Privacy Policy

The controller responsible for data processing on this website is:
Wolfhof – Südtiroler Hofkäserei, Armin Fink, Engadein 9, 39054 Oberinn am Ritten, South Tyrol, Italy
Phone: +39 345 90 16 553 · Email: info@wolfhof.com · PEC: armin.fink@pec.sbb.it
VAT no.: 03333010217

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA ("Vercel"). Each time the website is accessed, Vercel automatically collects technical information (including IP address, date and time of access, page requested, browser used) in so-called server log files. This processing serves the technical provision and security of the website (Art. 6(1)(f) GDPR).

Pages are delivered via Vercel's global network. The server functions of this website, which send the inquiry forms and look up places in the stockist search, currently run in a Vercel data centre in Washington, D.C. (USA); the data processed there is therefore transferred to the United States. According to Vercel, it is certified under the EU-U.S. Data Privacy Framework. Vercel acts as our hosting provider [data processing agreement with Vercel (Art. 28 GDPR) still missing: Vercel only offers it on the Pro and Enterprise plans]. Logs of the server functions can be viewed in our Vercel account for one hour to one day, depending on the plan; beyond that, according to Vercel, data is only kept as long as necessary. Further information: vercel.com/legal/privacy-policy.

The text, images, videos and code of this website are delivered from this server. Connections to third-party servers only occur in the cases described below.

The fonts used on this website are bundled locally when the page is built (self-hosted) and are not loaded from external servers when you visit. No data is transmitted to third-party providers in the process.

Without your consent, this website does not set any cookies. Cookies are only set by Google Analytics (after consent to "Statistics") and the Meta Pixel (after consent to "Marketing") (see the respective sections). On your first visit, a banner appears in which you decide on services that require consent: "Essential" (always active) and "External content" (Google Maps on the contact page, see section "Google Maps"), "Statistics" (Google Analytics, see section "Google Analytics 4") as well as "Marketing" (Meta Pixel, see section "Meta Pixel"). Services that require consent are only activated after you have given your consent (Art. 6(1)(a) GDPR). Choosing "Essential only" or closing the banner with the "×" rejects all services that require consent; the website remains fully usable.

We store your choice in your browser's local storage (localStorage) so that the banner does not reappear on every visit. It remains there until you change it or clear your browser data, and it is not sent to us (Art. 6(1)(f) GDPR). You can change or withdraw your choice at any time, with effect for the future, via the "Cookie settings" link in the footer. If further services requiring consent are added later, we will ask you again.

In addition, the website uses your browser's session storage (sessionStorage) to remember whether the RittenCard notice has already been shown or closed in the current session. This contains no personal data, is not sent to us and is deleted when you close the browser tab.

The stockist map is independent of these settings and is only loaded after a separate click (see section "Stockist search and map").

On our contact page, we offer a Google Maps view to help you find your way here. The map is not loaded automatically: only once you consent to the "External content" category in the banner, or click "Load map" directly on the contact page, is a connection established to servers operated by Google Ireland Limited; Google may collect and process data in the process, including in the United States. Further information is available in Google's privacy policy: policies.google.com/privacy. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings.

Route planning: the directions button on the home page and "Get directions" for the stockists are simple links to Google Maps. Only with this click do you leave our website; Google's privacy terms then apply.

The "Book now" page includes the booking widget from Roter Hahn / Yanovis. The technical provider of the widget is YANOVIS GmbH, Gianni-Brida-Straße 4, 39100 Bolzano, Italy [confirm the role of Yanovis or Roter Hahn (Südtiroler Bauernbund), independent controller or processor, based on the contract]. When you open this page, your browser loads the widget directly from the provider's servers (cdn.yanovis.com, booking-api.yanovis.com) as well as a code library via the jsDelivr content delivery network (cdn.jsdelivr.net). For technical reasons, your IP address and browser information are transmitted to these servers; the widget cannot be displayed without this connection. When loading, the widget sets no cookies and stores no data in your browser. The widget is not loaded on any other page.

If you book via the widget, the data you enter (e.g. name, contact details, travel dates, number of guests and, where applicable, payment details) is processed by the widget provider and used to handle your booking. The legal basis is the performance of pre-contractual measures or of the accommodation contract (Art. 6(1)(b) GDPR); for loading the widget, our legitimate interest in offering direct online booking (Art. 6(1)(f) GDPR). Further information: [add link to the widget provider's privacy notice].

Search by postcode or town: on our cheese stockists page you can search for stockists near you. What you enter is first matched directly in your browser against a directory of places that we provide ourselves; no data is passed to third parties at this stage. Only if a place is not in that directory and you submit the search does our server query the Nominatim service of the OpenStreetMap Foundation (St John’s Innovation Centre, Cambridge, United Kingdom). Our server transmits only the search term, not your IP address. To limit misuse, our server counts requests per IP address and minute in working memory; search terms and results are cached in working memory for at most seven days to avoid overloading the service. Nothing is stored in a database or linked to an individual. Because the search is sent as a request to our server, the search term may also appear in the server log files (see section "Hosting & server log files"). The legal basis is our legitimate interest in a working place search (Art. 6(1)(f) GDPR).

Voluntary location sharing: if you click "Use my location", your browser asks for your permission. If you grant it, your location is used solely in your browser to calculate the distance to the stockists. The coordinates are not sent to our server or to Nominatim and are not stored. If the map is loaded, it then shows the area around your location; to do so, the map tiles for that area are loaded from OpenStreetMap (see next paragraph). You can withdraw the permission in your browser at any time; searching by postcode or town also works without sharing your location. The legal basis is your consent (Art. 6(1)(a) GDPR).

Map (OpenStreetMap): the stockist map is not loaded automatically. Only when you click "Load map" does your browser load map tiles from servers of the OpenStreetMap Foundation in the United Kingdom. For technical reasons, your IP address and the map area shown are transmitted to these servers. Before you click, there is no connection to OpenStreetMap; the map software itself is loaded from our own server. Your choice applies only to the current page view, is not stored and is independent of the banner settings. Further information: osmfoundation.org/wiki/Privacy_Policy. The legal basis is your consent given by clicking "Load map" (Art. 6(1)(a) GDPR).

Route planning: "Get directions" opens Google Maps with the location of the stockist as the destination (see section "Google Maps").

If you contact us by email or phone, we process the information you provide (e.g. name, contact details, message) exclusively to handle your inquiry and any related follow-up questions (Art. 6(1)(b) GDPR where your inquiry relates to a contract, otherwise Art. 6(1)(f) GDPR). We do not pass your data on to third parties, except where necessary to fulfil a contract or required by law.

WhatsApp: the WhatsApp buttons on this website are simple links. Only when you click does WhatsApp open; the privacy terms of the provider WhatsApp Ireland Limited apply to your use of WhatsApp. Messages you send us via WhatsApp are processed to handle your inquiry.

Inquiry forms: if you contact us through a form on this website, we process the information you enter: name, email address, phone number (if provided) and the content of your inquiry (e.g. message, preferred date, cheese varieties, business and location). In addition, we process the technical data needed for sending: time, page and language of the inquiry. Your information is sent to our server (see section "Hosting & server log files") and from there as an email to our address info@wolfhof.com; your email address is set as the reply-to address. The information is not stored on the website itself. To fight spam, our server counts requests per IP address in working memory.

Sending via Brevo: these emails are sent technically by the email service of Brevo SAS, 9-17 rue Salneuve, 75017 Paris, France (Paris Trade and Companies Register no. 498 019 298), as our processor, under the data processing agreement that forms an appendix to Brevo's terms of use (Art. 28 GDPR). Brevo receives the content of the email, including your information, and creates sending and delivery logs; your IP address is not transmitted to Brevo. According to Brevo, it stores data in data centres in the EU (Google Cloud in France and Belgium). For some of Brevo's sub-processors, such as Cloudflare (USA) for network and attack protection, a transfer to the United States is possible; Brevo bases it on the EU-U.S. Data Privacy Framework and standard contractual clauses. Under Brevo's terms, we are responsible for deleting the data stored at Brevo. Without a rule of our own, according to Brevo it keeps sending logs and email previews without a time limit; the data is deleted at the latest when the contract ends [set a retention rule for sending logs in Brevo and enter it here].

Receiving via Aruba: the mailbox info@wolfhof.com is provided by our email provider Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy. Inquiries arrive there and are handled by us. Aruba is our processor: under Aruba's terms for hosting and domain services, the customer appoints Aruba as processor (Art. 28 GDPR).

We process the data exclusively to handle and answer your inquiry. The legal basis is Art. 6(1)(b) GDPR where your inquiry relates to a contract, for example a stay inquiry or a cheese pre-order; for other inquiries, our legitimate interest in answering them (Art. 6(1)(f) GDPR). [define the retention period for inquiry emails]

We link to our Facebook and Instagram profiles using simple links only (icons in the header and footer). No social network plugins are embedded; data is only transmitted if you follow a link, in which case Meta's privacy terms apply.

Only if you consent to the "Marketing" category in the banner do we load the Meta Pixel from Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland ("Meta"). Before that, no Meta code is loaded and no connection to Meta is made. The purpose is to measure the effectiveness of our ads on Facebook and Instagram and to show ads to people who have visited our website.

After you consent, your browser loads the pixel script from connect.facebook.net and sends a "PageView" event to Meta for each page you view. For technical reasons, your IP address, browser and device information, the page viewed and the referring page are transmitted. We also send "BookingClick" when you click a link to the booking page (with the apartment and link position) and "Lead" when an inquiry form has been sent successfully (only the type of form). We do not send form contents, booking data or automatically collected click or page data. The pixel stores a cookie "_fbp" with a random identifier and a lifetime of 90 days on our domain. If you arrive via an ad with a click identifier (fbclid), it also stores the cookie "_fbc"; Meta recommends a lifetime of 90 days for it.

We and Meta are joint controllers (Art. 26 GDPR) for collecting this data on our website and transmitting it to Meta, based on Meta's Controller Addendum (facebook.com/legal/controller_addendum). Meta alone is responsible for any subsequent processing, which may include transfers to the United States; according to Meta, Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. Meta itself determines how long it retains the data. You can exercise your rights against us and against Meta. Further information: facebook.com/privacy/policy.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings in the footer. The pixel then immediately stops sending data, and we delete the Meta cookies on our domain.

Only if you consent to the "Statistics" category in the banner do we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Before that, no Google code is loaded and no connection to Google Analytics is made. The purpose is to understand how our website is used (e.g. which pages are viewed) in order to improve it. Statistics and marketing can be chosen independently.

After you consent, your browser loads the Google tag from googletagmanager.com and sends a "page_view" event to Google for each page you view, with the page viewed and the referring page, date and time, and browser and device information. We also send "booking_click" when you click a link to the booking page (with the apartment, link position and language) and "generate_lead" when an inquiry form has been sent successfully (only the type of form and language, no contents). According to Google, IP addresses of users in the EU are discarded before storage. Based on the settings of our Analytics property, Google Analytics also automatically records: scrolling to the end of a page, clicks on links to other websites, page views with search parameters in the address (e.g. "?q=") and starting and submitting forms; for forms, only the form's identifier and destination, no entries. Google Signals and ad personalisation are disabled; we do not use the data for advertising.

Google Analytics stores the cookies "_ga" (to distinguish users) and "_ga_<identifier>" (to persist session state) on our domain, each with a lifetime of 2 years according to Google (current browsers limit cookies to a maximum of 400 days). Retention period of analytics data at Google: [enter the retention period set in the GA4 property (2 or 14 months)]. Google processes the data as our processor under Google's data processing terms for advertising and measurement products; according to Google, these terms are automatically part of the contract for businesses established in the EU. Google may also transfer data to the United States; according to Google, Google LLC is certified under the EU-U.S. Data Privacy Framework and relies on standard contractual clauses where required. Further information: policies.google.com/privacy.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings in the footer. Measurement then stops immediately, and we delete the Google Analytics cookies on our domain.

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods (e.g. tax and commercial law requirements). It is then deleted or anonymised.

You have the right to access the data we process about you (Art. 15 GDPR), as well as rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). Any consent you have given can be withdrawn at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing before the withdrawal. Please contact info@wolfhof.com or the address given above.

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Providing your data is voluntary. Without the information requested in the form, in particular your email address, we cannot answer your inquiry. We do not make automated decisions within the meaning of Art. 22 GDPR.

You have the right to lodge a complaint with the competent data protection supervisory authority: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy.

We update this privacy policy whenever our data processing or the applicable legal requirements change. The current version is always available on this page.