PRIVACY POLICY
Information on the processing of personal data (Articles 13 and 14 of Regulation (EU) 2016/679, "GDPR")
Last updated: 8 November 2026 — version 1.1
1. Data controller
Hari-Om Società Agricola s.s.
Loc. Boschi 47, 15079 Sezzadio (AL), Italy
VAT and tax code IT02435590068
Email: info@cascinabellaria.com
This notice covers the website cascinabellaria.com and its English version /en (the "Site"). No Data Protection Officer (DPO) has been appointed, as it is not mandatory.
2. What data we collect
- Data you give us in the forms on the Site: first name, last name, email address, phone number, message and any other data you choose to write. Fields marked with an asterisk are needed to reply; the others are optional.
- Form submission data: date and time, page you wrote from, campaign parameters if any (for example UTM), site language, and the boxes you ticked (privacy and newsletter).
- Browsing data: IP address, browser and device type, pages visited, times. These are recorded in server logs for security and operation. With your consent, measurement or marketing tools may collect further data (see the Cookie Policy).
- WhatsApp contact data, if you choose to write to us with the WhatsApp button on the Site: phone number, profile name and message content, processed under WhatsApp's own notice.
We do not collect special categories of data (health, religion, etc.). Please do not write them in your messages.
3. Why we process it and on what legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Replying to requests sent through the forms (information on courses, stays, events, activities) and taking steps you request before a contract | Pre-contractual steps at your request (Art. 6.1.b GDPR) | Up to 24 months from the last contact, then deleted; longer only if a contract arises, for the period required by law |
| Storing requests in the contact list (Mailchimp) without sending marketing, to find you again and not lose your request | Controller's legitimate interest in managing requests received (Art. 6.1.f) | Up to 24 months from the last contact, then deleted |
| Sending you the newsletter and communications about courses and events, only if you tick the dedicated box | Consent (Art. 6.1.a), withdrawable at any time | Until you withdraw or unsubscribe |
| Site security, preventing abuse and spam, defending legal claims | Legitimate interest (Art. 6.1.f) and legal obligations | Server logs: up to 12 months; for legal claims, as long as necessary |
| Administrative, accounting and tax obligations if you enrol in a course or activity | Legal obligation (Art. 6.1.c) | For the legal periods (generally 10 years) |
| Measurement, marketing and optional features (for example the WhatsApp widget) | Consent (Art. 6.1.a), through the banner | See the Cookie Policy |
Declining the newsletter box or non-essential cookies does not prevent you from using the Site or sending us a request. Not providing the required form data makes it impossible to reply.
4. Who we share data with
- Staff and collaborators of the Controller authorised to process data (administration, office, sales).
- Service providers processing data on behalf of the Controller as processors: OVH SAS (hosting of the Site on a virtual server and domain management, based in the European Union), Google Ireland Limited (Google Workspace, spreadsheet, mail and Apps Script to collect and route requests), Intuit Inc. / Mailchimp (contact list and newsletter), WidgetWhats, provider of the WhatsApp chat widget shown on the Site, active only after your consent, and, if activated after your consent, Google Tag Manager and related services.
- Meta Platforms (WhatsApp), only if you use the WhatsApp button, as an independent controller of its own service.
- Public authorities when required by law.
Data is not disseminated or sold. The up-to-date list of processors can be requested from the Controller.
5. Transfers outside the European Economic Area
Some providers (Google, Intuit/Mailchimp, Meta) may also process data in the United States. Transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses, as adopted by each provider.
6. How we protect data
We use appropriate technical and organisational measures: encrypted connection (HTTPS), access limited to authorised people, system updates and checks on suppliers' authorisations.
7. Your rights
You may ask the Controller at any time (info@cascinabellaria.com) for access to your data, rectification, erasure, restriction, portability, objection to processing based on legitimate interest, and withdrawal of consent (without affecting processing already carried out). We reply within one month. You can unsubscribe from the newsletter with the link in every message. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or the authority of your country.
8. Third-party sites and external links
The Site contains links to external services (for example Google Maps, Instagram, YouTube, WhatsApp, booking platforms). When you open them you leave the Site: those services' own notices apply. Maps are shown as an image with a link: no Google service is loaded until you click.
9. Changes
We may update this notice: the date at the top shows the latest version. If changes concern processing based on consent, we will ask for your consent again when needed.