Privacy policy

Data controller

The controller is identified in the details box at the top of this page. Privacy requests can be sent to the listed contacts.

Data processed

• •Account and authentication data: name, email, encrypted password, profile picture and Google profile data when Google sign-in is selected.
• •Purchase data: products, amounts, vouchers, payment and shipping status, gift recipient and message where applicable.
• •Billing and contact information entered by the user or collected during Stripe checkout.
• •Data concerning withdrawal requests, returns, refunds and product reviews.
• •Bottle, redemption-code and impact data linked to the profile.
• •Newsletter data: consent, privacy version, sign-up source, unsubscribe status and sending logs.
• •Technical data required for security, operation, abuse prevention and error diagnosis.
• •After marketing consent: pseudonymous first-party data about visit source, campaign, funnel pages, QR used and order attribution.
• •If marketing is enabled: Meta technical identifiers, pages and products viewed, cart additions, checkout starts and confirmed purchase data. Identifying data used for server-side measurement is normalised and hashed before transmission.

Purposes and legal bases

• •Accounts, orders, payments, shipping, refunds and support: performance of a contract or pre-contractual steps.
• •Billing, accounting and tax obligations: legal obligation.
• •Security, fraud prevention and protection of rights: legitimate interests.
• •The Resta newsletter, currently in beta, covers products, field work and project impact: consent, withdrawable at any time through the unsubscribe link. Format and frequency may change during testing.
• •Optional maps and external content: consent, which can be withdrawn at any time.
• •Pseudonymous first-party measurement of funnel operation and order sources: marketing consent, withdrawable at any time in cookie preferences.
• •Campaign and shop-action measurement through Meta Pixel and the Conversions API: consent, withdrawable at any time in cookie preferences.

Providers and recipients

• •Stripe for payments, shipping addresses and refunds.
• •Google only when Google sign-in is selected.
• •Resend for operational email and newsletter; Cloudflare R2 for media storage.
• •Hosting, database, security and technical-support providers.
• •Esri and OpenStreetMap only after external content is enabled.
• •Meta Platforms Ireland Limited only after marketing consent, for campaign and conversion measurement.
• •Authorities, advisers and authorised parties where required by law or necessary to protect a right.

Transfers and retention

Some providers may process data outside the EEA using GDPR safeguards. Data is kept for as long as necessary for the stated purposes and for any additional period required by tax, accounting and civil law.

Your rights

Where applicable, you may request access, correction, erasure, restriction and portability, object to processing, withdraw consent and lodge a complaint with the Italian Data Protection Authority or your local supervisory authority.

Children and automated decisions

The purchasing service is not intended for people under 18. Resta does not make solely automated decisions producing legal effects on users.