The following information provides an overview of what happens to your personal data when you visit our website or submit one of the forms on the website. Processing takes place in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) as well as the Italian Data Protection Code D.Lgs. 196/2003, as amended by D.Lgs. 101/2018, and the relevant regulations and guidelines of the Garante per la protezione dei dati personali. Definitions of the terms used (e.g., "personal data" or "processing") can be found in Art. 4 of Regulation (EU) 2016/679.

1. Data Controller

The data controller responsible for processing data on this website is:
Weingut Schmid Oberrautner
Michael-Pacher-Str. 3
I-39100 Bozen
Email: info@schmidoberrautner.it
Phone: +39 0471 281440

If you wish to object to the collection, processing, or storage of your personal data by us, you can send your objection by email to the address mentioned above. As a result of your objection, further use of the website may no longer be possible for technical reasons.

2. Your Rights

You have the following rights regarding the personal data concerning you (Art. 15–22 Regulation (EU) 2016/679 as well as the corresponding provisions of D.Lgs. 196/2003):

• Right of access

• Right to rectification

• Right to erasure

• Right to restriction of processing

• Right to data portability

• Right to object to processing

• Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

You also have the right to lodge a complaint with a data protection supervisory authority. To exercise these rights, an informal email to info@schmidoberrautner.it is sufficient.

3. Complaints

Competent Supervisory Authority:
Garante per la protezione dei dati personali
Piazza di Monte Citorio 12
00186 Roma

• Email: garante@gpdp.it

• PEC: protocollo@gpdp.it

• Fax: (+39) 06 69677 3785

• Phone: (+39) 06 696771

4. Hosting and Server Data

Our website is hosted in Germany and operated by sthot-systems (self-hosting). A data processing agreement (DPA) pursuant to Art. 28 Regulation (EU) 2016/679 has been concluded with sthot-systems. Within the scope of this agreement, data will not be passed on to third parties and is protected against unauthorized use and loss to the best extent possible. For more information on sthot-systems' data privacy: https://www.sthot.eu/dataprotection.html

Server Log Files

When using the website for purely informational purposes, we collect the personal data that your browser transmits to our server. This data is technically necessary to display the website and to ensure stability and security. Legal basis: Art. 6(1)(f) Regulation (EU) 2016/679 (legitimate interest in the secure and stable operation of the website) in conjunction with the relevant provisions of D.Lgs. 196/2003.

In particular, the following are logged:

• IP address

• Date and time of the request

• Content of the request (specific page)

• Access status / HTTP status code

• Volume of data transferred in each case

• Website from which the request originates (referrer)

• Browser

• Operating system and its interface

• Language and version of the browser software

These server log files are deleted after 10 days.

5. Cookies and Storage on the Terminal Device

The storage of information on your terminal device or access to it is governed by Art. 122 D.Lgs. 196/2003 as well as the guidelines of the Garante on cookies and other tracking tools.This website uses exclusively technically necessary cookies in connection with self-hosted web analytics (Matomo). No optional third-party marketing cookies are set.

Currently set cookies:

Legal basis for these technically required cookies: Art. 122(1) D.Lgs. 196/2003 (technical storage or access insofar as strictly necessary for the provision of an information society service explicitly requested by the user) as well as Art. 6(1)(f) Regulation (EU) 2016/679. You can restrict or prevent the storage of cookies in your browser settings. Without cookies, the functionality of the website may be limited.

6. Matomo Analytics (Self-Hosted)

This website uses Matomo to analyze the use of our online presence. Matomo is operated by us or by sthot-systems on our own servers in Germany. Analytics data is not forwarded to Google or other external analytics providers. Matomo uses the cookies mentioned above. IP addresses are shortened and anonymized. Legal basis: Art. 6(1)(f) Regulation (EU) 2016/679 (legitimate interest in the analysis and optimization of the website) as well as Art. 122 D.Lgs. 196/2003 for the associated technically necessary cookies. No other analytics, tracking, or marketing services (e.g., Google Analytics, Google Tag Manager, ad networks) are used.

7. Form Data

Personal data submitted via forms (e.g., vacation or contact inquiries) is used exclusively to process your request and for the technical handling associated with it. Form data is not stored on the web server or within the CMS. It is transmitted directly via email to info@schmidoberrautner.it and processed there as part of the correspondence. Legal basis: Art. 6(1)(f) Regulation (EU) 2016/679 (legitimate interest in responding to your inquiry). Insofar as the request aims at concluding or fulfilling a contract, additionally Art. 6(1)(b) Regulation (EU) 2016/679, in each case in conjunction with D.Lgs. 196/2003.

8. Google Maps (Integration Only After Consent)

This site embeds the map service Google Maps via an iframe. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (if applicable, supported by Google LLC, USA). When loading the embedded map, a connection to Google's servers is established; in particular, your IP address may be transmitted to Google and processed there. Prior consent (consent gate) before loading the map currently does not take place. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an appealing presentation and easy findability of the specified locations). Insofar as data is transferred to third countries (in particular the USA), Google relies, according to its own statements, on the EU-US Data Privacy Framework and/or standard contractual clauses. We have no influence on the actual data processing performed by Google. Further information: https://policies.google.com/privacy

9. Fonts (Locally Hosted)

To display fonts uniformly, the fonts used on this website are hosted locally on our server. When opening a page, no fonts are reloaded from servers of Google or other third-party providers. Therefore, no data transmission to Google occurs in connection with web fonts.

10. Integration of YouTube Videos (YouTube Player API)

On this website, we use the YouTube Player API to embed and display controllable videos directly on the page. The provider of this service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google", potentially involving Google LLC, USA).

Data Processing and Functionality

When using the API-based player, a connection to Google or YouTube servers is established. In doing so, technical data (e.g., your IP address, referrer URL, browser settings) as well as usage and interaction data (e.g., start, stop, or scrub duration of the video) are transmitted to Google and processed. Furthermore, the API accesses local storage technologies in your browser (e.g., cookies, Local Storage, or Session Storage) to save player settings, ensure the functionality of the API, and prevent abuse.

Legal Basis and Consent

The loading of the YouTube API and the associated data processing take place exclusively on the basis of your prior express consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG (or corresponding national data protection laws). You may revoke this consent at any time with future effect via our cookie settings on the website.

Third-Country Transfers

Insofar as data is transferred to the USA or other third countries, Google relies, according to its own statements, on the EU-US Data Privacy Framework as well as Standard Contractual Clauses issued by the EU Commission. Further information: https://policies.google.com/privacy

11. Erasure of Data

Unless statutory retention obligations apply, data is deleted as soon as it is no longer required for the purpose of processing. Server log files are deleted after 10 days as described above. Email correspondence from form inquiries is retained for as long as necessary to process the request and, if applicable, for legal defense.

12. Right to Object and Withdrawal of Consent

You can object at any time to the processing of your personal data based on legitimate interest (Art. 21 Regulation (EU) 2016/679). Insofar as the processing is based on your consent (in particular Google Maps and YouTube), you can withdraw this consent at any time (Art. 7(3) Regulation (EU) 2016/679). For rectification, blocking, erasure, information, or questions regarding data processing, please contact: info@schmidoberrautner.it