Privacy & Cookie Policy

1. Scope of Application

This policy is provided in accordance with EU Regulation 2016/679 (GDPR) and current Italian legislation. It applies exclusively to the website mielenaturale.it (hereinafter referred to as "the Site").

2. Data Controller

3. Types of Data Processed

The Site collects and processes the following categories of personal data. It is specified that the collected data is never sold or transferred to third parties for external commercial purposes.

A. Data Provided Voluntarily by the User

This refers to information spontaneously sent by the user through direct contact channels:

• Email correspondence;
• Interactions via social media platforms (Facebook, Messenger, Instagram, TikTok);
• Instant messaging via WhatsApp and Telegram;
• Telephone contact or SMS.

The user acknowledges that the use of third-party platforms (e.g., Meta, TikTok, Telegram) involves data processing operated by the providers of such platforms according to their own policies, over which the Controller has no direct influence.

B. Browsing Data

Computer systems acquire certain data whose transmission is implicit in the use of Internet communication protocols (e.g., IP addresses, system logs). Such data is used solely to ensure the security and correct functioning of the Site.

4. Purpose and Legal Basis

• Responding to inquiries and providing services: To process requests for information or bespoke quotes.
  Legal Basis: Performance of contractual or pre-contractual measures (Art. 6, para. 1, letter b GDPR).
• Compliance with legal obligations: Management of fiscal and administrative duties.
  Legal Basis: Legal obligation (Art. 6, para. 1, letter c GDPR).
• Cybersecurity: Protection against malicious attacks and spam.
  Legal Basis: Legitimate interest of the Controller (Art. 6, para. 1, letter f GDPR).
• Commercial Communications (Marketing):1. Subject to obtaining explicit consent (Art. 6, para. 1, letter a GDPR). 2. Via "Soft Opt-in" (Art. 130, para. 4, Legislative Decree 196/2003) for sending emails related to products or services similar to those already purchased, unless the data subject objects.

5. Methods, Location, and Infrastructure

Data is processed using protected electronic tools (including biometric authentication, firewalls, and antivirus software) primarily within the European Economic Area (EEA).

Technical Partners

• Hosting: BunnyWay d.o.o. (Slovenia) and OVH S.r.l. (Italy) with infrastructures entirely located within the European Union.
• Electronic Mail: QBoxMail S.r.l. (Italy) with infrastructures entirely located within the European Union.
• Productivity: Google Workspace. The transfer to Google LLC (USA) is legitimised by adherence to the EU-U.S. Data Privacy Framework.

Social Media, Messaging, and External Widgets

• Google Maps (Widget): Where present, to protect user privacy, the interactive Google map is disabled by default. No data is sent to Google until the user expresses explicit consent by clicking the activation button ("Load Map").
• Meta (WhatsApp, FB, IG): Transfer based on the Data Privacy Framework or Standard Contractual Clauses. Limited to "Page Insights" statistics services, the Controller and Meta Platforms Ireland Ltd operate under a Joint Controllership regime (Art. 26 GDPR), the agreement for which is available in Meta's Controller Addendum.
• Telegram and TikTok: Transfers protected by Standard Contractual Clauses (SCC).

Data Breach Management

In the event of a personal data breach presenting a risk to the rights and freedoms of natural persons, the Controller undertakes to notify the breach to the Data Protection Authority (Garante per la Protezione dei Dati Personali) within 72 hours of its discovery and, where the risk is high, to promptly communicate the incident to the data subjects.

6. Data Retention

• Marketing and contacts: 12 months from the last interaction.
• Fiscal/Legal data: 10 years (statutory limitation periods).

7. Rights of the Data Subject

Users may at any time exercise their rights of access, rectification, erasure (right to be forgotten), restriction, objection, and portability by writing to privacy@mielenaturale.it.

The right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) is always preserved (www.gpdp.it).

8. Cookie Policy

The Site uses exclusively technical cookies strictly necessary for navigation and the correct functioning of the infrastructure. No proprietary profiling tools or automated analytical trackers (e.g., Google Analytics or Facebook Pixel) are activated.

Any third-party profiling cookies (for example, those linked to Google Maps) will be installed on the user's device only following a positive and voluntary action (clicking to activate the content).

The user maintains in any case the ability to completely disable the reception of cookies through their browser settings, being aware that this operation could compromise the correct functioning of certain Site features.

9. Amendments

The Controller reserves the right to update this document in accordance with regulatory or technical developments. The amendments shall be effective from the publication date indicated at the top of the document.