Privacy policy
Last updated: 2 September 2026
This Privacy Policy applies to the Shopify store Atelier del Vino by Grande Passione, available at atelier.grandepassione.com, and to services connected with the store, including customer accounts, purchases, event and course registrations, digital products and any future restricted-access services.
The store is operated by:
Grande Passione di JC Viens
Sole proprietorship
Via Mario Morgantini 2/A
37128 Verona (VR), Italy
VAT No. IT04781010238
Italian Tax Code VNSJCH68C14Z401Y
REA VR-446577
Email: contact@grandepassione.com
Certified email (PEC): grandepassione@pec.it
Grande Passione di JC Viens is the Data Controller for the personal data processed for the purposes described in this Privacy Policy.
Atelier del Vino is the name of Grande Passione’s physical retail location at the same address.
This Privacy Policy applies exclusively to the Shopify store and the services connected with it. The website grandepassione.com has its own privacy policy.
The Italian version of this Privacy Policy is the reference text. The English version is provided for the convenience of international customers.
1. Personal data we process
The personal data we process depends on how you use the store and its related services.
Identification and contact data
We may process your first name, surname, email address, billing address, delivery address where applicable, information required for product collection and other contact details provided during a purchase, account access, registration or communication with us.
Customer account data
Grande Passione uses Shopify Customer Accounts.
When you use your customer account, we process the information necessary to give you access, manage associated preferences and make available information relating to orders, digital products, cancellation or return requests and other functions available through the account.
Account authentication may take place using your email address and codes or other authentication tools provided by Shopify.
Order and transaction data
We process information relating to products and services purchased, orders, amounts, payments, refunds, registrations, digital products and previous transactions.
Physical goods purchased online are normally available for collection from Atelier del Vino. For certain specific products, particularly some course materials, shipping may be offered where stated on the product page, at checkout or expressly agreed.
Grande Passione does not sell wine online under the current store configuration.
Event, tasting and course data
When you purchase a ticket, course, tasting, private experience or another event, we may collect information relating to the participant, such as first name, surname, email address and other information necessary to organise and manage participation.
Depending on the activity, additional information may be requested, such as company or professional role, experience level, WSET level or course, organisational requirements, preferences relevant to the activity or other information useful for participation.
Information concerning allergies, intolerances or other health conditions is requested only where useful for managing the activity. Providing this information is optional. Where such information constitutes health data, it is processed on the basis of the data subject’s explicit consent and with particular care.
If a person purchases a ticket, course or experience on behalf of another participant, we may receive that participant’s data from the person making the purchase.
Tax and invoicing data
When you request an invoice, we may process, as necessary, Italian tax code, VAT number, company or business name, billing address, PEC, recipient code and other information required by applicable tax law.
Payment data
Payments may be made using the methods available at checkout, which may include Shopify Payments, Shop Pay, Apple Pay, Google Pay, PayPal, Satispay, bank transfer or other methods that may be available.
Full payment-card data or payment credentials are normally collected and processed directly by the selected payment-service provider. Grande Passione receives the information necessary to confirm and manage the transaction, such as the amount, payment status, payment method and transaction identifiers.
Digital-product data
For digital products, we may process information relating to the purchase, supply, access and download of the content where such information is generated by the systems used.
For products configured for immediate digital supply, we also process the record of the customer’s express consent to immediate supply and acknowledgement of any resulting loss of the right of withdrawal, as required by applicable law.
Future restricted-access services or membership
Grande Passione membership is not currently available for purchase.
If a membership or other restricted-access services are introduced in the future, we may process the data necessary to manage the purchase, access, usage rights, duration of the service and other relevant functions. This Privacy Policy will be updated, where necessary, before new providers or material processing activities are introduced.
Communications with Grande Passione
When you contact us, we process the information contained in your communications and the information necessary to respond, provide assistance and manage an order, event, course, digital product, complaint or other request.
Technical and usage data
When you use the store, certain data may be collected automatically, such as IP address, device and browser information, online identifiers, session information, pages visited and interactions with the store.
Some of this data is necessary for the operation, security, authentication and checkout functions of the store.
Non-essential technologies are used as described in this Privacy Policy and the Cookie Declaration and, where required, according to the preferences expressed by the user.
Communication preferences
If you choose to subscribe to our communications, we process the information necessary to manage the subscription, your stated preferences and evidence of consent.
Grande Passione uses promotional communications by email. Under the current configuration, we do not use SMS, WhatsApp or postal mail for marketing purposes.
2. Sources of personal data
We may receive personal data:
- directly from you when you make a purchase, use an account, register for an event or course, purchase a digital product, complete a form or communicate with us;
- from the person purchasing a ticket, course or service on behalf of another participant;
- automatically through Shopify and the technologies used by the store;
- through Easy Appointment Booking by Servicify, when you use booking functions;
- through Shopify Digital Products, for the supply and management of digital products;
- from providers we use for payments, invoicing, communications, consent management, security and other services required to operate the store.
3. Purposes and legal bases for processing
Performance of a contract and pre-contractual measures
We process the data necessary to manage your account, process orders and payments, organise collection or any applicable shipping, manage registrations for events and courses, provide digital products, manage cancellation, withdrawal, return and refund requests and provide support relating to purchased products and services.
The legal basis is the performance of a contract or pre-contractual measures taken at the request of the data subject under Article 6(1)(b) GDPR.
Legal, tax and accounting obligations
We process the data necessary to comply with tax, accounting, commercial, consumer-protection and other applicable legal obligations, including issuing and retaining tax documentation and managing rights granted to consumers.
The legal basis is compliance with a legal obligation under Article 6(1)(c) GDPR.
Newsletter and promotional communications
We use Klaviyo to manage subscriptions and authorised email communications.
We send promotional emails to people who have provided the relevant consent.
Newsletter subscriptions use a double opt-in confirmation process.
The legal basis is consent under Article 6(1)(a) GDPR.
You may withdraw your consent at any time using the unsubscribe link contained in our emails or by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Purchasing a product, participating in an event or creating or using an account does not automatically subscribe you to promotional communications.
Cookies, non-essential technologies and measurement
The store uses technologies strictly necessary for its operation and may, subject to consent where required, use functional, analytical or marketing technologies.
Preferences are managed through Pandectes GDPR Compliance.
Where applicable law requires consent, these technologies are used according to the choices made by the user. Preferences can subsequently be changed using the tools available on the store.
The Shopify integration with Klaviyo may receive customer, order and subscription data. Any behavioural tracking functions on the store are subject to applicable privacy and consent settings and are not used for marketing purposes in regions requiring consent before the necessary consent has been provided.
The configuration of Klaviyo behavioural tracking is being completed and verified before operational use.
Grande Passione does not currently use Google Analytics, Google Ads or Meta Pixel on the store.
If these or other analytics or advertising technologies are introduced in the future, the relevant notices and consent settings will be updated before activation where required by applicable law.
Shopify Network Intelligence and Shopify Enhanced Services
Shopify Network Intelligence is enabled on our store.
When this feature is enabled, Shopify may securely use certain customer data from our store together with data from customers’ interactions with Shopify and other merchants to generate insights and support advanced functionality referred to by Shopify as Enhanced Services.
These services may contribute, among other things, to personalising the experience, improving performance and security, understanding interactions with the store and, for functions that provide for it, improving the relevance of advertising activities.
For certain processing carried out in connection with Enhanced Services, Shopify acts as an independent data controller or under another role provided by its terms and Data Processing Addendum.
Where applicable law requires consent or grants a right to object or opt out, the relevant choices are collected or made available through the privacy tools provided by the store and Shopify.
Further information about processing carried out directly by Shopify and the ways in which relevant rights or privacy choices can be exercised is available in the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.
Health data provided for events and courses
Where a participant chooses to provide information relating to allergies, intolerances or other health conditions, that information is used solely to the extent necessary to organise the activity and manage the requirements communicated.
The legal basis is explicit consent under Article 9(2)(a) GDPR.
Security and fraud prevention
We may process technical, account and transaction data to protect the store, users and transactions, prevent abusive access and combat fraud or unlawful activity.
The legal basis is our legitimate interest in protecting our business and services under Article 6(1)(f) GDPR, together with any applicable legal obligations.
Protection of legal rights
We may retain and use data where necessary to establish, exercise or defend a legal right, manage a dispute or cooperate with competent authorities.
The legal basis may be our legitimate interest in protecting our rights and, where applicable, compliance with a legal obligation.
4. Mandatory and optional provision of data
Data necessary to complete a purchase, make a payment, use an account, participate in an event or course, obtain a digital product, manage collection or shipping or request an invoice is necessary to provide the relevant service.
Failure to provide this data may prevent us from completing the requested operation.
Consent to newsletters, promotional communications and non-essential technologies is optional.
Providing information concerning allergies, intolerances or other health conditions is also optional.
5. Who we share personal data with
We share personal data to the extent necessary to provide our services, operate the store and comply with legal obligations.
Recipients may include:
- Shopify, which provides the e-commerce platform, Shopify Customer Accounts, checkout, order management, Shopify Digital Products, payment services and other technical and commercial services. With Shopify Network Intelligence enabled, Shopify also processes certain data in connection with its Enhanced Services according to the role provided by its terms;
- payment providers, including, depending on the method selected, Shopify Payments, Shop Pay, Apple Pay, Google Pay, PayPal and Satispay;
- Easy Appointment Booking by Servicify, for managing bookings, availability, participants, operational communications, waiting lists and other functions connected with events and courses;
- Klaviyo, for managing email profiles, subscriptions, preferences, authorised communications and, where configured and permitted, related measurement and automation functions;
- Pandectes GDPR Compliance, for managing the consent banner, preferences relating to cookies and consent-based technologies and functions connected with privacy requests;
- Fatture Italia and Fatture in Cloud, where used to collect and process information necessary for invoicing and tax obligations;
- the Italian Revenue Agency’s Sistema di Interscambio and other public authorities where disclosure is required by law;
- any postal services, couriers or carriers where specific materials or products are shipped;
- our accountant, professional advisers and technical providers, where their involvement is necessary and subject to applicable confidentiality and data-protection obligations.
Membership is not currently active and no technical provider for it has yet been selected. Before introducing a new provider that receives personal data, this Privacy Policy will be updated where necessary.
Some providers act as processors on behalf of Grande Passione; others may operate as independent data controllers depending on the nature of the service, their respective terms and their own privacy policies.
Grande Passione does not sell personal data in exchange for money.
Certain laws, particularly in the United States, give the terms “sale” or “sharing” a broader meaning. Where such rights apply, the store provides a Do Not Sell or Share My Personal Information function and any additional tools required by applicable law and the platform.
6. Our relationship with Shopify
The store is built and hosted on the Shopify platform.
Shopify processes certain personal data on behalf of Grande Passione in order to provide services necessary for the operation of the store, including customer accounts, checkout, order management, digital products, security and other platform functions.
Shopify Network Intelligence is enabled.
Through Shopify Network Intelligence, Shopify may use certain data arising from customers’ interactions and transactions with our store together with other Shopify data to provide, develop and improve its Enhanced Services.
For certain processing carried out in connection with those services, Shopify may act as an independent data controller under its contractual and privacy terms.
Other merchants cannot access Grande Passione’s identifiable customer database through Shopify Network Intelligence. Shopify uses the information within its own infrastructure to support the relevant functions and services.
Where required by applicable law, preferences relating to processing subject to consent or opt-out rights are collected through the store’s consent-management system or through privacy tools made available by Shopify.
Information transmitted through the store may be processed by Shopify and its providers in countries other than the country in which the user is located, in accordance with the mechanisms required by applicable law.
For more information, please consult the Shopify Consumer Privacy Policy.
Shopify also provides a Privacy Portal through which, where applicable, you can manage certain preferences and exercise rights or objections relating to processing carried out directly by Shopify.
7. Cookies and similar technologies
The store uses cookies and technologies strictly necessary for its operation.
Preferences relating to cookies and other non-essential technologies are managed through Pandectes GDPR Compliance, which is the consent-management system used by the Shopify store.
In regions configured for prior consent, non-essential technologies are activated according to the choices made by the user.
You can:
- accept the available categories;
- reject non-essential technologies;
- customise your preferences;
- subsequently change your choices using the dedicated function available on the store.
Pandectes integrates its consent model with the Shopify Customer Privacy API to communicate preferences to Shopify systems and integrations that support this framework.
Grande Passione does not currently use Google Analytics, Google Ads or Meta Pixel on the store.
If these or other analytics, profiling or advertising tools are introduced in the future, the relevant notices and consent configurations will be updated where necessary.
For detailed information about the categories and technologies used, please consult the Cookie Declaration available on the store.
8. Events, tastings, courses and minors
Grande Passione does not sell wine online under the current store configuration.
Events, courses and other activities involving the tasting or serving of alcoholic beverages are restricted to persons who have reached the minimum age required by applicable law and, for activities taking place in Italy, to adults.
Grande Passione may visually inspect an identity document at entry where necessary.
Under normal circumstances, we do not retain a copy of the document or record its details following that check.
9. Data retention
We retain personal data for the period necessary for the purposes for which it was collected and to comply with applicable obligations.
In particular:
- tax and accounting documents are retained for the period required by law, generally 10 years;
- order and contract data may be retained for up to 10 years where necessary to document the relationship, comply with legal obligations or protect our rights;
- customer account data is retained for the duration of the account and thereafter to the extent necessary to manage previous transactions or legal obligations;
- event and course booking data is retained for the period necessary to manage the activity and subsequently to the extent required for contractual, administrative or legal purposes;
- digital-product data may be retained together with the order and information necessary to document supply, access and, where applicable, consent to immediate supply;
- data used for marketing is processed until consent is withdrawn or the person unsubscribes; information required to demonstrate consent may be retained for the period necessary to document its validity;
- any health data provided for a specific event or course is deleted when no longer necessary to manage the activity and the immediate related requirements, unless further retention is required by law;
- customer-support communications may be retained for up to 24 months unless connected with a contract, dispute or obligation requiring a longer period;
- retention periods relating to cookies and similar technologies are stated in the Cookie Declaration or consent-management tools.
If a membership is introduced, the relevant retention periods will be defined according to the actual service and this Privacy Policy will be updated where necessary.
At the end of the applicable retention periods, data is deleted or anonymised unless further retention is required or permitted by law.
10. International transfers
Some providers used by Grande Passione, including Shopify, Klaviyo and other technology providers, may process personal data or make it accessible from countries outside the European Economic Area.
Where required by the GDPR, transfers are made on the basis of a European Commission adequacy decision, Standard Contractual Clauses approved by the European Commission or other mechanisms recognised under applicable law, together with any additional measures required in relation to the relevant transfer.
11. Security
We adopt reasonable and proportionate technical and organisational measures to protect personal data against loss, unauthorised access, misuse, alteration or disclosure.
Security also depends on the systems of the providers we use. We encourage you to protect access to your email and account and to contact us if you suspect unauthorised access.
12. Automated decision-making
Grande Passione does not make decisions based solely on automated processing that produce legal effects or similarly significant effects on the data subject.
Shopify, payment-service providers and other providers may use automated systems for purposes such as security, authentication and fraud prevention in accordance with their respective privacy policies.
13. Your rights
Where provided by applicable law, you may request:
- confirmation as to whether your personal data is being processed and access to that data;
- rectification or completion of inaccurate or incomplete data;
- deletion of data;
- restriction of processing;
- data portability;
- objection to processing based on legitimate interests;
- objection at any time to processing for direct-marketing purposes;
- withdrawal of consent where processing is based on consent.
You can exercise these rights by writing to:
or by certified email (PEC):
The store also provides a Manage your personal data page through which, where available, requests concerning access, correction, portability or deletion of data may be submitted.
We may request information reasonably necessary to verify your identity.
We will respond within the periods required by applicable law, normally within one month of receiving the request under the GDPR.
For processing carried out by Shopify as an independent data controller in connection with its own services, you may also use the Shopify Privacy Portal.
Rights relating to the sale or sharing of data
For persons to whom laws granting a right to opt out of the “sale” or “sharing” of personal data apply, the store provides a Do Not Sell or Share My Personal Information page.
The availability and effect of this choice depend on the applicable law and the processing activities actually used.
14. Complaints
If you believe that the processing of your personal data breaches applicable law, you have the right to lodge a complaint with:
Garante per la protezione dei dati personali
or, where applicable, another competent supervisory authority within the European Economic Area.
Any other remedies available under applicable law remain unaffected.
15. Third-party links and services
The store may contain links to websites, platforms or services operated by third parties.
When you access an external service, its operator may process your data in accordance with its own privacy policy. Grande Passione does not control the privacy practices of independent websites and services that you voluntarily access through external links.
16. Changes to this Privacy Policy
We may update this Privacy Policy when our services, technologies, providers or regulatory obligations change.
The updated version will be published on the store with the new revision date.
Where required by applicable law, we will provide additional information or obtain new consent before introducing the relevant processing activity.
17. Contact
For questions relating to this Privacy Policy, the processing of your personal data or the exercise of your rights:
Grande Passione di JC Viens
Via Mario Morgantini 2/A
37128 Verona (VR), Italy
VAT No. IT04781010238
Italian Tax Code VNSJCH68C14Z401Y
REA VR-446577
Email: contact@grandepassione.com
Certified email (PEC): grandepassione@pec.it