Privacy Notice and Cookie Policy

Last updated: 23 October 2026

This notice describes how the personal data of users who visit and use www.birrasanmichele.it are processed, including the e-commerce services available on the website. It is provided pursuant to Regulation (EU) 2016/679 (“GDPR”), Italian Legislative Decree No. 196 of 30 June 2003, as subsequently amended and supplemented (“Privacy Code”), and the applicable rules on cookies and other tracking technologies.

1. DATA CONTROLLER

The Data Controller is: BIRRIFICIO SAN MICHELE S.R.L., Via III Rgt. Alpini 10/A, 10057 Sant’Ambrogio di Torino (TO), VAT no. 10226170016. Email: info@birrasm.it. For any request concerning personal data protection and the exercise of rights under the GDPR, you may contact the Data Controller at the address above.

2. SCOPE

This notice applies to processing carried out through www.birrasanmichele.it. The website may contain links to third-party websites, platforms and services. The processing of data through those websites is governed by the notices issued by their respective data controllers, rather than by this notice.

3. DATA PROCESSED

Browsing data

During their normal operation, the computer systems and software procedures used to operate the website acquire certain data whose transmission is implicit in the use of Internet communication protocols. These include, for example, IP addresses, domain names of users’ devices, URI/URL addresses of requested resources, the date and time of the request, the method used to submit the request to the server, the numerical code indicating the response status, and other parameters concerning the user’s operating system and computing environment. These data may be used to ensure the correct operation and security of the website, obtain aggregate statistical information and establish responsibility in the event of unlawful conduct or cyberattacks.

Data voluntarily provided by the user

Sending messages to the contact addresses listed on the website and using any forms entails the collection of the data communicated by the user, such as first name, surname, email address, telephone number and the content of the enquiry.

Purchase and e-commerce data

When a user makes a purchase or uses e-commerce features, the data processed may include first name and surname, billing and delivery addresses, email address, telephone number, products purchased, amounts, and information concerning the order, delivery, billing and payment status. If the user creates an account, the data required to manage the personal area and order history are also processed. Payment instrument data may be processed directly by the payment service provider used for the transaction, in accordance with that provider’s procedures and privacy notices. The Brewery processes the information required to determine the outcome and status of the transaction to the extent necessary to manage the order.

4. PURPOSES AND LEGAL BASES

Personal data may be processed to enable browsing and the correct operation of the website, ensure system security and prevent fraudulent or unlawful use. Processing is based on providing the requested service and, where applicable, the Data Controller’s legitimate interest in the security of its systems. Data provided through information requests or enquiries are processed to respond to the data subject and handle the request. The legal basis is taking pre-contractual steps at the data subject’s request or, depending on the nature of the enquiry, the Data Controller’s legitimate interest in handling communications received.

Order data are processed to enable the conclusion and performance of the sales contract and to manage payment, preparation, delivery, support and any returns. The legal basis is performance of the contract or pre-contractual steps requested by the data subject. Order, billing and administrative data are also processed to comply with accounting, tax and administrative obligations laid down by law. The legal basis is compliance with a legal obligation.

Any promotional communications or marketing activities based on the user’s consent are carried out only where specific consent has been obtained, which may be freely withdrawn at any time. Cookies and tracking technologies that are not necessary for the website to operate are used only with the user’s prior consent where required by law.

5. PROVISION OF DATA

Providing the data needed to manage an order, comply with legal obligations or respond to an enquiry is necessary to deliver the relevant service. Failure to provide essential data may make it impossible to complete the purchase or fulfil the user’s request. Providing data for optional purposes, such as marketing or non-technical tracking, is voluntary; withholding consent does not prevent normal browsing or the use of the website’s essential features.

6. PROCESSING METHODS AND SECURITY

Personal data are processed using computer systems and, where necessary, manually, with appropriate technical and organisational measures to ensure security, confidentiality, integrity and availability. The Data Controller adopts measures intended to prevent loss, unauthorised access, disclosure, alteration or unlawful use of personal data.

7. RECIPIENTS AND DATA PROCESSORS

Data may be processed by the Brewery’s staff and collaborators who are authorised according to their respective duties. They may also be disclosed, to the extent necessary to provide the services, to parties providing hosting and IT infrastructure, website maintenance and technical support, e-commerce management, electronic payment, transport and delivery, administrative, accounting and tax assistance, and other services strictly necessary for the business. The website is hosted using services provided by Aruba S.p.A. or companies in its group, according to the service activated under the contract; these companies may act as data processors under Article 28 GDPR. Data are not indiscriminately disclosed to the public.

8. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

Some IT service providers or third-party services that may be used by the website could involve processing data in countries outside the European Economic Area. In such cases, processing takes place in accordance with Articles 44 et seq. GDPR, on the basis of an adequacy decision of the European Commission or other safeguards provided for by law, including standard contractual clauses where applicable.

9. RETENTION PERIOD

Data are retained only for the period necessary to achieve the purposes for which they were collected. Order data and administrative and tax records are retained for the period required by applicable civil, tax and accounting obligations. Data associated with the customer account are retained while the account remains active, except for data that must be retained longer to comply with a legal obligation or protect the Data Controller’s rights. Enquiry data are retained for the time needed to handle the request and any resulting relationship. Data processed on the basis of consent are retained until consent is withdrawn or for the different period specified for the particular purpose, subject to any legal obligation. Technical and security logs are retained for the time technically necessary for system security and correct operation, and in accordance with the policies of the relevant infrastructure providers.

10. DATA SUBJECT RIGHTS

In the circumstances provided for by the GDPR, data subjects may ask the Data Controller for access to their personal data, rectification of inaccurate data, erasure, restriction of processing and, where applicable, data portability. Data subjects also have the right to object to processing in the circumstances provided for by law. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Requests may be sent to info@birrasm.it. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority.

Cookie Policy

The website uses Iubenda Privacy Controls and Cookie Solution to collect and manage preferences concerning cookies and other tracking technologies.

Manage cookie preferences

11. What cookies are

Cookies are small text files stored on a device during browsing. Online identifiers, pixels and browser local storage may perform similar functions. In this notice, the term “cookies” includes these technologies where relevant.

12. Necessary cookies

These make the requested functions available: browsing, security, session management, authentication, shopping basket, checkout and storage of consent preferences. They do not require consent and remain active even when “Rifiuta” (“Reject”) is selected. The technical WooCommerce services required for the basket and checkout are not subject to consent for statistics or marketing.

13. Measurement and statistics

In the current configuration, Google Analytics, Matomo and WooCommerce order-source attribution tools are subject to consent for the “Misurazione” (“Measurement”) category. They help understand how the website is used and where visits and purchases originate. They are not necessary to make a purchase. Their activation requires an affirmative choice by the user.

14. Functionality and experience

The Iubenda panel distinguishes the optional “Funzionalità” (“Functionality”) and “Esperienza” (“Experience”) categories. Additional services or embedded content, such as maps, videos and third-party components, may require consent where they use non-essential trackers. Withholding consent may prevent them from being displayed, without preventing the shop’s essential functions. A simple link to an external website is not equivalent to activating its embedded content.

15. Marketing

Google and Meta advertising tools are subject to consent for the Marketing category. They may be used to measure campaigns and provide personalised advertising. The Google Tag Manager container on the website is also subject to this category. Refusal does not prevent access to the catalogue, basket or checkout.

16. Making choices with Iubenda

The Italian banner offers “Accetta” (“Accept”), “Rifiuta” (“Reject”) and “Scopri di più e personalizza” (“Learn more and customise”). Optional trackers remain blocked before consent. Continuing to browse or scrolling the page does not constitute consent.

The panel allows choices by category: “Necessari” (“Necessary”), “Funzionalità” (“Functionality”), “Esperienza” (“Experience”), “Misurazione” (“Measurement”) and “Marketing”. The Necessary category cannot be disabled in the panel. After changing your choices or using “Rifiuta tutto” (“Reject all”) or “Accetta tutto” (“Accept all”), press “Salva e continua” (“Save and continue”). Preferences are stored using Iubenda’s technical tools in the browser being used.

17. Services concerned and provider information

• WooCommerce: technical management of sessions, the basket and checkout; separately, order-source attribution subject to Measurement consent.
• Iubenda: banner, preference panel and storage of consent choices.
• Google Analytics: browsing statistics, Measurement category.
• Matomo: browsing and e-commerce statistics through the service on the domain analisimtm-mediaservice1.it, Measurement category.
• Google Tag Manager and Google advertising tools; Meta: advertising tag management and marketing activities, Marketing category.

Cookies may be session cookies, deleted when the browser is closed, or persistent cookies, retained until expiry or deletion. Their names and duration depend on the service, its settings and the functions used. The Iubenda panel allows choices by purpose; it is not a detailed inventory of every cookie in the browser.

Provider information: Iubenda privacy notice, Google privacy policy, Meta privacy policy. For information about processing through the shop and the related retention periods, contact the Data Controller at info@birrasm.it.

18. Changes, withdrawal and deletion

You may change or withdraw consent at any time using “Gestisci preferenze cookie” (“Manage cookie preferences”) or the Iubenda button “Le tue preferenze relative al consenso per le tecnologie di tracciamento” (“Your consent preferences for tracking technologies”), available at the bottom right of the website’s pages. Save your new preferences and reload the page to apply them to content already loaded.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Cookies already stored can be deleted through browser settings; deleting technical cookies may result in loss of the basket, session or saved preferences. Choices apply to the browser and device being used: they must be made again on another browser or device.

19. Updates

This notice may be updated if services, processing activities or legislation change. The date of the latest revision appears at the beginning of the page. Cookie choices may be reviewed at any time through the Iubenda panel.