Privacy Policy

This privacy policy describes the processing of personal data of users who consult the website iandp.it (hereinafter the "Website") and of those who purchase products, request information, or subscribe to the services offered by I&P, a brand of Azienda Agricola Ione Zobbi S.r.l. (hereinafter "I&P" or the "Data Controller"). This information is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter "GDPR" or "Regulation") and Legislative Decree no. 196 of June 30, 2003, as amended by Legislative Decree no. 101 of August 10, 2018 (Italian Personal Data Protection Code).

This privacy policy applies exclusively to the website iandp.it and not to any other websites that may be accessible via links contained therein, for which I&P accepts no liability.

The Data Controller is Azienda Agricola Ione Zobbi S.r.l., with registered office at Strada Comunale della Sala 12, 01011, Canino (VT), Italy, VAT number 01967700566, reachable at the email address info@iandp.it and at the number +393921058829.

The Data Controller has not deemed it necessary to appoint a Data Protection Officer (DPO), as it does not fall under the categories of entities for which such an appointment is mandatory pursuant to Art. 37 GDPR. For any requests regarding the processing of personal data, you may write to info@iandp.it

3.1 Website navigation

The computer systems and software procedures used to operate the Website acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (IP address, browser type, pages visited, time of access, and similar). These data are used for aggregate statistical purposes and to verify the correct functioning of the Website, and could be used to ascertain liability in the event of hypothetical computer crimes.

Legal basis: legitimate interest of the Data Controller in the security and correct functioning of the Website (Art. 6.1.f GDPR).

3.2 Buying products

To fulfill an order placed in the Boutique, the following data are collected: first name, last name, shipping and billing address, email address, telephone number, and the data necessary for payment. The latter are managed directly by the online payment service provider and do not pass through or get stored on I&P's systems.

Legal basis: performance of a contract to which the data subject is party (Art. 6.1.b GDPR) and compliance with legal obligations, such as tax obligations (Art. 6.1.c GDPR).

3.3 Creation and management of the customer account

If the user creates an account on the Website to manage their orders, registration data (first name, email, encrypted password) and the order history linked to the account are processed.

Legal basis: performance of a contract (Art. 6.1.b GDPR).

3.4 Newsletter and promotional communications via email

Anyone who subscribes to the newsletter through the forms on the Website provides their name, email address, and optionally, their mobile phone number. The data are processed via email marketing and WhatsApp Marketing platforms to send commercial communications, DEM (Direct Email Marketing), and for contact segmentation based on expressed interests.

Legal basis: consent of the data subject (Art. 6.1.a GDPR), which can be revoked at any time via the unsubscribe link present in every communication or by writing to newsletter@iandp.it

3.5 “Which oil is right for you” Quiz

The answers provided in the quiz are used to offer a personalized purchase recommendation and, if the user leaves their email address, for subscription to the related contact list on Brevo and the sending of correlated communications. This is not an entirely automated decision-making process that produces legal effects concerning the data subject: the quiz result is a non-binding suggestion.

Legal basis: consent of the data subject (Art. 6.1.a GDPR)

3.6 Comunication via WhatsApp

I&P uses WhatsApp Business to respond to requests for information, for example about Olive Grove Experiences or HoReCa price lists, and, subject to specific consent, to send broadcast communications of an informational or promotional nature.

Legal basis: pre-contractual measures at the request of the data subject for information requests (Art. 6.1.b GDPR); consent of the data subject for promotional broadcast communications (Art. 6.1.a GDPR).

3.7 Information requests and contacts (email, HoReCa form, Instagram Direct)

Anyone who contacts I&P via email, contact form, or direct message on social media channels—for example, to request the HoReCa catalog, book an Olive Grove Experience, or manage a pre-order for limited edition initiatives—provides the data necessary to respond to the request (name, contact details, content of the message).

Legal basis: pre-contractual measures at the request of the data subject (Art. 6.1.b GDPR).

3.8 Cookies and tracking technologies

The Website uses technical cookies, necessary for its operation, and third-party cookies for statistical and marketing purposes, including Meta Pixel and Google Ads / Google Analytics 4. The latter are activated only with the user's explicit consent via the specific banner. For details on cookie types, purposes, duration, and how to manage preferences, please refer to the dedicated Cookie Policy, available [link to Cookie Policy].

The provision of data is mandatory for purposes related to the conclusion and performance of a purchase contract (points 3.2 and 3.3): failure to provide such data will make it impossible to fulfill the order. For all other purposes, such as the newsletter, quiz, and promotional WhatsApp communications (points 3.4, 3.5, 3.6), the provision of data is optional and based on consent: failure to provide data or the withdrawal of consent will have no consequence on the possibility to purchase products or browse the Website.

• Data relating to orders, invoices, and commercial transactions: 10 years from the termination of the relationship, in order to comply with tax and civil law obligations (Art. 2220 of the Italian Civil Code and applicable tax regulations).
• Customer account data: for the entire duration of the account, until a deletion request is made by the user, with the exception of data relating to orders already placed, which follow the tax retention periods indicated above.
• Data for newsletter and marketing purposes: until consent is withdrawn, or automatically after a period of contact inactivity.
• Browsing data and server logs: no longer than 12 months, unless necessary to investigate cybercrimes against the Website.
• Messages and requests via email, WhatsApp, or social media: for the time necessary to handle the request, and subsequently archived for customer support purposes for a maximum period of 24 months.

Personal data may be disclosed, within the limits of their respective responsibilities and in their capacity as data processors pursuant to Art. 28 of the GDPR, subject to the signing of a Data Processing Agreement (DPA), to:

• the provider of the hosting and technical maintenance services for the Website;
• Brevo (Sendinblue SAS), for sending newsletters, DEM (Direct Email Marketing), and for the marketing automation platform;
• Meta Platforms Ireland Limited, for the tracking pixel and for managing pages and direct messages on Facebook and Instagram;
• Google Ireland Limited e/o Google LLC, for Google Ads e Google Analytics 4;
• the online payment service provider used during the checkout phase;
• the courier or shipping agents responsible for delivering the orders;
• accounting, tax, and legal consultants of the company, if necessary for regulatory compliance;
• public authorities, if required by law or by an order of the competent authorities.

Under no circumstances are data sold or transferred to third parties for commercial purposes unrelated to those specified in this privacy policy.

Some of the parties indicated in point 6, in particular Meta and Google, are based and transfer data also outside the European Economic Area, specifically to the United States. Such transfers take place on the basis of appropriate safeguards provided for by the GDPR, such as the Standard Contractual Clauses approved by the European Commission and/or adherence to the EU-U.S. Data Privacy Framework, where applicable to the individual provider. Further information is available in the privacy policies of the respective providers.

As a data subject, you have the right to:

• obtain confirmation as to whether or not your personal data is being processed, and access your personal data (Art. 15 GDPR);
• request the rectification of inaccurate data or the completion of incomplete data (Art. 16 GDPR);
• request the erasure of data, in the cases provided for by law (Art. 17 GDPR);
• request the restriction of processing (Art. 18 GDPR);
• receive the data you have provided to us in a structured, commonly used, and machine-readable format, and request its transmission to another data controller (Art. 20 GDPR);
• object at any time to the processing, in particular for direct marketing purposes (Art. 21 GDPR);
• revocare il consenso eventualmente prestato, senza che ciò pregiudichi la liceità del trattamento svolto prima della revoca (art. 7.3 GDPR).

The Data Controller does not carry out processing based solely on automated decision-making, including profiling, which produces legal effects concerning the data subject or similarly significantly affects him or her (Art. 22 GDPR).

Requests relating to the previous points can be sent to:

• email: info@iandp.it

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia 11, 00187 Rome, email garante@gpdp.it, PEC protocollo@pec.gpdp.it, website garanteprivacy.it (Art. 77 GDPR).

The Site and the products offered are not directed to minors under the age of 18, and the Data Controller does not knowingly collect data from minors. If a parent or guardian believes that a minor has provided personal data without their consent, they may contact the Data Controller to request its erasure.

This privacy policy may be updated in the event of changes to regulations or to the processing activities carried out. The updated version will always be available on this page, indicating the date of the last update.

Last Update 16/06/2026