Privacy policy
Information on the processing of personal data under Art. 13 of Regulation (EU) 2016/679 (GDPR) for the website www.zafferano.org and for the subscription to the Zafferano magazine.
Last updated: 6 November 2026 · version 4 · This is a translation of the Italian version, which prevails in case of discrepancy.
In brief
- Who processes your data: Consorzio Zafferano, Curtarolo (Padua, Italy), publisher of the Zafferano magazine.
- Which data: what you enter in the website forms — «Subscribe» (first name, last name, email, postal address, reason for your request, message) and «Newsletter» (first name, email) — your choices on the consent boxes and technical browsing data. If you accept statistics cookies, also website usage data collected by Google Analytics.
- Why: to send you the free print magazine you request and manage your subscription; to answer your requests, including proposals to contribute as an author; to send you the newsletter and promotional communications only if you tick the dedicated box; to measure website use statistically, only if you accept it in the banner; to protect the forms from spam and the website from abuse.
- Who receives them: authorised staff of the Consorzio; whoever prints and ships the magazine; providers who manage on our behalf the forms, the subscriber list and the newsletter (HubSpot), hosting (Amazon Web Services), form protection (Google reCAPTCHA, Cloudflare) and, only if you accept them, visit statistics (Google Analytics). Some providers may process data in the United States, with the safeguards in section 6.
- What we do not do: the website does not use advertising or profiling cookies; statistics cookies are enabled only if you accept them in the banner, and third-party services are not loaded before your choice or until you open one of the forms («Subscribe» or «Newsletter»). Our emails do not use tools that record whether you open them or which links you click.
- Your rights: to change your shipping address, cancel the magazine or stop the newsletter, write to info@zafferano.org; for access, erasure and the other rights in section 7, write to dataprivacy@zafferano.org.
1. Data controller
Consorzio con attività esterna Zafferano, in short Consorzio Zafferano
Via Caduti di Russia, 9 – 35010 Curtarolo (PD), Italy
VAT IT03403950284
Privacy contact: dataprivacy@zafferano.org
2. Which data we process, why and for how long
| Processing | Data | Purpose | Legal basis | Provision of data | Retention |
|---|---|---|---|---|---|
| Website browsing | IP address, browser and device type, requested page, date and time | Running the website and protecting it from abuse | Legitimate interest (Art. 6(1)(f) GDPR) | Necessary to visit the website | Access logs are kept by the hosting provider (Amazon Web Services) for the whole duration of the service: this is a provider setting we cannot reduce. We only consult them for website security and to investigate abuse. |
| Free subscription to the print magazine | First name, last name, postal address, email | Sending you the magazine and managing the subscription: address changes, cancellation, notices about the subscription | Performance of the service you request (Art. 6(1)(b) GDPR) | Fields marked * are necessary to send you the magazine | As long as you remain a subscriber. Every 24 months we ask you by email whether you want to keep receiving it: if you do not confirm, we stop shipping and erase the data |
| Contact requests | First name, last name, email, reason for the request, message | Answering your request for information or your proposal to contribute to the magazine as an author | Pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) for the contribution proposal; legitimate interest in answering whoever writes to us (Art. 6(1)(f)) for other requests | Fields marked * are necessary to answer you | 3 years from collection, then erasure; if a collaboration starts, for the duration of the relationship and then as required by law |
| Newsletter and promotional communications | First name, email | Sending you by email the newsletter and promotional communications of Consorzio Zafferano: articles, recipes, new issues, initiatives and events | Consent (Art. 6(1)(a) GDPR and Art. 130 of the Italian Privacy Code), given by ticking the dedicated box in the «Newsletter» or «Subscribe» form | Optional: if you do not tick the box, you still receive the magazine. In the «Newsletter» form the box is how you sign up | Until consent is withdrawn and in any case no longer than 24 months from the last interaction. Our emails do not use tools that record whether you open them or which links you click. |
| Visit statistics | Online identifiers assigned by Google Analytics cookies, pages visited, duration and source of the visit, device and browser type, approximate geographic location | Understanding statistically how the website is used in order to improve it | Consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code), given with «Accept» in the banner | Optional: if you reject, the website works in exactly the same way | Cookies: 2 years; data in the Google Analytics property: 14 months |
| Record of cookie choices | Random code of your choice (also stored in your browser's local storage, see the Cookie policy), choice (statistics accepted or rejected), version of the banner text, page, browser type and operating system (without version), date and time. The record does not store your IP address, and the service receiving the choices keeps no access logs. | Being able to prove the consent you gave or refused | Legal obligation (Art. 6(1)(c) GDPR): proving consent, as required by Articles 7(1) and 5(2) GDPR | Automatic when you choose in the banner | 12 months, then automatic erasure: the 6 months during which the choice remains valid plus 6 months for any disputes. Meanwhile the records cannot be altered. |
| Protecting the forms from spam | Technical device and browsing data collected by Google reCAPTCHA Enterprise (IP address, browser, interactions with the page) and the _GRECAPTCHA cookie | Telling people apart from automated programs | Legitimate interest in the security of the form (Art. 6(1)(f)). Access to device information is strictly necessary to securely submit the form you asked to use (Art. 122(1) of the Italian Privacy Code) and therefore does not require consent | Necessary to submit the form | Managed by Google as a sub-processor of HubSpot; cookie for 6 months |
3. Legitimate interests
- Website security and operation: recording technical data about visits lets us run the website and detect abuse.
- Answering requests: answering those who write to us through the form to ask for information.
- Protecting the forms from spam: we use Google reCAPTCHA to prevent the automated submission of fake sign-ups.
You can object at any time to processing based on legitimate interest (see the box in section 7).
4. Recipients
Consorzio staff. Data are processed by authorised staff of Consorzio Zafferano (Art. 29 GDPR and Art. 2-quaterdecies of the Italian Privacy Code), who are instructed and bound to confidentiality, only as far as their task requires: editorial office, administration and IT systems.
Printing and shipping. To send you the magazine we disclose your first name, last name and postal address to whoever prints and ships it, who processes them on our behalf as a processor (Art. 28 GDPR): the printer and the shipping service appointed by the Consorzio. If you want to know who they are, write to dataprivacy@zafferano.org. The postal service or courier receives the address only for delivery.
Providers. They process data on our behalf as processors (Art. 28 GDPR):
| Provider | Service | Where the data are |
|---|---|---|
| HubSpot Ireland Ltd. | «Subscribe» and «Newsletter» forms, subscriber list, requests received and newsletter sending | HubSpot data centres in the European Union (eu1 region); possible access from the United States, see section 6 |
| Google Ireland Limited | Google Analytics and Google Tag Manager, only if you accept statistics cookies | European Union and United States (Google LLC), see section 6 |
| Amazon Web Services | Website hosting and content delivery (CloudFront) | European Union (Ireland); content is delivered through the global CloudFront network, see section 6 |
| Cloudflare, Inc. | HubSpot sub-provider: bot protection on the form servers (__cf_bm cookie) | United States and global network, see section 6 |
| IT service provider | Technical management of the website, the forms and the record of cookie choices | Italy |
Google LLC provides Google reCAPTCHA Enterprise as a sub-processor of HubSpot. Under the terms of the service, Google processes these data only to provide and maintain the service and to keep its security features effective, and does not use them for other purposes such as personalised advertising. The up-to-date list of processors is available on request from the contact in section 1. Data are not disseminated or disclosed to others, except for legal obligations or requests from the authorities.
5. Automated decisions
We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
6. Transfers outside the European Economic Area
| Provider | Country | Safeguard |
|---|---|---|
| Google LLC (Analytics, Tag Manager, reCAPTCHA) | United States | EU-US adequacy decision (Data Privacy Framework, Decision (EU) 2023/1795) |
| HubSpot, Inc. | United States | Data Privacy Framework and standard contractual clauses in the data processing agreement |
| Cloudflare, Inc. | United States | Data Privacy Framework and standard contractual clauses |
| Amazon Web Services | United States and global CloudFront network (support access; delivery of pages to visitors outside the EU) | EU-US adequacy decision (Data Privacy Framework): Amazon Web Services, Inc. is covered by the certification of Amazon.com, Inc.; in addition, the standard contractual clauses of the AWS data processing agreement |
You can ask us for information on the safeguards adopted, or a copy of them, by writing to the contact in section 1.
7. Your rights
You can ask us at any time to:
- access your data and receive a copy (Art. 15 GDPR);
- rectify them if they are inaccurate or incomplete, for example if you change address (Art. 16);
- erase them when they are no longer needed, if you cancel the magazine or have withdrawn consent (Art. 17);
- restrict their processing (Art. 18);
- receive them in a structured format or have them transmitted to another controller, for data you gave us on the basis of consent or a contract (Art. 20);
- withdraw your consents (newsletter and promotional communications, statistics) at any time, without affecting processing already carried out (Art. 7(3)): for the newsletter also through the link in every message, for statistics from «Cookie preferences» at the bottom of every page.
Right to object (Art. 21 GDPR). You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (sections 2 and 3). You can always object, without giving reasons, to the use of your data for the newsletter and promotional communications.
Address changes, cancellation and newsletter. To change your shipping address, cancel the magazine or stop receiving the newsletter, write to info@zafferano.org. For the newsletter you can also use the link in every message. To exercise the other rights, write to dataprivacy@zafferano.org or by post to Consorzio Zafferano, Via Caduti di Russia, 9, 35010 Curtarolo (PD), Italy. A request sent to either address will be handled in any case. We reply within one month, extendable by two months for complex cases, and tell you the reason for any extension.
8. Complaints
If you believe the processing of your data infringes the GDPR, you can lodge a complaint with the supervisory authority of the State where you live, work or where the infringement took place. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it).
9. Minors
The website and the magazine are aimed at professionals in the food service and culinary sector and are not intended for minors.
10. Cookies and similar tools
The website uses technical cookies and, only with your consent, Google Analytics statistics cookies. It does not use advertising or profiling cookies. All details are in the cookie policy; you can change your choice from «Cookie preferences» at the bottom of every page.
11. Changes to this notice
We may update this notice when processing, providers or regulations change. The date at the top shows the latest version. If the changes concern purposes for which you gave consent, we will ask you again.