Privacy Policy
Last updated: May 2025
1. Data Controller
The Data Controller for the personal data collected through the website cestellofirenze.com (hereinafter "the Site") is:
Cestello Firenze
Piazza di Cestello, 8 — 50124 Firenze (FI)
E-mail: info@cestellofirenze.com
This Privacy Notice is provided pursuant to Article 13 of EU Regulation 2016/679 (GDPR) to all individuals who interact with the services of the Site.
2. Data Collected and Processing Methods
2.1 Browsing Data
The computer systems and software procedures used to operate the Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses, the type of browser, the operating system, the domain name and the addresses of the websites from which access is made, the pages visited, the time of the visit and other parameters relating to the user's operating system and computer environment.
2.2 Data Provided Voluntarily by the User
The optional, explicit and voluntary sending of messages to the email addresses indicated on the Site entails the subsequent acquisition of the sender's address, which is necessary in order to respond to requests, as well as of any other personal data included in the communication. Such data is used solely for the purpose of responding to the requests received and is not disclosed to third parties.
2.3 Data Collected through Google Analytics 4
The Site uses Google Analytics 4, a web analytics service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics 4 uses cookies and similar technologies to collect and analyse information on users' use of the Site and to produce reports on the Site's activities.
The information generated by the cookie about the use of the Site (including the IP address, transmitted in anonymised form by means of the IP Anonymization function activated by the Data Controller) is transmitted to and stored on Google's servers. This information is processed by Google in order to compile reports on the Site's activity.
The data collected by Google Analytics 4 includes, by way of example and without limitation: pages visited, session duration, aggregated geographic origin, device type and browser. No directly identifying information is collected.
Users can disable Google Analytics by installing the browser add-on available at tools.google.com/dlpage/gaoptout.
3. Legal Basis for Processing
The processing of browsing data is carried out on the basis of the Data Controller's legitimate interest for the purposes of information security and the proper provision of the service (Art. 6(1)(f) GDPR). Processing through analytics cookies is carried out subject to the user's consent where required by applicable legislation (Art. 6(1)(a) GDPR).
4. Purposes of Processing
The personal data collected is processed for the following purposes:
— management and maintenance of the Site;
— responding to user requests;
— anonymous statistical analysis of the use of the Site (Google Analytics 4);
— compliance with legal obligations.
5. Data Retention
Browsing data is retained for the time strictly necessary for the purposes for which it was collected and, in any case, for a period not exceeding 12 months, except where it is necessary to investigate criminal offences. Contact data (email) is retained for the time necessary to handle the request and in any case for no longer than 24 months. Data collected through Google Analytics 4 is retained for a period of 14 months from the date of collection, as set in the platform's properties.
6. Disclosure and Dissemination of Data
Personal data is not disseminated, sold or transferred to third parties, except as indicated in this Privacy Notice in relation to Google Analytics 4. Data may be disclosed to the competent authorities where required by law or by orders of the judicial authorities.
7. Rights of the Data Subject
As a data subject, the user has the right to exercise the following rights at any time pursuant to Articles 15–22 GDPR:
Obtain confirmation as to whether data concerning you exists and a copy of that data.
Request the correction of inaccurate data or the completion of incomplete data.
Request the erasure of data when it is no longer necessary for the purposes for which it was collected.
Request the restriction of processing in specific circumstances provided for by Article 18 GDPR.
Receive the data you have provided in a structured, commonly used and machine-readable format.
Object to the processing of your data on grounds relating to your particular situation.
Withdraw the consent given at any time, without affecting the lawfulness of processing carried out beforehand.
Lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (garanteprivacy.it).
To exercise your rights, simply send a written request to the Data Controller at info@cestellofirenze.com. The Data Controller will respond within 30 days of receiving the request.
8. Security
The Data Controller adopts appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration or destruction. Communications between the Site and users' browsers take place via the HTTPS protocol with TLS encryption.
9. Changes to the Privacy Policy
The Data Controller reserves the right to update this Privacy Notice at any time. The updated version will be made available on the Site with an indication of the revision date. You are advised to consult this page periodically.
10. Contact
For any request relating to the processing of personal data or to the exercise of the rights set out in section 7, you may contact the Data Controller at:
Cestello Firenze
Piazza di Cestello, 8 — 50124 Firenze (FI)
info@cestellofirenze.com