Last updated: 2 November 2026
Thank you for visiting Organic Farming Italy. This notice explains how we handle personal data when you use our website, place an order, arrange an olive tree sponsorship, communicate with us or interact with our related services.
The controller responsible for this website, orders and olive tree sponsorships is MY BIO FARM GmbH (trading as Organic Farming Italy), Landsberger Str. 333e, 80687 Munich, Germany. Email: info@organicfarming-italy.com; telephone: +39 338 597 3817. Our agricultural activities also take place in Imperia, Italy. You can contact us at the email address above with any questions or requests concerning personal data.
Depending on how you interact with us, we process connection and usage information (such as IP address, time of access and browser), contact and correspondence details, billing and shipping addresses, order items, transaction and shipping status, and sponsorship details including tree size, name printed on the tree plaque and certificate, requested certificate date, gift recipient details and visit appointments. We may also process photos, videos and messages shared in connection with a sponsorship.
We rely on Article 6(1)(b) GDPR for contracts and pre-contractual requests, Article 6(1)(c) for legal obligations, Article 6(1)(f) for our legitimate interests in operating a secure website and providing reliable support and administration, and Article 6(1)(a) for consent-based activities such as newsletters and non-essential tracking. Information marked as required at checkout is necessary to complete an order; additional information is voluntary.
Our website and its hosting/security providers process technical log data to deliver pages, identify errors, prevent abuse and protect systems (Article 6(1)(f) GDPR). These data may include IP address, time, requested URL, browser, device information and response status. Logs are retained only as long as necessary for the relevant technical or security purpose, subject to the respective service configuration.
We use WordPress, WooCommerce, WooCommerce Subscriptions, Elementor, WPML and caching/security functions. Essential cookies and similar storage mechanisms keep shopping carts, checkout sessions and account logins working. Strictly necessary storage generally does not require separate consent under applicable electronic privacy rules; optional analytics and advertising technologies are addressed below.
If you contact us by form, email, telephone or another channel you choose, we use your contact details and message to respond, manage and document your enquiry. The legal basis is Article 6(1)(b) GDPR for contract-related questions or Article 6(1)(f) for other legitimate business communications. We use Microsoft Outlook/Microsoft 365 for business correspondence. Access is restricted to authorised staff and service providers.
WooCommerce is used to process purchases, customer accounts, renewals and ongoing sponsorship subscriptions. Personal data include names, addresses, contact details, purchased products, order identifiers, prices, payment status, shipment information and data required to provide the selected services (Article 6(1)(b) GDPR). Invoicing and legally mandated records are processed under Article 6(1)(c) GDPR.
Payments are handled by the payment method selected at checkout, including PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) and Stripe (Stripe Payments Europe, Ireland and affiliated providers). Required order and payment details are sent to the chosen provider. Complete card information is generally collected directly by the payment provider, while we retain payment status and transaction references. Subscriptions may involve recurring payment operations. See PayPal privacy and Stripe privacy.
To fulfil and maintain sponsorships we process the name requested for the plaque and certificate, sponsorship date, tree information, photographs, videos, location details and service correspondence. We use these details to coordinate plaques, certificates, farm visits, media files and olive oil shipments (Article 6(1)(b) GDPR).
We use services such as Google Drive/Sheets, Dropbox and pdfFiller to organise documents, production lists, certificates and individual media folders, with access limited to appropriate recipients and authorised team members. If a sponsorship is given as a gift, we may receive the recipient’s name and necessary contact details from the person who places the order. This indirect collection is limited to fulfilling the gift and is also subject to Article 14 GDPR transparency requirements.
We share necessary recipient, address, order and shipment data with our fulfilment and delivery partners, particularly Mail Boxes Etc. (MBE) Garching and DHL, as well as other carriers involved in delivering a specific order. For international deliveries, customs offices, shipping providers and other relevant authorities may receive information required for exports, imports, customs declarations and food-related shipping documentation. The legal grounds are Article 6(1)(b) and (c) GDPR. Shipping notifications and tracking may require additional contact details.
We connect services through Zapier (Zapier, Inc., USA), WooCommerce integrations and protected in-house interfaces, including an internally operated MCP server. These workflows support order processing, creation and updating of sponsorship records, production coordination, customer communications, accounting and shipping preparation. Depending on the task, personal data transferred between connected services can include name, email, address, order number, product, plaque name, certificate date, shipping/payment status and references to relevant documents. We aim to restrict access to what the relevant task requires.
The legal ground depends on the specific activity: generally Article 6(1)(b), (c) or (f) GDPR. Zapier may process data in the United States; connected services may also receive and process the data under their own terms. See Zapier privacy and its Data Processing Addendum.
We use AI-assisted tools, particularly OpenAI/ChatGPT, to help draft and translate customer messages, research information and perform internal administrative and technical tasks. Where necessary for a particular task, these tools may process information from customer enquiries, orders, sponsorship documents or correspondence. We seek to minimise personal data, restrict access and maintain human oversight. Binding contractual changes and sensitive customer matters are not decided solely on the basis of AI-generated output.
Depending on the purpose, the legal ground is Article 6(1)(b), (f) or, for consent-based processing, (a) GDPR. Data may be transferred to external AI providers and subprocessors, including outside the EEA, subject to applicable agreements and safeguards. See OpenAI European privacy policy and OpenAI DPA. Our internal AI support does not make solely automated decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR.
At your request, we may communicate through WhatsApp Business or invite you to a group for your sponsorship. This can involve your phone number, profile information, messages, photos, videos and sponsorship information. In group chats, other group members can see your phone number, profile name and contributions. Participation is voluntary; our sponsorship service is also available without WhatsApp. The legal ground for optional group participation is Article 6(1)(a) GDPR, and for requested one-to-one communications Article 6(1)(b) or (f). WhatsApp Ireland Limited is part of the Meta group. See WhatsApp privacy.
If you subscribe to our newsletter, we process your email address and, where applicable, name, language preference, subscription/confirmation records and email usage data. We use Intuit Mailchimp to send newsletters. Depending on settings, opening and link-click activity may be measured and attributed to individual contacts. Newsletters generally rely on your consent under Article 6(1)(a) GDPR. You can unsubscribe at any time using the link in each newsletter. Records needed to demonstrate consent may be retained. See Mailchimp privacy.
We use analytics and advertising measurement tools, including Google Analytics 4, Google Tag Manager, Google Ads, where applicable Meta/Facebook/Instagram advertising technologies and the OpenAI Ads Measurement Pixel. Depending on the technology, these may process page views, technical identifiers, referral/click information, browser and device data, and conversion events such as completed orders. Certain supported matching technologies may also use hashed information; hashing does not automatically make personal data anonymous.
Where required, we rely on prior valid consent (Article 6(1)(a) GDPR and applicable device privacy rules) for non-essential analytics and marketing technologies. Consent can be withdrawn for the future. This notice does not replace the technical requirement to obtain consent before the relevant scripts track activity. See the privacy policies of Google, Meta and OpenAI.
Some pages may display external content, including Google Maps, or link to external media. If an external resource is embedded, its provider may receive your IP address and technical usage data. Content requiring consent is loaded only after the applicable consent has been obtained. Following a link to another website may transfer data to its operator after you click. We may use security and anti-spam services, including Akismet for enabled forms/comments, to prevent misuse (Article 6(1)(f) GDPR).
For invoicing, accounting, payment reconciliation and statutory records we use systems such as Lexware Office (lexoffice), WooCommerce and Microsoft 365, together with authorised accounting and tax professionals. Data include names, contact and billing information, amounts, order and invoice details, payment status and related document references. Legal bases are Article 6(1)(b) and (c) GDPR.
Personal data are kept only as long as necessary for the underlying service, sponsorship, customer support or the establishment, exercise or defence of legal claims. Applicable accounting and tax retention periods may be six, eight or ten years depending on the document type. Other information is deleted or anonymised once no longer required, unless an applicable obligation or legitimate retention need applies. External providers may have additional contractual retention and deletion rules.
Depending on the processing purpose, recipients may include hosting and security providers, payment services, transport partners, communications and newsletter providers, cloud document services, automation and AI providers, accounting professionals and authorised technical staff. Where applicable, we use processors in accordance with Article 28 GDPR. Some providers or subprocessors operate outside the European Economic Area, particularly in the United States.
International transfers take place only subject to Articles 44 et seq. GDPR, for example an applicable adequacy decision (including the EU-US Data Privacy Framework for certified participating US companies) or appropriate safeguards such as the EU Standard Contractual Clauses, with additional measures where required. The actual transfer mechanism depends on the relevant provider and its current status.
Subject to applicable conditions, you have rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20). You may object on grounds relating to your particular situation to processing based on legitimate interests (Article 21). You can object to processing for direct marketing at any time. Consent may be withdrawn with future effect (Article 7(3)). Contact info@organicfarming-italy.com to exercise these rights.
You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The Bavarian State Office for Data Protection Supervision is generally competent for private companies established in Bavaria.
For prearranged farm visits we process booking and contact details to organise the appointment (Article 6(1)(b) or (f) GDPR). Where CCTV is used at a farm or business site, it is operated only for purposes indicated locally, such as protection of people and property, following the required legitimate-interest assessment (Article 6(1)(f) GDPR). Information on monitored areas, responsible parties and retention is provided on site.
Last updated: 2 November 2026. We will revise this notice when our actual processing activities, providers or legal obligations change. For further information about specific recipients or transfers, please contact us.
