Privacy Notice pursuant to Art. 13 of the EU GDPR and the UK GDPR.

 Last update: July 2025

Controller: Tenute Ruffino S.r.l. Società Agricola (“we”, “us” or “Ruffino”) with Headquarters in Via Poggio al Mandorlo 1, Loc. Quarate, Bagno a Ripoli (FI), email: tenuteruffino@ruffino.it or event@ruffino.it

We collect and process your personal information with utmost care, and in compliance with the EU GDPR and UK GDPR and other applicable data protection laws (collectively, “Privacy Laws”).

This Privacy notice applies to the Website events.ruffino.it/en . 

This Privacy notice explains what kind of personal information we collect, how we use it, for how long we store it, who we might share it with, and your rights in relation to the information we collect. We may also collect information on your internet browsing through cookies and other tracking technologies. Please see the cookie policy, available here https://events.ruffino.it/en/cookies-policy for the web site.

This Privacy notice should be read in conjunction with the Terms of Use of the Ruffino’s Websites, Terms and Conditions of Experience Reservation and Terms of Sale.

This Privacy notice describes the data processing activities carried out in the context of browsing the Ruffino’s Websites.

Within this Privacy notice, we will address the following:

CONTENTS

1. WHAT PERSONAL INFORMATION DO WE COLLECT AND HOW DO WE COLLECT IT?
2. WHY DO WE COLLECT YOUR PERSONAL INFORMATION AND WHAT IS THE LEGAL BASIS FOR PROCESSING?
3. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?
4. WHO DO WE SHARE PERSONAL INFORMATION WITH?
5. HOW IS PERSONAL INFORMATION SECURED?
6. HOW CAN I EXERCISE MY PRIVACY RIGHTS?
7. HOW CAN I CONTACT RUFFINO?
8. MINORS.

We invite you to regularly review this Privacy notice in order to acknowledge any updates on collection and conditions of processing your personal data.

Before submitting any personal data, please read this Privacy notice carefully to understand how we process your personal data and the features of said processing.

By accessing or using Ruffino’s Websites, you confirm that you have read this Privacy notice and that you understand how we collect, process, use and disclose your personal data as herein described.

1) WHAT PERSONAL INFORMATION DO WE COLLECT AND HOW DO WE COLLECT IT?

We collect information directly from you or from other sources, as below specified.

Personal Information you provide us.

User information: We process data such as your first and last name, date of birth, country of residence and your contact information (e.g. telephone number, address and email address). Your email, together with a password of your choice, will be registered to allow you to access your personal account.

Personal Information automatically collected.

While you visit Ruffino Websites, we automatically collect information through cookies and other tracking technologies.

Technical information: We process certain information when you visit or use any of Ruffino’s Websites, including your Internet Protocol (IP) address, login information, browser type and version, device IDs, operating system and platform, device settings (e.g. language and time zone), and information relating to your mobile operator or Internet Service Provider (ISP). This information helps ensure content on Ruffino’s Websites is presented effectively for you and for your device.

For more specific information on the cookies and other tracking technologies we use, please refer to our Cookie Policy, available here https://events.ruffino.it/en/cookies-policy.

2) WHY DO WE COLLECT YOUR PERSONAL INFORMATION AND WHAT IS THE LEGAL BASIS FOR PROCESSING?

We process your data for the following purposes; for each of them we state the data processed and the legal basis that legitimises our processing:

When we rely on our legitimate interest as legal basis for the processing, we carry out a balancing test in order to ensure that your interests and fundamental rights and freedoms are not overridden by our interests You can request further details by contacting us as described below at point 7. Our legitimate interests include enhancing our services, preventing fraud, preventing the misuse of IT systems, ensuring IT and network security, carrying out internal investigations, or to aid with potential merger and acquisition activities.

We may also link and/or combine the information we collect about you from the various devices you use.

When do you need to provide your personal information? The provision of your data is necessary when the legal basis for processing (as described above) is to comply with applicable laws (e.g. to conduct age verification on users) or to perform our obligations under a contract with you (e.g. for your registration on Ruffino’s Websites or to fulfil a purchase you make). If you do not provide your personal data, we may not be able to proceed with your registration or manage your purchases.

The provision of your personal data for marketing purposes is optional. Choosing not to provide your personal data for this purpose will not affect your ability to Ruffino’s Websites register and purchases.

3) HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

Your data will be stored for the time strictly necessary to fulfil the purpose it was collected for and in compliance with storage limitation principles under the applicable Privacy Laws.

We may need to retain your data for a longer period to comply with applicable laws (e.g. bookkeeping rules)

We will inform you as applicable on when there are extended data retention obligations we have to comply with.

4) WHO DO WE SHARE PERSONAL INFORMATION WITH?

We may share your personal information with:

• authorised Ruffino personnel and other group companies in the Ruffino Group;
• our third party service providers, when required to fulfil the use purposes set out point 2 above. Our service providers act as data processors, and are appointed and instructed on the basis of a specific contract. Service providers will only process your personal information on our behalf as necessary to perform their support functions (e.g. payment processing), doing so in accordance with our instructions and applicable Privacy Laws. You can request the updated list of processors by contacting us at the contact details set out at point 7 below;
• third parties such as law enforcement agencies, regulators or other similar government bodies when required to comply with a legal obligation, applicable laws or regulation;
• third parties such as auditors, legal advisers or other professional advisers

Data recipients may be established in third countries worldwide without an adequate level of protection of personal data (e.g. in the case of shipping outside the EU that requires communicating your data to local couriers). We takes all necessary measures to ensure that the transfer of data outside the EU is adequately protected as required by applicable Privacy Laws, including using the European Commission’s Standard Contractual Clauses and addenda required by local law as applicable and applying relevant measures as required by applicable Privacy Laws.

We may transfer your personal data to the United States to our parent company, to other affiliated companies, or to service providers, if necessary to pursue the purposes set out in this privacy notice. Such transfers are carried out in compliance with applicable privacy laws, through the adoption of the European Commission’s Standard Contractual Clauses and any additional measures necessary to ensure an adequate level of data protection.

5) HOW IS PERSONAL INFORMATION SECURED?

The processing of your personal information may be carried out manually or electronically, in each case in accordance with the logic and procedures necessary to ensure the protection of your data and to ensure their security. We take appropriate security measures, including physical, technological, and procedural measures, to help to safeguard your personal data and to prevent unauthorised access and disclosure.

Unfortunately, the transmission of information via the internet is not completely secure. We do our best to protect your personal information, but we cannot guarantee the security of your data transmitted to us, any transmission is at your own risk. Once we have received your information, we use strict procedures and security features to try to prevent unauthorised access.

6) HOW CAN I EXERCISE MY PRIVACY RIGHTS?

You may contact Ruffino, at the contact details indicated below, to exercise your rights under applicable Privacy Laws, including:

• Right of access: You may request access to your data and verify its origin and accuracy.
• Right to portability: In certain cases, you may also obtain a copy of your personal data that is commonly used and machine-readable in order to enable you to exercise your right to data portability and to transfer them to another data controller or request us to transfer such data directly to another data controller to the extent this is technically possible.
• Right of rectification: You may request the integration of incomplete data and the rectification or updating of inaccurate data.
• Right of erasure: You may request the erasure of your data and the portability of the same.
• Right to limit the processing: You may request the restriction of the processing and object to the processing of your personal data.
• Right to withdraw your consent: You may withdraw any consent you may have given.
• Right to lodge a complaint: You may lodge a complaint to the competent supervisory authority and contact the authority if the exercise of your rights is subject to delay, restriction or exemption, pursuant to law.
• Right to object: As applicable under privacy laws, you have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data and we may be required to no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing or for the establishment, exercise or defence of legal claims.

7) HOW CAN I EXERCISE MY PRIVACY RIGHTS?

If you have questions or comments regarding this Privacy notice or our privacy practices, wish to enforce your data privacy rights as set out at point 6 above, or want to receive the current list of our data processors and third parties with whom we share your personal data or receive further information on the balancing test performed when we rely on our legitimate interest for the data processing and the transfer of personal data to third countries, you can contact us at:

Tenute Ruffino S.r.l. Società Agricola (“we”, “us” or “Ruffino”) with Headquarters in Via Poggio al Mandorlo 1, Loc. Quarate, Bagno a Ripoli (FI), email:  tenuteruffino@ruffino.it or event@ruffino.it