PRIVACYYOUR DATA.
Updated on 24 October 2026
Who processes your data
The controller is MY RISTO APP S.R.L.S., a single-member company, at Via F.lli Maristi 27, 00137 Roma (RM), Italy, VAT and tax number 16770631006. For personal data enquiries: info@laboccadellaverita.it; certified email: myristoappsrls@legalmail.it.
Data collected and requests
We collect the information you enter in our forms: name, business, contact details, location, country, any delivery address, products of interest and message. Required fields are marked; without these details we cannot handle your request. Please do not include health information or other sensitive data.
How we handle your request
Requests reach our office by email and are recorded in Google Drive by authorised staff. We use this information to contact you, arrange a tasting, collect your feedback and follow up on any supply arrangement. The form does not subscribe you to newsletters, and contact details are not used for regular promotional campaigns.
Purposes and legal bases
Requests and pre-contractual activities are processed under GDPR Article 6(1)(b), where applicable. For contacts acting on behalf of a company, processing relies on the legitimate interest in handling business correspondence, Article 6(1)(f). Legal obligations rely on Article 6(1)(c). Submitting the form does not automatically subscribe you to newsletters or promotional campaigns.
Security and operation
The server may process IP addresses and technical data to deliver the site and prevent abuse. The form uses a security token and submission limits. Abuse prevention records pseudonymised technical identifiers and request times, without storing message content in that register. The legal basis is the legitimate interest in service security.
Recipients and service providers
Requests are handled by our office and are not automatically forwarded to agents or distributors. Hostinger provides website hosting and email; Google Drive is used to record and organise contacts. When arranging a shipment, we give the appointed carrier, such as BRT/Bartolini or Fa Freddo, only the information needed for delivery and transport documents: recipient, address, contact details and relevant instructions. Data are not made public or transferred for advertising purposes.
Cloud services and transfers
Cloud providers may also process data outside the European Economic Area. Google describes its use of adequacy decisions, including the EU–US Data Privacy Framework for certified entities, and standard contractual clauses where needed. Hostinger’s agreement provides for standard contractual clauses for relevant transfers to countries without an adequacy decision. You can consult the provider references below and contact us for information about the safeguards applicable to your data.
Retention periods
Requests that do not lead to a customer relationship are retained for up to 24 months after the last substantive contact about the request, to manage the tasting and any subsequent supply arrangement. At expiry, the data are deleted or anonymised. If you become a customer, information needed for that relationship and administrative, accounting and transport documents are retained for their contractual purposes and applicable legal requirements. In a dispute, we retain only what is necessary to protect legal rights for the relevant period.
Technical logs
The form’s anti-spam log contains pseudonymised technical identifiers and is automatically cleared within 48 hours; it does not contain the text of requests. Hosting logs are processed under the provider’s terms for operation, troubleshooting and security. Any extracts needed to investigate abuse are kept for the time required for that investigation or the protection of legal rights, with restricted access.
Statistics and advertising, only with your consent
With your consent to Statistics, we activate Google Analytics 4, provided by Google Ireland Limited, to understand which pages are visited and how forms, links and brochures are used. With Marketing consent, we activate Meta Pixel, provided by Meta Platforms Ireland Limited, to measure Facebook and Instagram campaigns and enable personalised advertising. These services receive technical data, IP addresses, browser identifiers and information about pages and actions. Meta may associate this information with your account on its services. The legal basis is consent under Article 6(1)(a) GDPR. Refusing does not prevent you from using the website or requesting a sample.
Form data and tracking choices
Our measurement events do not include the name, email address, phone number, delivery address or message entered in forms. We do not use User-ID, Google Signals or manual Meta advanced matching. Forms do not subscribe you to newsletters. You can withdraw or separately change statistics and marketing consent through Cookie preferences on every page; withdrawal does not affect previous lawful processing. We do not make solely automated decisions with legal or similarly significant effects.
Measurement data retention
Analytics cookies last up to 180 days from creation; Meta Pixel cookies _fbp and, when present, _fbc normally last 90 days. Detailed user and event data in this standard GA4 property are retained for no more than 14 months; aggregated statistical reports follow separate rules. Meta’s processing periods depend on the purposes described in its privacy policy, linked below. A cookie’s lifetime does not necessarily equal the retention of data already received by a provider.
Google and Meta: roles and transfers
For Analytics, Google processes data on our behalf under the relevant terms. For the collection and transmission of event data through Meta Pixel, we and Meta Ireland act as joint controllers within the scope of Meta’s agreement; Meta is responsible for subsequent processing for its own purposes. Data may also be processed outside the European Economic Area with applicable safeguards, such as adequacy decisions for covered recipients or standard contractual clauses. The links below explain roles, safeguards, purposes and ways to exercise your rights; you can also contact us using the details provided.
WhatsApp, brochure and customer area
WhatsApp opens only when you select its link; the service’s own terms and privacy notice then also apply. The brochure is a downloadable file. The customer area is being prepared: this website does not collect login credentials or activate push notifications. Access, orders, documents and notifications in the future web app will be covered by a dedicated notice within that service.
Your rights
Where provided by the GDPR, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent without affecting the lawfulness of previous processing and lodge a complaint with the Italian Data Protection Authority or another competent authority.
Providers: Hostinger: data processing · Google: data transfers
Provider privacy information: Google Privacy · Google Cookies · Meta Privacy · Meta Cookies · Meta Controller Addendum