Privacy Policy

1. Who is responsible for your data

The controller of your personal data is:

Charitable Corti is the sponsor of AYOT – Adopt Your Olive Tree and the entity that receives contributions to the programme.

Contact point in the European Union. Charitable Corti is not established in the European Union. If you are in the Union and prefer a local address, you can also write to Annalisa Corti, c/o Azienda Agricola il Gallazone, Loc. Fontemaggio 25/b, 53040 Rapolano Terme (SI), Italy. The email is the same: info.ayot@gmail.com.

Who else is involved. The olive groves, the trees and the oil belong to Azienda Agricola il Gallazone di Filippo Fabbri, Loc. Fontemaggio 25/b, 53040 Rapolano Terme (SI), P.IVA 01517560528, which cultivates the land and produces the oil. It processes your data on behalf of Charitable Corti, and only for the purposes described below (engraving your plaque, preparing your shipment, delivering your thank-you). It does not use your data for its own purposes.

We have not appointed a Data Protection Officer, as our processing does not require one.

2. What we collect, and why

We only collect what is needed to run the programme and to deliver your thank-you.

What we never collect. We do not receive or store your card or bank details. When you contribute through PayPal or SumUp you are on their own secure pages, and they process your payment data as independent controllers under their own privacy policies.

If you choose to dedicate your tree to someone else, you may need to give us that person's name and, for a shipped gift, their address. Please make sure you have the right to share it with us.

3. How long we keep it

• Contribution and accounting records: 10 years, as required by Italian accounting and tax rules.
• Plaque, certificate and programme records (name, dedication, number of trees): for the duration of the programme and for as long as your adoption is renewed, so we can keep your tree's history.
• Shipping data: 24 months after delivery.
• Hospitality bookings: 24 months after the stay.
• Correspondence: 24 months after the last exchange.
• Consent records: as long as the processing continues, plus 3 years.
• Analytics data: a maximum of 14 months.

When a retention period ends, your data is deleted or irreversibly anonymised.

4. Who we share it with

Your data is shared only with those who need it to make the programme work.

• Azienda Agricola il Gallazone di Filippo Fabbri, as our processor: engraving, harvest, packing and shipping.
• Couriers and shipping agents (including Mail Boxes Etc. as our shipping partner): delivery of your oil.
• Il Fornacino and, when Il Fornacino is fully booked, the partner agriturismi hosting your stay: only your booking details.
• PayPal and SumUp: your contribution. They are independent controllers for payment data.
• Our service providers: website hosting and infrastructure (Base44), email and file storage, analytics and advertising providers (Google, Meta), accounting and legal advisers.
• Authorities, where we are legally required to disclose.

We never sell your personal data, and we never share your shipping address with other adopters.

Google and Meta as recipients. When you allow analytics and marketing cookies, the recipients of the navigation data described in clause 2 also include Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, for Google Analytics 4, and Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, Ireland, for the Meta Pixel. The purpose is to measure visits to this site and the performance of our advertising. The legal basis is your consent (Art. 6(1)(a) GDPR), given through the cookie banner and withdrawable at any time from the Cookie preferences link. The identifiers kept for this purpose are retained for up to 2 years for Google Analytics, 90 days for Meta's _fbp cookie, and our analytics data at user level for a maximum of 14 months. Our Cookie Policy lists the exact cookies and storage keys.

5. Transfers outside the European Economic Area

Charitable Corti is based in Jersey and the United Kingdom, which the European Commission considers to provide an adequate level of protection (UK adequacy decision) or, for Jersey, adequate protection with the same effect. Some of our providers (for example Google and Meta) may process data in the United States.

Where a transfer needs a safeguard, we rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

Google and Meta transfers. Google Ireland Ltd and Meta Platforms Ireland Ltd transfer the data described in clause 4 to their parent companies in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses (2021/914) and, where the recipient is certified, on the adequacy decision for the EU–US Data Privacy Framework. A copy of the safeguards can be obtained from us at the address in clause 1.

6. Your rights

You have the right to:

• access the personal data we hold about you, and receive a copy;
• rectify data that is wrong or incomplete;
• erase your data, where we are not required to keep it (accounting records are exempt);
• restrict or object to processing;
• portability of data you provided to us;
• withdraw consent at any time, without affecting processing carried out before the withdrawal;
• lodge a complaint with a supervisory authority.

To exercise any of these rights, write to info.ayot@gmail.com. We reply within one month, and we may need to verify your identity first.

Supervisory authorities: in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it); in the United Kingdom, the Information Commissioner's Office (www.ico.org.uk). You may also address the authority in your country of residence.

If you are in the United States

Most of the people who take part in AYOT are in the United States, so this section explains where you stand in plain terms.

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising except through the marketing cookie described in our Cookie Policy, which runs only if you consent.
• We collect only what clause 2 lists: what we need to engrave your plaque, ship your oil, book your stay and issue your receipt.
• You can ask us to access, correct or delete your information by writing to info.ayot@gmail.com. We do not discriminate against anyone who exercises these rights: your adoption, your oil and your nights are unaffected.
• We do not knowingly collect information from anyone under 18.
• The categories of third parties who may receive your information are listed in clause 4: our processor, the couriers, the agriturismi, the payment providers and our service providers.

Whatever your state of residence, the rights in this clause 6 are available to you on the same terms.

7. What we do not do

• We do not carry out automated decision-making with legal effects on you.
• We do not profile you for decisions about your adoption.
• We do not send marketing emails to anyone who has not asked for them. Every newsletter includes an unsubscribe link.

8. Minors

The programme is intended for adults. We do not knowingly collect data about children under 18. If you are a parent or guardian and believe a child has sent us personal data, write to us and we will delete it.

9. Changes

If we change how we process your data, we update this policy and change the "last updated" date at the top. Substantial changes are communicated by email to adopters with an active adoption.

10. Contact

info.ayot@gmail.com — this is the single contact point for the programme, for your data, and for the European Union contact point.