Privacy Policy

Last updated: 27 September 2026

This policy explains how Organic Tuscany Cooking Classes (“Organic Tuscany”, “we”, “us”) collects and uses personal data when you visit our website, get in touch with us, or join one of our cooking weeks or classes. It follows the EU General Data Protection Regulation (GDPR) and the Italian Privacy Code (Legislative Decree 196/2003).

In short: we use your details to answer your questions and to organise your stay. We share them only with people who help us do that, or where the law requires it, and we never sell them. You can ask us at any time to see, correct or delete your data.

1. Who we are

The data controller responsible for your personal data is:

Organic Tuscany
Località Il Pino, 50052 Certaldo (FI), Italy
Email: [email protected]

This policy cover our website, organictuscany.org (“the website”), and the services we provide.

2. What we collect, why, and for how long

When you visit the website

Our hosting and security providers automatically process the technical data needed to deliver web pages: your IP address, browser and device type, the pages you request, the date and time, and the page you came from. Our contact forms are protected by Cloudflare Turnstile, which checks similar technical signals to tell people apart from spam bots. Cloudflare also uses these signals, as an independent controller, to improve its bot detection (see Cloudflare’s Turnstile privacy addendum). To see which pages are visited, we use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.

• Why: to show you the website, keep it fast and secure, block spam and attacks, and count visits to our pages.
• Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).
• How long: security and server logs are kept only briefly, normally a few weeks, unless we need them to investigate a specific incident.

Services that run only if you accept them, such as Google Analytics, are described in section 3.

When you contact us

If you write to us through the website, email us or call us, we receive your contact details, such as your email address or phone number, and whatever else you choose to tell us, such as your name, the week you are interested in and your message. Messages sent through the website’s forms are delivered to our mailbox and may also be saved in the website’s database.

• Why: to answer your questions and, if you wish, to hold or book a place for you.
• Legal basis: steps taken at your request before a booking (Art. 6(1)(b) GDPR) and our legitimate interest in replying to messages (Art. 6(1)(f)).
• How long: up to 2 years after our last exchange, unless you go on to book with us.

When you book a cooking week or class

To organise your booking we collect the names and contact details of everyone in your party, billing details, your dates and type of room, payment records, your acceptance of our terms and liability waiver, and practical details such as your arrival plans or a rental car you ask us to arrange. If you pay by card, the payment is processed by our payment provider and we do not store your card number. If you book for other people, please make sure they have seen this policy.

• Why: to confirm and manage your booking, take payments, organise classes, meals and excursions, and keep in touch before and during your stay.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and, for invoices and accounting, our legal obligations (Art. 6(1)(c)).
• How long: invoices, payment records and booking correspondence for 10 years, as Italian law requires for business records; other practical details for up to 2 years after your stay.

Allergies, dietary needs and health information

If you tell us about food allergies or intolerances, dietary requirements linked to your health or religion, or a medical condition or physical limitation that matters for classes, meals or excursions, we treat this as sensitive data and handle it with extra care.

• Why: only to keep you safe and to adapt meals and activities to your needs. We share it only with the team members and partners who prepare your food or run your activities (for example, the winery that hosts lunch).
• Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which we ask for when we collect this information and which you can withdraw at any time. In a medical emergency, we may share relevant information with medical services to protect your life or health (Art. 9(2)(c)).
• How long: deleted within 30 days after your stay ends.

Registering guests with the police

Italian law requires accommodation providers to register every guest with the local police (Questura) through the State Police’s Alloggiati Web service. When you arrive, we therefore ask to see your passport or ID card and send the details the law requires, such as your name, date and place of birth, nationality and document details.

• Legal basis: legal obligation (Art. 6(1)(c) GDPR; Art. 109 of the Italian Public Security Act, TULPS).
• How long: we do not keep copies of your documents once the registration has been sent; we keep the confirmation receipt for the period required by law.

After your stay

We may email you after your stay to ask how it went or whether you would like to leave a review, and from time to time to tell you about new course dates. We do this in our legitimate interest in keeping in touch with past guests (Art. 6(1)(f) GDPR and Art. 130(4) of the Italian Privacy Code). Every such email reminds you that you can opt out: just reply and we will stop.

Photos

We sometimes take photos during classes and outings. We only publish photos in which you can be recognised, on this website or on our social media, if you have agreed (Art. 6(1)(a) GDPR), and we will remove them from our website and social media accounts if you change your mind.

Reviews shown on our website

Our website displays reviews that guests have published on Google, TripAdvisor, Yelp and Facebook, with the reviewer’s name or username and the date as they appear on those platforms. We do this in our legitimate interest in sharing independent feedback about our courses (Art. 6(1)(f) GDPR). If you would like your review removed from our website, just ask; it will remain on the original platform unless you delete it there.

Do you have to give us your data? No, but we cannot reply without a way to contact you, we cannot host you without your booking details, and Italian law requires identity details from everyone who stays with us.

When a retention period ends, we delete or anonymise the data. Copies in our website backups disappear as the backups are replaced.

3. Cookies and Google services

Cookies are small files that a website stores on your device.

Strictly necessary. Our website and its security services (Cloudflare and our firewall) use cookies and similar technologies to deliver pages and to protect the site and its forms from bots and attacks. The law does not require your consent for these.

Only with your consent. The following Google services run only if you accept them in our cookie banner:

• Google Analytics, to understand how visitors find and use the website. We keep this data for no more than 14 months.
• Google Ads, to measure whether our ads lead to enquiries and to show our ads to people who have visited our website (remarketing). Google uses this data as an independent controller and may combine it with other information it holds about you: see how Google uses information from sites that use its services, which also explains how to change your ad settings.
• Google Maps, which shows the interactive map on our “Where we are” page.

When these services run, Google receives your IP address, information about your device and the pages you visit, may set cookies that last up to 2 years, and may process the data in the United States (see section 5). Our legal basis is your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). You can accept or refuse these services in the banner and change your choice at any time with the “Cookie settings” link at the bottom of every page. Refusing them does not affect the rest of the website; only the map will not load.

Our website does not respond to browser “Do Not Track” signals; instead, these services run only if you accept them.

The Facebook, Instagram, Pinterest, TripAdvisor and Yelp icons on our website are plain links: those services receive information about you only if you click through, and their own privacy policies then apply.

4. Who we share your data with

We never sell your personal data. We share it only where necessary with:

• Service providers who help us run the website and the business: Cloudflare, Inc. (content delivery, security, the Turnstile check and Web Analytics), Defiant, Inc. (Wordfence website firewall), Google (Analytics, Ads and Maps, only if you accept them; see section 3), and our website maintenance, email, telephone, payment and IT providers. Where they act on our behalf, they are bound by contracts that require them to protect your data (Art. 28 GDPR).
• Partners who help run your week, and only with what they need: for example, local guides, the winery that hosts lunch, or a car rental company you ask us to book with.
• Public authorities, where the law requires it: for example, the police registration of guests or the tax authorities.
• Professional advisers, such as our accountant and, if ever needed, lawyers or insurers to establish or defend legal claims.

5. Transfers outside the European Union

Some of our providers, such as Google, Cloudflare and Defiant, are based in the United States or may access data from there. These transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, for companies certified under it, or on the Commission’s Standard Contractual Clauses. You can ask us for more details about these safeguards.

6. How we protect your data

The website is served only over an encrypted (HTTPS) connection and is protected by a firewall and bot protection. Access to guest information is limited to the people who need it to organise your stay, and we keep our systems and software up to date. No online service can be completely secure, but if a breach ever puts your data at risk, we will act promptly and inform you and the authorities as the law requires.

7. Your rights

You have the right to:

• access your personal data and receive a copy;
• correct data that is inaccurate or incomplete;
• delete your data, unless we must keep it by law (for example, accounting records);
• restrict how we use it in certain circumstances;
• object to our use of your data based on legitimate interests, including emails after your stay;
• receive the data you gave us in a common digital format, or have it sent to someone else (portability);
• withdraw your consent at any time where we rely on it, without affecting anything we did before.

These rights apply wherever you live. To use them, email [email protected]. It is free, and we will reply within one month (or tell you within that month if a complex request needs up to two more). We may ask you to confirm your identity first.

We do not make decisions about you based solely on automated processing.

If you think we have mishandled your data, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority in the EU country where you live or work (list of EU authorities). We would appreciate the chance to put things right first, so please contact us.

8. Children

Our website is not aimed at children, and we do not knowingly collect data through it from anyone under 14, the age of digital consent in Italy. When young people join a cooking week with their family, we collect their details from the parent or guardian who makes the booking.

9. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the current version. If a change significantly affects how we use data we already hold about you, we will tell you directly.

10. Contact us

For any question about this policy or your personal data, email [email protected] or write to us at the postal address in section 1.

---

Turnstile Privacy Addendum

Last updated: JUNE 18, 2025

1. INTRODUCTION

Turnstile, developed by Cloudflare, Inc. (Cloudflare), is a pro-privacy website security tool that processes minimal Signals (as defined below) solely to protect web properties against malicious activity by distinguishing human users from bots and blocking bot traffic.

Cloudflare does not control whether a website chooses to use Turnstile; instead, we make Turnstile available to any website that is looking for a way to detect and block bot traffic.

2. SCOPE OF THIS ADDENDUM

This Turnstile Addendum is supplemental to Cloudflare’s main Privacy Policy. It provides additional information specific to your use and interaction with Turnstile. This Addendum also applies to the personal data processed using Cloudflare’s Challenge Platform, and any reference to “Turnstile” in this addendum applies equally to the Challenge Platform.

The Cloudflare Privacy Policy continues to apply to your use and interaction with Turnstile, except where this Turnstile Addendum provides more specific information. In those cases, the more specific information will apply instead.

3. INFORMATION WE COLLECT

Cloudflare Turnstile processes a variety of client-side signals (“Signals”) such as client IP address, TLS Fingerprint, User-Agent Header and Sitekey and associated origin. Cloudflare does not have the ability to directly identify any individuals from any of the Signals Turnstile collects, including IP addresses.

4. HOW WE USE INFORMATION WE COLLECT

(i) Bot detection and blocking

Turnstile is a tool to protect web properties by distinguishing human users from bots and blocking any detected bot traffic that could otherwise harm the safety and security of that property.

It does so by evaluating the Signals listed above specific to both the website visitor and the website visited. The purpose of collecting these Signals is not to identify, profile or target any individuals but solely to detect and block bots. The Signals collected by Turnstile are strictly necessary for this purpose (i.e. detecting and blocking bots to enable visitors to enjoy a safe and secure experience when visiting websites that have implemented Turnstile).

Cloudflare is a data processor of Signals that we process to provide the Turnstile service to our customers, that is, securing our customers’ websites. This means that we process Signals for this purpose on behalf of, and pursuant to instructions issued by, our website operator customers (who are the data controllers of any data processed for this purpose). If you have questions, or wish to exercise any data protection rights, regarding Cloudflare’s processing of Turnstile data to provide our service, please contact the relevant website operator.

(ii) Improving Turnstile’s bot detection capabilities

Cloudflare also processes the Signals described in this Privacy Notice to improve Turnstile. This is necessary to refine and improve our bot detection algorithms in order to respond to evolving bot threats, and to maintain the security of the web properties that website visitors choose to visit.

Cloudflare is a data controller of Signals that we process to improve Turnstile’s bot detection capabilities. This Turnstile Privacy Notice (in conjunction with Cloudflare’s main Privacy Policy) governs our processing of Signals for this purpose.

5. NOTICE TO EU AND UK RESIDENTS

To the extent that the data described in the Turnstile Privacy Notice qualifies as personal data, then:

• When processing this personal data as a processor to protect our customers’ websites, our customers, as controllers, determine the lawful basis of this processing, and we process this data under their instruction and on their behalf; and

• When processing this personal data as a controller, we rely on our legitimate interests in improving the effectiveness of Turnstile’s bot detection capabilities to process this Turnstile data.

6. COOKIES

The Signals collected by Turnstile are strictly necessary for the purpose of detecting and blocking bots to enable visitors to enjoy a safe and secure experience when visiting websites that have implemented Turnstile.

For more information about the cookies used by Cloudflare, please check our Cookie Policy and our Turnstile Developer Docs.

CONTACT FOR PRIVACY CONCERNS

If you have questions or concerns about this Turnstile Privacy Notice or your personal data processed through Turnstile, please contact Cloudflare’s Data Protection Officer at [email protected].