Privacy Policy

Last update: August 2026

This policy describes how the personal data of users visiting the Cascina Bruno website is processed, in accordance with EU Regulation 2016/679 (GDPR).

1. Data Controller

2. Personal Data Collected

The company collects personal information in various circumstances during browsing and use of the services offered by the website.

2.1 Customer area

Access to the order history is via email address and single-use code. An account is not created and no customer passwords are stored.

2.2 Contact forms, reservations and quotes

The data entered by the user, such as name, email, telephone number and information necessary to respond to the request or manage the booking, are processed.

2.3 Reviews

To moderate and post a review, your name, email address, rating and text are collected. The email address is not published.

2.4 Payments and Orders

The following data is collected for order processing:

• First and last name
• Any delivery notes provided by you
• Country, street, postal code, city, province
• Phone number
• Email address
• Transaction references; the complete card data is processed directly by Stripe or PayPal and is not stored by the site

2.5 Technical data and statistics

Upon consent, the proprietary analytics system collects only the page path without a query string, the external referrer without a query, technical device data and a random session identifier valid for 30 minutes. The IP address is not retained.

3. Purpose of Processing

Personal data is processed for the following purposes:

• Entry of personal records into company databases
• Issuing quotes and offers to active and/or potential customers
• Order management and fulfillment
• Management of contacts, reviews, reservations and quote requests
• Production of aggregate statistics on the functioning of the site, subject to consent
• Prevention of abuse, fraud and unauthorized access
• Compliance with legal, regulatory, and tax obligations

4. Legal Basis for Processing

The processing of personal data is based on the following legal grounds:

• Consent of the interested party: for non-essential analytics and voluntary submission of reviews or requests
• Performance of a contract: for order and payment management
• Legal obligation: for compliance with tax and regulatory requirements
• Legitimate interest: for fraud prevention and website security

5. Data Recipients

Customers'/Users' personal data is not disclosed outside our premises without the data subject's consent, except in the following cases:

• Competent authorities as required by applicable law
• Legal, administrative, and tax consultancy firms
• Public offices for mandatory compliance requirements
• Stripe and PayPal: secure payment management
• Google reCAPTCHA: prevention of abuse in public forms
• Locally hosted web fonts: fonts are served by this website and do not require requests to external font providers
• Hostinger: site hosting, infrastructure and email

6. Data Retention Period

Personal data is retained for the following periods:

Data Type	Retention Period
Tax and accounting data	For the period prescribed by civil and tax regulations (10 years)
Order and payment data	For the periods necessary for contractual, accounting and tax obligations
Customer area verification codes	10 minutes, unless canceled before use or after five attempts
Proprietary analytics data	Maximum 90 days
Reviews and reservations	For the time necessary for management and related obligations
Cookie preference	365 days

7. Data Subject Rights

Under Articles 15-22 of the GDPR, the data subject has the right to:

• Access: request to receive an exported file containing their personal data
• Rectification: request the correction of inaccurate data
• Erasure: request the deletion of all personal data concerning them
• Restriction: request the restriction of processing
• Portability: receive data in a structured, machine-readable format
• Objection: object to the processing of their data

To exercise your rights, the data subject may contact the Data Controller at the email address info@cascinabruno.com.

8. Cookie Policy

The website uses cookies to improve the browsing experience of users. Below are the types of cookies implemented:

8.1 Technical cookies

• cb_cookie_consent: retains your choice of non-essential cookies for 365 days
• cb_admin_sess: session cookie reserved for the administrative panel, does not contain credentials

8.2 Proprietary Analytics

Only after the consent is set _cb_sid, random identifier with duration of 30 minutes. The site does not use Google Analytics or Google Tag Manager.

8.3 External services

Stripe, PayPal and Google reCAPTCHA may process technical data or set cookies in their respective domains according to their own policies. For details, please refer to the complete Cookie Policy.

9. Changes to the Privacy Policy

The Data Controller reserves the right to make changes to this policy at any time. Users are encouraged to periodically check this page for any updates.

10. Contact Us

For any questions or requests regarding this Privacy Policy, you may contact the Data Controller: