Skip to content

Privacy Policy

Last updated: March 16, 2026

This privacy notice describes how personal data of users of the IROLDO platform for collective purchases of organic extra virgin olive oil is processed. This notice is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. Data Controller

The Data Controller is:

Azienda Agricola Milluzzo Grazia
Via Giovanni XXIII n. 2, 95048 Scordia (CT), Italy
VAT: IT03689670879
Email: [email protected]

Pursuant to Article 37 of the GDPR, Azienda Agricola Milluzzo Grazia is not required to appoint a Data Protection Officer (DPO) as it is a small enterprise that does not carry out large-scale processing of special categories of data. For any questions regarding data protection, contact the Data Controller at [email protected].

2. Categories of Data Processed

The IROLDO platform collects and processes the following categories of personal data:

  • Identification data: first name, last name, email address
  • Contact data: phone number (optional, for order-related communications)
  • Order data: quantities ordered, order history, buying group membership
  • Group membership data: buying group name, role (member or coordinator)

3. Purposes and Legal Bases for Processing

Purpose Legal basis GDPR reference
Managing collective olive oil purchases and order cycles Performance of the contract Art. 6(1)(b)
Sending order notifications (cycle opening, order confirmation, delivery) Legitimate interest of the Controller Art. 6(1)(f)
User account management and magic link authentication Performance of the contract Art. 6(1)(b)
Tax and accounting obligations (invoicing) Legal obligation Art. 6(1)(c)

4. Data Retention Periods

Data type Retention period
Account data As long as the account is active
Order and billing data 10 years from termination of the relationship (fiscal and accounting obligations)
Contact data As long as the account is active, deleted within 30 days of account deletion

Once the retention periods have expired, data is deleted or irreversibly anonymised.

5. Data Recipients

Personal data is not shared with third parties, except for:

  • Mailgun (Sinch Email) — transactional email delivery service (order notifications, magic link authentication). Mailgun operates on EU servers.

Personal data will not be disseminated nor communicated to third parties for their own purposes.

6. International Data Transfers

The email delivery service (Mailgun) uses servers within the European Union. No transfers of personal data to countries outside the European Economic Area (EEA) are planned.

7. Rights of the Data Subject

As a data subject, pursuant to Articles 15-22 of the GDPR, you have the right to:

  • Access (Art. 15) — obtain confirmation as to whether your personal data is being processed
  • Rectification (Art. 16) — obtain the rectification of inaccurate personal data
  • Erasure (Art. 17) — obtain the erasure of personal data
  • Restriction (Art. 18) — obtain the restriction of processing
  • Portability (Art. 20) — receive personal data in a structured, machine-readable format
  • Objection (Art. 21) — object to processing based on legitimate interest

To exercise your rights, send a request to [email protected]. The Data Controller will respond within one month.

8. Cookies

For information about cookies used by the platform, please see the Cookie Policy.

9. Right to Lodge a Complaint

The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali):

10. Changes to This Notice

The Data Controller reserves the right to amend this notice at any time by publishing the updated version on the platform.