Scope
This notice explains how Sunawi Società Agricola s.r.l. processes personal data when you browse the website or contact us. It covers SUNAWI pages and the services described here.
Controller
The data controller is Sunawi Società Agricola s.r.l., with its registered office at Via Europa 77, 25087 Salò (BS), Italy, VAT number 04222060982.
Contact details
For information about our wines and company: info@sunawi.it. For questions about your personal data or to exercise your rights: privacy@sunawi.it, or write to the controller’s registered office.
Data processed
Browsing transmits the technical data needed to deliver pages, such as your IP address, request date and time, and browser information. If you email us, we receive your email address, any other contact details you choose to provide and your message. Email and telephone links open applications on your device. The assistant’s separate “Send an enquiry” form is an exception: when you press its submit button, your name, email and enquiry are recorded on OVHcloud for contact; these fields are not sent to the AI model. We do not integrate advertising tools, behavioural analytics or automated decision-making about individuals. After each AI exchange, a summary is also emailed to the team as described in the dedicated section.
Purposes and legal bases
We use message data to reply and handle your request. Requests related to entering into or performing a contract are processed under Article 6(1)(b) GDPR. Other communications are processed on the basis of our legitimate interest in responding to your request, under Article 6(1)(f). Providing contact details is optional, but without them we may be unable to reply. Contacting us does not subscribe you to promotional messages.
Hosting
Pages, images, fonts and scripts are served by the same website. The hosting infrastructure receives the technical data needed to deliver and protect the service. The website is hosted on OVHcloud Web Hosting at the Gravelines data centre in France. Technical copies of the files may also be replicated in Roubaix, France. Pages, images and scripts are served by this infrastructure; the assistant’s separate “Send an enquiry” form records your name, email and enquiry in a private OVHcloud folder accessible only to authorised people. After each AI exchange, a summary is also emailed to the team as described in the dedicated section.
Technical logs
Access and security logs may contain IP addresses, dates and times, requested resources and request outcomes. They support website operation, error diagnosis and abuse prevention, based on the legitimate interest in keeping the service secure. The applications do not add a full conversation archive. Email summaries and the sending queue are processed separately, as described in the assistant section. To protect the assistant it uses counters with IP-derived HMAC pseudonyms that change each UTC day, without raw IP addresses; previous-day data is removed on the next request or by daily maintenance. Access and security logs are managed by the OVHcloud infrastructure. The retention criterion takes into account the time needed to provide the service, diagnose faults and handle security incidents, together with any applicable obligations. Technical log retention is separate from the retention of anonymised statistical reports and website file backups.
Retention
We retain data for the period needed for the purpose for which it was collected. Email enquiries are accessible only to authorised staff. We retain them for the time needed to handle the enquiry and any resulting relationship, then delete them, except where legal obligations or documented needs to protect rights require retention. External-service preferences are valid for six months from your choice; see Cookies and browser storage for details. Legal obligations or disputes may require relevant data to be retained for the applicable period.
Recipients and transfers
Data may be processed by authorised people handling enquiries and by the technical providers needed for hosting and email. We use OVHcloud for hosting and Google Workspace for company email. The providers and their subprocessors may process data needed to deliver, secure and support these services. Hosting files in Gravelines does not mean that all processing, including email and remote support, takes place exclusively in the European Union. Provider agreements specify adequacy decisions or standard contractual clauses, where applicable, for international transfers. The relevant data processing agreements and subprocessor lists are available through the links shown here; you can ask the controller for information about the safeguards applied. If you allow the map, your browser communicates directly with the OpenStreetMap Foundation under its privacy policy.
Your rights
Where the GDPR provides, you may request access, rectification, erasure, restriction of processing and data portability. You may also object to processing based on legitimate interests for reasons relating to your particular situation. Where processing is based on consent, you may withdraw it without affecting the lawfulness of processing already carried out. Send requests to privacy@sunawi.it.
Complaints
If you believe processing breaches data protection law, you may lodge a complaint with the Italian Data Protection Authority using the procedures on garanteprivacy.it, or with the competent supervisory authority in the EU country where you live, work or where the alleged infringement occurred.
Cookies and browser storage
The website code sets no advertising or profiling cookies and does not embed social widgets. Technical browser storage (localStorage) remembers your choices: sunawi.privacy.v1 stores the notice version, date, expiry and map preference; sunawi.privacy.v1.events keeps up to 20 local choice records, each valid for six calendar months. When you make or change a choice on the OVH website, a technical record is also sent to the controller and retained in a private consent register for six calendar months. This register is separate from the records stored locally on your device. Expired choices are no longer used; expired records are removed the next time the preference system runs. You can delete this storage in your browser settings. You will then need to choose again, as you will on another device or domain.
Map and consent
The OpenStreetMap map is optional and stays off without your consent. Allowing it sends your IP address, site origin and technical browser data to the OpenStreetMap Foundation to download map images. The map does not request your device’s geolocation. Consent for this loading is based on Article 6(1)(a) GDPR. You can refuse and still browse, read the written address and open directions separately. Change or withdraw your choice through “Privacy preferences” in the footer: the map is removed and further requests for map images stop. Withdrawal does not erase data the provider has already received.
External links
Instagram and directions are links to external services, rather than embedded content. They open only when you select them. Once opened, data processing also depends on the external provider and its privacy policy. The same applies to the email or telephone application you choose to use.
Updates
Text updated: 4 October 2026. This page is updated when services or processing arrangements change. Changes requiring a fresh choice for optional services are presented before those services are activated.
Website backups
For website files, OVHcloud documents restore points from 1, 2, 3, 7 and 14 days earlier. These are technical copies for restoring the website. The private enquiry register and the email-summary queue are separate stores. Technical copies that include the register follow the provider’s restore periods; the 90-day enquiry expiry is reapplied when data is restored. This expiry does not mean immediate deletion of the provider’s technical copies or copies exported by the operator. The email queue keeps content for up to seven days; technical backups may retain it for up to 31 days. Expiry is reapplied after restoration.
Technical hosting cookie
The OVHcloud infrastructure may set the technical SERVER ID cookie to keep requests on the same server during a session. According to the provider’s documentation, it lasts less than 24 hours and is necessary for the hosting service to work. The website does not use it for advertising.
Server statistics
OVHcloud provides technical statistics calculated from server logs after anonymisation and aggregation. They do not require an analytics script in the pages. Reports are available for up to 40 months; this period concerns statistical reports, not the retention of raw logs.
OVHcloud · Web Hosting · OVHcloud · Data Processing Agreement · OVHcloud · Sub-processors · OVHcloud · Web Hosting terms · Google Workspace · Data Processing Agreement
OpenStreetMap privacy policy · Garante per la protezione dei dati personali
AI assistant and team enquiries
You can choose to use an artificial intelligence assistant to explore the website’s content. The controller is Sunawi Società Agricola s.r.l.. The service starts when you select “Start the conversation”; messages are transmitted to OpenAI’s APIs only when you send them. Avoid personal details, confidential information and other people’s data in the chat. Use the separate “Send an enquiry” form to leave contact details. After each AI exchange, a summary is also emailed to the team as described in the dedicated section.
We process messages to answer your enquiry. For information relating to a contract, the legal basis is Article 6(1)(b) of the GDPR; for other questions, our legitimate interest in responding under Article 6(1)(f). The assistant can make mistakes: it does not confirm orders or bookings, or make decisions with legal effects on people. We do not use conversations for behavioural analytics or marketing.
The copy displayed on your device remains in the page’s memory and is cleared by “New conversation” or by closing the page. OpenAI may retain content in security logs for up to 30 days, subject to legal or abuse-prevention exceptions; the provider’s documented technical retention also applies. We do not enable data sharing for model training.
If you submit the separate form, your name, email and enquiry text are saved in a private register on OVHcloud, accessible to authorised staff, to handle your request for contact. These fields are not sent to the AI model. The enquiry expires 90 days after submission; expired records are removed during daily cleanup or the next submission. Technical backups follow the periods described in this notice, and expiry is reapplied after restoration. Any resulting relationship follows the retention criterion already described for enquiries and applicable obligations. Submission does not subscribe you to marketing.
We use OVHcloud and OpenAI’s APIs to provide this service. OpenAI’s data processing agreement for customers in the European Economic Area identifies OpenAI Ireland Ltd. and provides for standard contractual clauses or adequacy decisions, where applicable, for transfers outside the EEA. The agreement and subprocessor list are available through the links shown here. You can ask about the safeguards applied, exercise the rights described in this notice or contact us at privacy@sunawi.it. You can continue browsing and contact us directly without using the assistant.
After each AI exchange, we email a summary of the question and reply to giuseppe@paeoniasrl.com to follow up on enquiries. A private OVHcloud queue keeps the content needed for sending for up to seven days; it is removed once the email service accepts the message, which does not guarantee delivery. Backups may retain it for up to 31 days; expiry is reapplied after restoration. Only authorised staff can access emailed summaries. They are kept to handle the enquiry and any resulting relationship, then deleted unless legal obligations or documented needs to establish or defend a right require otherwise. They do not confirm an order, booking or follow-up. Technical sending uses Microsoft 365 through hello@villaeuropagardalake.com. A copy may remain in Sent Items as well as in the recipient’s mailbox; the same access and retention rules apply to both.
To limit abuse, we keep usage counters associated with an IP-derived pseudonymous identifier that changes each UTC day; these counters contain neither the raw IP address nor messages. Previous-day counters are deleted on the next request or during daily maintenance. The temporary session token is valid for 30 minutes and remains in the page’s memory. Hosting logs follow the criteria already described in this notice.
OpenAI · Data controls · OpenAI · DPA · OpenAI · Sub-processors
Managing and demonstrating privacy choices
On public domains hosted by OVHcloud, when you make or change a choice, the website sends a technical record to its own server: a random identifier, website, notice version, date, action, optional-service choice and expiry. The application register does not store your IP address, browser information, email or message contents. Hosting logs, described separately, may contain IP addresses and request data.
These records are used to manage and demonstrate privacy choices and withdrawals. Demonstrating consent fulfils the controller’s duties under GDPR Articles 5(2) and 7(1); the records are not used for advertising, profiling or behavioural analytics.
External maps are enabled only with consent (GDPR Article 6(1)(a)). Evidence of consent and withdrawal is retained to meet the obligation to demonstrate consent under Article 7(1), on the basis of Article 6(1)(c). Recording a refusal serves the legitimate interest in respecting the choice and keeping preferences working (Article 6(1)(f)), without enabling optional services.
Choice records expire after six calendar months. At expiry they are no longer used to manage preferences. Expired files are deleted progressively during subsequent reads of the register and recording of new choices, with cleanup split into groups of files. Until cleanup is completed, and during periods without traffic, expired data may remain in the files. This period is an operational choice for managing preferences; it is separate from the retention criteria for emails and hosting logs.
The register is stored outside the website’s public folder and is accessible only to authorised staff and technical providers authorised for the service. It is not sent to OpenStreetMap or social websites. For requests concerning your data, contact the controller identified in this notice.
OpenStreetMap map images are served through a global server network. Request data may therefore be processed outside the European Economic Area, as described in the provider’s privacy policy. This map remains optional, and you can use the written addresses without enabling it.