Scope
This notice explains how Sunawi Società Agricola s.r.l. processes personal data when you browse the website or contact us. It covers SUNAWI pages and the services described here.
Controller
The data controller is Sunawi Società Agricola s.r.l., with its registered office at Via Europa 77, 25087 Salò (BS), Italy, VAT number 04222060982.
Contact details
For information about our wines and company: info@sunawi.it. For questions about your personal data or to exercise your rights: privacy@sunawi.it, or write to the controller’s registered office.
Data processed
Browsing transmits the technical data needed to deliver pages, such as your IP address, request date and time, and browser information. If you email us, we receive your email address, any other contact details you choose to provide and your message. Email and telephone links open applications on your device; this website does not submit forms to a server. We do not integrate advertising tools, behavioural analytics or automated decision-making about individuals.
Purposes and legal bases
We use message data to reply and handle your request. Requests related to entering into or performing a contract are processed under Article 6(1)(b) GDPR. Other communications are processed on the basis of our legitimate interest in responding to your request, under Article 6(1)(f). Providing contact details is optional, but without them we may be unable to reply. Contacting us does not subscribe you to promotional messages.
Hosting
Pages, images, fonts and scripts are served by the same website. The hosting infrastructure receives the technical data needed to deliver and protect the service. The website is hosted on OVHcloud Web Hosting at the Gravelines data centre in France. Technical copies of the files may also be replicated in Roubaix, France. Pages, images and scripts are served by this infrastructure; the website has no message database or form-submission system.
Technical logs
Access and security logs may contain IP addresses, dates and times, requested resources and request outcomes. They support website operation, error diagnosis and abuse prevention, based on the legitimate interest in keeping the service secure. The website does not create an additional log archive: access and security logs are managed by the OVHcloud infrastructure. The retention criterion takes into account the time needed to provide the service, diagnose faults and handle security incidents, together with any applicable obligations. Technical log retention is separate from the retention of anonymised statistical reports and website file backups.
Retention
We retain data for the period needed for the purpose for which it was collected. Email enquiries are accessible only to authorised staff. We retain them for the time needed to handle the enquiry and any resulting relationship, then delete them, except where legal obligations or documented needs to protect rights require retention. External-service preferences are valid for six months from your choice; see Cookies and browser storage for details. Legal obligations or disputes may require relevant data to be retained for the applicable period.
Recipients and transfers
Data may be processed by authorised people handling enquiries and by the technical providers needed for hosting and email. We use OVHcloud for hosting and Google Workspace for company email. The providers and their subprocessors may process data needed to deliver, secure and support these services. Hosting files in Gravelines does not mean that all processing, including email and remote support, takes place exclusively in the European Union. Provider agreements specify adequacy decisions or standard contractual clauses, where applicable, for international transfers. The relevant data processing agreements and subprocessor lists are available through the links shown here; you can ask the controller for information about the safeguards applied. If you allow the map, your browser communicates directly with the OpenStreetMap Foundation under its privacy policy.
Your rights
Where the GDPR provides, you may request access, rectification, erasure, restriction of processing and data portability. You may also object to processing based on legitimate interests for reasons relating to your particular situation. Where processing is based on consent, you may withdraw it without affecting the lawfulness of processing already carried out. Send requests to privacy@sunawi.it.
Complaints
If you believe processing breaches data protection law, you may lodge a complaint with the Italian Data Protection Authority using the procedures on garanteprivacy.it, or with the competent supervisory authority in the EU country where you live, work or where the alleged infringement occurred.
Cookies and browser storage
The website code sets no advertising or profiling cookies and does not embed social widgets. Technical browser storage (localStorage) remembers your choices: sunawi.privacy.v1 stores the notice version, date, expiry and map preference; sunawi.privacy.v1.events keeps up to 20 local choice records, each valid for six months. These records stay in your browser and are not sent to a central register. Expired choices are no longer used; expired records are removed the next time the preference system runs. You can delete this storage in your browser settings. You will then need to choose again, as you will on another device or domain.
Map and consent
The OpenStreetMap map is optional and stays off without your consent. Allowing it sends your IP address, site origin and technical browser data to the OpenStreetMap Foundation to download map images. The map does not request your device’s geolocation. Consent for this loading is based on Article 6(1)(a) GDPR. You can refuse and still browse, read the written address and open directions separately. Change or withdraw your choice through “Privacy preferences” in the footer: the map is removed and further requests for map images stop. Withdrawal does not erase data the provider has already received.
External links
Instagram and directions are links to external services, rather than embedded content. They open only when you select them. Once opened, data processing also depends on the external provider and its privacy policy. The same applies to the email or telephone application you choose to use.
Updates
Text updated: 2 October 2026. This page is updated when services or processing arrangements change. Changes requiring a fresh choice for optional services are presented before those services are activated.
Website backups
For website files, OVHcloud documents restore points from 1, 2, 3, 7 and 14 days earlier. These are technical copies for restoring the website; they do not contain an archive of visitor messages, because the website does not collect forms on the server.
Technical hosting cookie
The OVHcloud infrastructure may set the technical SERVER ID cookie to keep requests on the same server during a session. According to the provider’s documentation, it lasts less than 24 hours and is necessary for the hosting service to work. The website does not use it for advertising.
Server statistics
OVHcloud provides technical statistics calculated from server logs after anonymisation and aggregation. They do not require an analytics script in the pages. Reports are available for up to 40 months; this period concerns statistical reports, not the retention of raw logs.
OVHcloud · Web Hosting · OVHcloud · Data Processing Agreement · OVHcloud · Sub-processors · OVHcloud · Web Hosting terms · Google Workspace · Data Processing Agreement
OpenStreetMap privacy policy · Garante per la protezione dei dati personali