PRIVACY POLICY
Information on the processing of personal data under Articles 12 and 13 of Regulation (EU) 2016/679 (“GDPR”)
Last updated: 1 October 2026
1. DATA CONTROLLER
The Data Controller is:
Morisfarms S.r.l. Società Agricola
Fattoria Poggetti – Località Cura Nuova
58024 Massa Marittima (GR), Italy
VAT No. 01092500535 – Tax Code 00246020523
E-mail: [email protected]
Telephone: +39 0566 919135
This Privacy Policy explains how Morisfarms processes personal data collected through morisfarms.it and related services, including the online shop, information requests, farm-stay bookings, Terrazza Moris reservations and other forms or online services made available by Morisfarms.
2. PERSONAL DATA WE MAY COLLECT
Depending on the service used, we may process:
• identification and contact details, such as first name, surname, e-mail address, telephone number and address;
• order and purchase data, such as products ordered, shipping and billing address, payment status, invoices, receipts and related documents;
• reservation data, such as date, time, number and composition of guests, special requests and information needed to manage the service;
• for farm-stay guests, the information required by applicable law to identify and register guests and to comply with obligations toward the competent authorities;
• information contained in communications with us, including requests sent by e-mail, telephone, online forms or other channels chosen by the user;
• technical browsing data, such as IP address, browser or device type, technical logs, access date and time and information needed for security and the proper operation of the website;
• preferences relating to cookies and promotional communications;
• only where voluntarily provided by the user, information relating to food allergies or intolerances. This information may qualify as special-category personal data and is processed only to safely manage the requested service and, where required, on the basis of the data subject’s explicit consent.
We do not request personal data that is not reasonably necessary for the requested service.
3. WHY WE USE PERSONAL DATA AND OUR LEGAL BASIS
A. Orders, purchases, shipping and customer service
We use the information needed to:
• receive and manage an order;
• contact the customer if information is missing or if an aspect of the order needs clarification;
• send confirmations and information on order status, availability, payment and shipping;
• prepare and send invoices, receipts or other documents relating to the order;
• arrange delivery;
• provide the courier with the information strictly necessary for delivery, including the telephone number where useful or required to deliver the parcel;
• manage customer assistance, returns, complaints, refunds and post-purchase requests.
Legal basis: performance of a contract or steps taken at the data subject’s request before entering into a contract, under Article 6(1)(b) GDPR, and compliance with legal obligations under Article 6(1)(c) GDPR.
We do not automatically use contact details supplied for an order to send unsolicited advertising or promotional communications.
B. Terrazza Moris, farm-stay, tasting and experience reservations
We use the information needed to:
• check availability;
• record and confirm the reservation;
• organise the table, stay or requested experience;
• contact the guest in the event of changes, problems, special requests or operational needs;
• handle subsequent requests relating to the service.
Legal basis: performance of a contract or steps taken at the data subject’s request before entering into a contract, under Article 6(1)(b) GDPR.
For farm-stay accommodation, certain personal data may also be processed and disclosed to public authorities where required by law.
For Terrazza Moris, we may retain contact details and essential reservation history internally in order to prevent duplicate records, correctly identify an existing reservation and ensure continuity in the management of the service. This use is not intended to create advertising profiles or to determine different prices or conditions. The legal basis is Morisfarms’ legitimate interest in properly organising the service and reliably managing customer relationships under Article 6(1)(f) GDPR, subject to the rights of the data subject.
C. Food allergies and intolerances
If a guest chooses to tell us about an allergy or intolerance, we use that information solely to manage the requested reservation or service appropriately.
Where this information constitutes health data, it is processed on the basis of the data subject’s explicit consent under Article 9(2)(a) GDPR.
Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
D. Information requests and contacts
If a user contacts us, we use the information provided to answer the request and to perform any steps directly connected with it.
Legal basis: steps taken at the data subject’s request before entering into a contract, performance of a contract or, depending on the circumstances, our legitimate interest in responding to requests received.
E. Administrative, tax, accounting and legal obligations
We process the information needed to comply with tax, accounting, administrative, public-security and other applicable legal requirements, and to establish, exercise or defend legal claims.
Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR and, where applicable, legitimate interest under Article 6(1)(f) GDPR.
F. Website and system security
We may process technical data and logs to prevent unauthorised access, abuse, fraud, malfunctions and security incidents and to protect the website, systems and data.
Legal basis: Morisfarms’ legitimate interest in the security of its systems and services under Article 6(1)(f) GDPR.
G. Promotional communications
We may send e-mails about Morisfarms wines, initiatives, events or other news only where the data subject has given specific consent, except in any case expressly permitted by applicable law.
Refusing marketing consent does not prevent a person from placing an order, making a reservation or using our other services.
Consent can be withdrawn at any time by writing to [email protected] or by using any unsubscribe function included in the communication.
Legal basis: consent under Article 6(1)(a) GDPR.
4. HOW WE COMMUNICATE WITH CUSTOMERS AND GUESTS
If a person places an order or makes a reservation, we may contact that person where necessary to provide the requested service.
For example, we may write or call to:
• confirm or clarify an order;
• provide information about payment or availability;
• provide shipping updates;
• send or request documents connected with the order;
• provide the courier with information needed for delivery;
• communicate changes relating to a reservation;
• respond to the data subject’s request.
These are service communications and are not marketing.
Morisfarms does not sell, rent or provide lists of customers or guests to third parties for those third parties’ own advertising purposes.
5. WHO MAY RECEIVE PERSONAL DATA
Personal data may be accessed or disclosed, only to the extent necessary, to:
• authorised Morisfarms staff and collaborators;
• providers of hosting, cloud, database, backup, IT security, maintenance and technical support services;
• providers of website, e-commerce, reservation and service-management platforms;
• banks, payment institutions and payment-service providers;
• couriers, freight forwarders and logistics operators;
• accountants, consultants, lawyers and other appointed professional advisers;
• e-mail or communication-service providers, limited to the purposes for which they are used;
• anti-spam, security and verification-service providers, where present;
• public authorities, law-enforcement bodies, tax authorities or other entities where disclosure is required by law or by a lawful order.
Where a service provider processes personal data on behalf of Morisfarms, it is used, where required, as a processor under Article 28 GDPR and on the basis of an appropriate contractual arrangement.
6. PAYMENTS
Where an online payment is handled by a payment-service provider, the information needed to complete the payment may be processed directly by that provider under its own terms and privacy information.
Morisfarms receives and keeps only the information needed to verify and document the outcome of the payment, unless otherwise required by the selected payment method or by law.
7. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
Some technology providers may process data in countries outside the European Economic Area.
Where required by the GDPR, such transfers are made on the basis of a mechanism recognised by applicable law, such as an adequacy decision of the European Commission, Standard Contractual Clauses or other safeguards provided by the GDPR.
8. HOW LONG WE KEEP PERSONAL DATA
We keep personal data only for as long as necessary for the purposes for which it was collected and for the applicable legal requirements.
In particular:
• accounting and tax data and documents connected with orders, invoices and payments are kept for the periods required by law, generally for up to 10 years, subject to longer periods where required by law or necessary for an ongoing dispute or inspection;
• information needed to manage orders, shipping, assistance, reservations and requests is kept for the time needed to complete the service and afterwards for the period reasonably necessary to manage complaints, disputes, service continuity or the defence of legal claims;
• reservation data and contact details may be kept in limited form for as long as they remain useful and relevant to managing the customer relationship, subject to periodic review and deletion or anonymisation when no longer necessary;
• information concerning allergies or intolerances is kept only for the time strictly necessary to manage the requested service and any related legal requirements or disputes;
• data used for marketing is processed until consent is withdrawn or until the purpose is no longer relevant, with periodic review.
When information is no longer necessary, it is deleted, anonymised or made unavailable for further use unless retention is required by law.
9. DATA SECURITY
Morisfarms applies reasonable technical and organisational measures appropriate to the risk in order to protect personal data against unauthorised access, loss, alteration, disclosure or unlawful use.
Depending on the systems used and the level of risk, these measures include:
• access limited to authorised personnel;
• authentication systems and passwords;
• access-permission management;
• backups and recovery procedures;
• system maintenance and updates;
• protections provided by hosting, cloud and IT-service providers;
• encryption or other protective measures where appropriate and supported by the systems used.
No computer system can be considered completely risk-free, but personal data is not used or shared beyond what is necessary for the stated purposes.
10. BROWSING DATA, COOKIES AND THIRD-PARTY SERVICES
The website uses cookies and similar technologies that are necessary for the operation of the site and, where applicable, additional tools only in accordance with the user’s choices and applicable law.
Technical cookies may be used without consent where they are necessary to provide the requested service. Analytics, advertising or other non-essential tracking tools are used only where permitted by law and, where required, after consent has been obtained.
Some pages may use external services for security, anti-spam, maps, embedded content or similar functions. For example, forms may be protected by services such as Google reCAPTCHA. These providers may process technical data under their own privacy policies.
Detailed information about the cookies used and how to change preferences should be consulted in the website Cookie Policy and cookie-management panel.
11. DATA SUBJECT RIGHTS
Where provided by the GDPR, the data subject may request:
• confirmation as to whether personal data concerning them is being processed;
• access to personal data;
• rectification of inaccurate data or completion of incomplete data;
• erasure of personal data;
• restriction of processing;
• data portability, where applicable;
• objection to processing based on legitimate interests;
• objection at any time to direct marketing;
• withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal.
Requests can be sent to:
If a data subject asks us to delete their data, Morisfarms will erase information that is no longer necessary and that is not required to be retained by law or on another valid legal basis.
For example, a deletion request does not allow us to delete an invoice or accounting record before the end of the legally required retention period. In such cases, the information is kept only for mandatory purposes and is not used for incompatible purposes such as marketing.
12. RIGHT TO LODGE A COMPLAINT
The data subject has the right to lodge a complaint with the competent supervisory authority.
For Italy:
Garante per la protezione dei dati personali
www.garanteprivacy.it
13. REQUIRED AND OPTIONAL DATA
Information marked as required in our forms is necessary in order to provide the requested service.
If such information is not provided, it may not be possible to complete an order, reservation or shipment or to respond properly to a request.
Optional information, including marketing preferences and, unless specifically needed for the requested service, information about allergies or intolerances, may be omitted.
14. AUTOMATED DECISION-MAKING AND PROFILING
Morisfarms does not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects on the data subject.
Any automated tools used for availability, reservations, duplicate prevention, security or service organisation are operational tools and are not used to create individual advertising profiles without the consent required by law.
15. CHANGES TO THIS PRIVACY POLICY
This Privacy Policy may be updated to reflect legal, technical or organisational changes.
The updated version will be published on this page and will state the date of the latest update.
For questions about this Privacy Policy or the processing of personal data: