Privacy Policy
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018
Last updated: 9 April 2026
This notice describes how we process the personal data of users who visit the website aitrescalini.org and of anyone who interacts with the "Ai Tre Scalini" wine bar, run by Enotema C&C S.r.l.
This English version is provided for convenience only. In case of any discrepancy, the Italian version shall prevail.
1. Data Controller
The Data Controller is:
- Company name: ENOTEMA C&C Società a Responsabilità Limitata
- Registered office: Via Panisperna, 249/251 – 00184 Rome (RM), Italy
- VAT number / Tax code: 07813261000
- EU VAT number: IT07813261000
- REA (Business Register): RM – 1056088
- Certified email (PEC): enotemacec@arubapec.it
- Email: aitrescalini@colosseo.org
- Phone: +39 06 4890 7495
- Internal contact person: Barbara Chioccia
2. Types of data processed
The Controller processes the following categories of personal data:
2.1 Browsing data
The computer systems and software procedures used to run this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not associated with identified users but, by its very nature, could allow users to be identified.
This category includes:
- IP addresses or domain names of the computers used by visitors;
- URI/URL addresses of the requested resources;
- time of the request and method used to submit it to the server;
- size of the file obtained in response;
- numerical code indicating the status of the server's response;
- other parameters relating to the user's operating system and IT environment.
2.2 Data provided voluntarily by the user
The optional, explicit and voluntary sending of messages to the Controller's contact addresses, as well as filling in and submitting any forms on the website, involves the acquisition of the sender's contact details, needed to reply, and of any personal data included in the communications.
2.3 Cookies and tracking technologies
The website uses technical cookies and, subject to consent, analytics and profiling cookies. For more information, please see our Cookie Policy.
3. Purposes and legal basis of processing
| Purpose | Legal basis |
|---|---|
| Enabling proper browsing and use of the website | Legitimate interest (Art. 6(1)(f) GDPR) |
| Replying to requests for information sent by email or phone | Pre-contractual measures (Art. 6(1)(b) GDPR) |
| Compliance with tax, accounting and legal obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Aggregate statistics and service improvement | Consent of the data subject (Art. 6(1)(a) GDPR) |
| Legal defence and protection of the Controller's rights | Legitimate interest (Art. 6(1)(f) GDPR) |
4. Processing methods
Personal data is processed using automated and non-automated tools for no longer than is strictly necessary to achieve the purposes for which it was collected. Specific security measures are in place to prevent data loss, unlawful or incorrect use and unauthorised access.
5. Retention period
Personal data will be kept for no longer than is strictly necessary to achieve the purposes for which it was collected, in compliance with legal requirements:
- Browsing data: up to 6 months, except where needed to investigate computer crimes;
- Data relating to email requests: 24 months from the last contact;
- Tax and accounting data: 10 years, as required by applicable law.
6. Recipients of the data
Personal data may be disclosed to:
- parties entitled to access the data under laws, secondary regulations or EU legislation;
- parties who need access to the data for purposes ancillary to the relationship (banks, professionals, consultants, accountants);
- IT, hosting and website maintenance providers, duly appointed as Data Processors under Art. 28 GDPR;
- competent authorities, upon request.
Data will not be disseminated or transferred to third parties for marketing purposes.
7. Transfer of data outside the EU
Some services used by the website (e.g. Google Maps, Google Fonts, any analytics tools) may involve the transfer of data to non-EU countries, including the United States. Such transfers take place on the basis of appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission and/or certification under the EU-US Data Privacy Framework.
8. Rights of the data subject
Under Articles 15 to 22 GDPR, data subjects have the right to:
- Access (Art. 15): obtain confirmation as to whether personal data concerning them is being processed;
- Rectification (Art. 16): have inaccurate or incomplete data corrected;
- Erasure (Art. 17): have their data erased ("right to be forgotten");
- Restriction (Art. 18): obtain restriction of processing;
- Portability (Art. 20): receive their data in a structured, machine-readable format;
- Objection (Art. 21): object to processing on legitimate grounds;
- Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- Complaint to the Italian Data Protection Authority – Garante per la Protezione dei Dati Personali (www.garanteprivacy.it).
To exercise your rights, please write to aitrescalini@colosseo.org or by certified email (PEC) to enotemacec@arubapec.it.
9. Provision of data
Providing your data is optional, but refusing to provide the requested data may make it impossible to fulfil your request.
10. Changes to this notice
The Controller reserves the right to modify, update or supplement this notice, including as a result of changes in legislation. Any changes will be published on this page and the "last updated" date will be revised accordingly.