Privacy policy

1. Data controller

Giardini di Noto Società Agricola S.r.l. (trading as Orto Noto)
Registered office: Via Rocco Pirri 1, 96017 Noto (SR), Italy
Farm: Contrada Grattaluri, 96017 Noto (SR)
VAT and tax code IT01950880896 · REA SR-405208 · Share capital €10,000.00
Email: ortonoto@ortonoto.com · Phone and WhatsApp: +39 379 125 3062

2. What data we process and why

Newsletter. If you subscribe we collect your email address, the site language and your consent, and use them only to tell you when the new oil is ready and to send you our offers. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing to ortonoto@ortonoto.com or replying to one of our emails; withdrawal does not affect processing already carried out. We keep your email until you withdraw.

Orders on the site. When you order from the order page we collect your name, email, phone, delivery address, any notes, the products and amount, and the PayPal payment reference, to fulfil and ship the order, provide support and meet our tax obligations. Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)). Tax documents are kept for 10 years (Art. 2220 of the Italian Civil Code); other data for as long as needed to handle the order and any warranty.

WhatsApp orders. When you tap “Order on WhatsApp” the site records, without your name or phone number, the products in the cart, the total, the language and the page you came from: this tells us which sizes people want and helps us match the order. Legal basis: our legitimate interest (Art. 6(1)(f)). Retention: 24 months.

The conversation then continues on WhatsApp, where we process your name, phone number, delivery address and order details to fulfil and ship it. Legal basis: performance of a contract or pre-contractual steps (Art. 6(1)(b)) and tax and accounting obligations (Art. 6(1)(c)). Tax documents are kept for 10 years (Art. 2220 of the Italian Civil Code); other data for as long as needed to handle the order and any warranty.

Contact. If you email or call us, we use the details you give us only to reply (Art. 6(1)(b) or 6(1)(f)) and for as long as needed.

Statistics. To know how many people visit the site and which pages they read we use GoatCounter, a service that uses no cookies, does not store IP addresses and produces only aggregate, anonymous data (page views, referrer, device type, country). In the same anonymous way we count clicks on “Order” and “WhatsApp” and completed orders, with no personal data. Legal basis: our legitimate interest in improving the site (Art. 6(1)(f)). The data stays on servers in the European Union (Finland and Germany).

Browsing data. The server hosting the site records, for security and operation, technical data such as IP address, date and time, requested page and browser type. Legal basis: legitimate interest in a secure, working site (Art. 6(1)(f)). We do not use it to identify you, and it is kept for the short period set by the hosting provider.

3. Cookies

The site uses no profiling, analytics or third-party cookies and does not follow visitors across other sites, which is why no cookie banner is shown; GoatCounter statistics work without cookies. Fonts are served from our own server. Links to Instagram, Google Maps and WhatsApp open those services, which apply their own policies. Online payment takes place on PayPal’s pages, which use its own cookies and technologies needed for payment and fraud prevention, under PayPal’s policy.

4. Who receives the data

• Netlify, Inc. (United States), which hosts the site and its forms as our processor (Art. 28 GDPR);
• EmailJS, the service that sends the order confirmation email to the address you give us, as our processor;
• GoatCounter (Martin Tournoij, Ireland), for anonymous visit statistics, as our processor;
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), which handles payment as an independent controller under its own policy;
• WhatsApp Ireland Limited, for messaging, acting as an independent controller of its own service under its own policy;
• the couriers who ship orders and our tax adviser, only as far as necessary.

We do not sell or publish your data. If we start using an external service to send the newsletter, we will name it on this page.

5. Transfers outside the European Union

Netlify, PayPal and some WhatsApp services may process data in the United States. Transfers rely on the EU-U.S. Data Privacy Framework adequacy decision, for participating companies, or on the Standard Contractual Clauses approved by the European Commission (Arts. 45 and 46 GDPR).

6. Your rights

You can ask at any time to access, correct or erase your data, restrict processing or receive your data in a portable format, and you can object to processing based on legitimate interest (Arts. 15–22 GDPR), by writing to ortonoto@ortonoto.com. We reply within one month. You can also lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority where you live.

7. Other information

Giving us your data is optional, but without an email we cannot add you to the newsletter and without a delivery address we cannot ship your order. We make no automated decisions and do no profiling. The newsletter is for people aged 14 and over. Any changes to this policy will be published on this page.