Privacy notice

1. Data controller

The data controller is Luigi Pesaro, trading as Fungo Da Te — Az. Agr. Pesaro Luigi, VAT no. 01445770777, Italian tax code PSRLGU03E23G786N, registered at Via Santa Croce 2, 75025 Policoro (MT), Italia ("the Controller", "we"). For any request about your personal data you can write to info@fungodate.com or, via certified email (PEC), to luigi.pesaroazagr@pec.it.

2. What data we collect

We only collect the data necessary to provide the service you requested:

• Order data: name, shipping and billing address, email, phone, payment details (handled by the payment provider, not stored by us).
• Account data (if you create an account): name, email, password (stored encrypted).
• Contact data: whatever you write to us by email or WhatsApp for support, including any photos of your grow you send us.
• Newsletter data: the email address you leave in the sign-up form.
• Technical browsing data: IP address, browser/device type, pages visited, and a coarse country estimate supplied by the hosting edge to offer the right market — see the Cookie Policy for detail.

3. Purposes and legal basis of processing

We process your data only for the purposes listed below, each with its own legal basis under Art. 6 GDPR:

4. Who we share your data with

We do not sell or transfer your data to third parties for marketing purposes. Your data may be shared, to the extent strictly necessary, with parties who process data on our behalf as data processors (Art. 28 GDPR):

• Shopify, for hosting the e-commerce store, managing the order and processing payment at checkout;
• the couriers handling shipping (SDA, GLS, Bartolini/BRT, Poste Italiane, depending on the delivery zone);
• our accountant/accounting firm, for tax obligations;
• Klaviyo Inc., based in the United States, which we use (a) as our newsletter service provider, for subscribers who gave consent, and (b) to send order-related communications regardless of newsletter consent — including confirming a digital withdrawal request, and, only for shoppers who separately opted into marketing, cart-abandonment reminders.
• Cloudflare, Inc., which provides Turnstile, an invisible bot-detection check running silently (no puzzle, no visible widget) on our newsletter and digital-withdrawal forms to stop automated abuse. It processes your IP address and browser signals for this sole purpose — see Cloudflare's own Turnstile Privacy Addendum.
• Google Ireland Limited / Google LLC, which provides Google Analytics 4 (anonymous, aggregate statistics on site usage, only if you accept the "Statistics" cookie category), Google Ads (conversion measurement for our own advertising campaigns) and Google Merchant Center (publishing our product catalogue, prices and shipping information on Google's own surfaces, such as the Shopping tab). None of these enable third-party advertising profiling or data sale — see our Cookie Policy for how your consent choice controls Google Analytics specifically.

5. Data transfers outside the European Economic Area

Some of the providers listed in point 4 may be based, or hold servers, outside the European Economic Area (EEA). In that case the transfer only takes place towards countries covered by a European Commission adequacy decision, or on the basis of appropriate safeguards, such as Standard Contractual Clauses (Arts. 44–49 GDPR).

Klaviyo, based in the United States, is certified under the EU-U.S. Data Privacy Framework (an adequacy mechanism recognised by the European Commission) and additionally includes Standard Contractual Clauses in its Data Processing Agreement as a fallback safeguard. Your email address is processed by Klaviyo if you subscribe to the newsletter (with consent), submit a digital withdrawal request, place an order, or — if you opted into marketing — leave a cart without completing checkout; see point 4.

Cloudflare, Inc., based in the United States, relies on Standard Contractual Clauses for this kind of transfer. Only the technical signals described in point 4 are involved — never your name, email or order details.

Google, based in the United States, is certified under the EU-U.S. Data Privacy Framework and additionally relies on Standard Contractual Clauses in its data processing terms as a fallback safeguard.

6. How long we keep your data

7. Your rights

At any time you can exercise, by writing to info@fungodate.com, the rights set out in Arts. 15–22 GDPR:

• Access: get confirmation that we process your data and receive a copy of it.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data, within the limits set by law (e.g. not for data we must keep for tax obligations).
• Restriction: request that processing be restricted in specific cases.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: withdraw a consent you gave (e.g. newsletter, statistics cookies) at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Complaint: lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali (www.garanteprivacy.it) — if you believe the processing breaches the GDPR.

8. Nature of the data provided

Providing the data necessary to fulfil an order is mandatory: without it we cannot complete the sale. Providing your email for the newsletter is instead optional and based on your consent.

9. Automated decision-making

We do not use any fully automated decision-making process, including profiling, that produces legal effects concerning you.

10. Minors

The site is not directed at minors under 16. If you are a parent or guardian and believe a minor has provided us with personal data without your consent, contact us to have it removed.

11. Changes to this notice

We may update this notice over time, for example to reflect new services or regulatory changes. The last-updated date is shown at the top of the page (26 August 2026). We invite you to check it periodically.