing, we carry out a balancing test in order to ensure that your interests and fundamental rights and freedoms are not overridden by our interests You can request further details by contacting us as described below at point 7. Our legitimate interests include enhancing our services, preventing fraud, preventing the misuse of IT systems, ensuring IT and network security, carrying out internal investigations, or to aid with potential merger and acquisition activities.

We may also link and/or combine the information we collect about you from the various devices you use.

When do you need to provide your personal information? The provision of your data is necessary when the legal basis for processing (as described above) is to comply with applicable laws (e.g. to conduct age verification on users) or to perform our obligations under a contract with you (e.g. for your registration on Ruffino's Websites or to fulfil a purchase you make). If you do not provide your personal data, we may not be able to proceed with your registration or manage your purchases.

The provision of your personal data for marketing purposes is optional. Choosing not to provide your personal data for this purpose will not affect your ability to Ruffino's Websites register and purchases.

3. How long do we keep your personal information?

Your data will be stored for the time strictly necessary to fulfil the purpose it was collected for and in compliance with storage limitation principles under the applicable Privacy Laws.

In particular, for personal information processed:

• to enable your registration to the Ruffino Wine Club, your data will be retained as long as your account remains active;
• to fulfil your purchases and reservations, we will retain your data until delivery of your purchases at the time in which you have used the reservation, two years, as required by warranty;
• to fulfil after-sales service requests, we will retain your data for as long as necessary to fulfil your request;
• for marketing purposes, your data will be retained for one year from (i) your last interaction with us, (ii) until your consent is withdrawn, or (iii) until you request deletion of the data or exercise your right to object, whichever occurs first. We may keep a record of your opt-out so we can respect your preferences and demonstrate our compliance.

We may need to retain your data for a longer period to comply with applicable laws (e.g. bookkeeping rules)

We will inform you as applicable on when there are extended data retention obligations we have to comply with.

4. Who do we share personal information with?

We may share your personal information with:

• authorised Ruffino personnel and other group companies in the Ruffino Group;
• our third party service providers, when required to fulfil the use purposes set out point 2 above. Our service providers act as data processors, and are appointed and instructed on the basis of a specific contract, such as to supply of bulk email services or perform couriers services. Service providers will only process your personal information on our behalf as necessary to perform their support functions (e.g. cloud storage, payment processing), doing so in accordance with our instructions and applicable Privacy Laws. You can request the updated list of processors by contacting us at the contact details set out at point 7 below;
• third parties such as law enforcement agencies, regulators or other similar government bodies when required to comply with a legal obligation, applicable laws or regulation;
• third parties such as auditors, legal advisers or other professional advisers

In some instances, for example for certain experiences (e.g. Tre Rane restaurant reservation) you may provide your personal data directly to third parties (for Tre Rane restaurant, to the reservation platform The Fork).

In this case the controller of the data processing will be the third party and the relevant privacy policy applies. We do not have control of third party's privacy policies and procedures and we may not be considered liable for the processing of your personal data by said third parties. 

Data recipients may be established in third countries worldwide without an adequate level of protection of personal data (e.g. in the case of shipping outside the EU that requires communicating your data to local couriers). We takes all necessary measures to ensure that the transfer of data outside the EU is adequately protected as required by applicable Privacy Laws, including using the European Commission's Standard Contractual Clauses and addenda required by local law as applicable and applying relevant measures as required by applicable Privacy Laws.

We may transfer your personal data to the US to our parent company or other affiliates. In this case we have signed the Standard Contractual Clauses and UK Addendum in order to ensure that the transfer of data outside the European Economic Area (EEA) and/or UK is adequately protected as required by applicable Privacy Laws You may obtain more information on the countries where we transfer personal data and on the safeguards we adopt for such transfers by contacting us at the contact details indicated at point 7 below.

5. How is personal information secured?

The processing of your personal information may be carried out manually or electronically, in each case in accordance with the logic and procedures necessary to ensure the protection of your data and to ensure their security. We take appropriate security measures, including physical, technological, and procedural measures, to help to safeguard your personal data and to prevent unauthorised access and disclosure.

Unfortunately, the transmission of information via the internet is not completely secure. We do our best to protect your personal information, but we cannot guarantee the security of your data transmitted to us, any transmission is at your own risk. Once we have received your information, we use strict procedures and security features to try to prevent unauthorised access.

6. How can I exercise my privacy rights?

You may contact Ruffino, at the contact details indicated below, to exercise your rights under applicable Privacy Laws, including:

• Right of access: You may request access to your data and verify its origin and accuracy.
• Right to portability: In certain cases, you may also obtain a copy of your personal data that is commonly used and machine-readable in order to enable you to exercise your right to data portability and to transfer them to another data controller or request us to transfer such data directly to another data controller to the extent this is technically possible.
• Right of rectification: You may request the integration of incomplete data and the rectification or updating of inaccurate data.
• Right of erasure: You may request the erasure of your data and the portability of the same.
• Right to limit the processing: You may request the restriction of the processing and object to the processing of your personal data.
• Right to withdraw your consent: You may withdraw any consent you may have given.
• Right to lodge a complaint: You may lodge a complaint to the competent supervisory authority and contact the authority if the exercise of your rights is subject to delay, restriction or exemption, pursuant to law.
• Right to object: As applicable under privacy laws, you have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data and we may be required to no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing or for the establishment, exercise or defence of legal claims.

Right to object to direct marketing: when your personal data is processed for direct marketing purposes, you have the right to object at any time and without justification to the processing of your personal data for such direct marketing purposes (including profiling insofar as it relates to such direct marketing).

7. How can I contact Ruffino?

If you have questions or comments regarding this Privacy Policy or our privacy practices, wish to enforce your data privacy rights as set out at point 6 above, or want to receive the current list of our data processors and third parties with whom we share your personal data or receive further information on the balancing test performed when we rely on our legitimate interest for the data processing and the transfer of personal data to third countries, you can contact us at:

Tenute Ruffino S.r.l. Società Agricola with Headquarters in Via Poggio al Mandorlo 1, Loc. Quarate, Bagno a Ripoli, email: tenuteruffino@ruffino.it. 

8. Minors

You must be of legal age for purchasing and consuming alcohol (e.g., in Italy, and the UK, you must be 18 years of age) to enter Wine Club and other possible section of the website where is possible to buy wine.

If you are under the age of 18, you may not use Ruffino's Websites, and our products and services are not available to purchase for those below the legal age.

We do not intentionally target, or otherwise process information from individuals who are under the age of 18. If you are a parent or guardian of a child under 18, please contact us if you are aware that your child has used Ruffino's Websites. We shall delete or otherwise cease processing your child's personal information within a reasonable time. We may retain your information for a reasonable amount of time to make sure that we do not process your child's personal information in the future.

By using the Ruffino's Websites, you confirm to us that:

• you are of the required legal age according to the legislation applicable to you;
• you are using your actual identity; and
• the personal data that you have provided to us is true and accurate and that you shall maintain and promptly update such personal data to ensure a true and accurate record.