Privacy Policy

Last updated: 19 October 2026

This notice explains how LangheMyFood S.r.l. processes the personal data of people who visit www.langhemyfood.com, create an account, buy products, book experiences, subscribe to the newsletter, write to us or use Sofia, the shop's assistant. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 (the "Privacy Code"). You will find all the details about cookies and similar tools in the cookie policy.

1. Who is the data controller

LangheMyFood S.r.l.
Registered office: Via Vivaro 29/A, 12051 Alba (CN), Italy
VAT number and tax code 03715690040 · REA CN-311599
Email info@langhemyfood.com · Certified email (PEC) langhemyfood@pec.it · Phone +39 0173 530010

We have not appointed a data protection officer (DPO): for any privacy question, write to the addresses above.

2. What data we process, why and for how long

Browsing the website

When you visit the website, our servers automatically record some technical data: IP address, date and time, requested page, referring page, browser and device type. The shop software links the visit to a technical identifier stored in the session cookie. We use this data to run the website, to protect it from abuse (the limits on how often forms and the chat can be used are calculated on an encrypted fingerprint of the IP address, not on the address itself) and for internal statistics in aggregate form.

Legal basis: our legitimate interest in the security and proper functioning of the website (Art. 6(1)(f) GDPR). Retention: for as long as needed for these purposes and no longer than 12 months, unless required to investigate abuse or crimes; the anti-abuse counters are deleted automatically after about 24 hours.

Customer account

You need an account to buy. We ask for your first name, last name, email and password (stored only in encrypted form); title and date of birth are optional. In your account you can see your orders, addresses and personal details and change them whenever you like.

Legal basis: performance of the contract and of the pre-contractual steps you request (Art. 6(1)(b) GDPR). Retention: for as long as you keep the account; if you ask us to delete it, we erase your data except what the law requires us to keep (see the next section).

Orders, experiences and payments

To handle orders and bookings we process your account details, billing and delivery addresses (with phone number and, if any, company and VAT number), the products or experiences you choose, the number of participants, the amounts, the payment method, the messages you send us and the communications about the order.

  • Experiences: the date is agreed with you after the purchase. To arrange it, we give the operator running the experience (for example a winery, farm stay, spa, guide or rental service) your name, contact details, number of participants and any requirements you tell us. The operator processes this data as an independent controller, in order to provide the service.
  • Allergies and intolerances: if you tell us about them for a tasting or an experience, we use them and pass them on to the operator only to adapt the service. They are health data: we process them with your explicit consent (Art. 9(2)(a) GDPR), which you give by telling us and can withdraw at any time, and we keep them only for as long as needed to arrange the experience.
  • Products: for shipping we give the courier the recipient's name, address and phone number. If a product is sold and shipped by another company, we say so on the product page and in the cart, and we pass on to that company the data needed to fulfil the order.
  • Payments: the website does not process payment card data. We accept bank transfer, cheque and cash on delivery: for bank transfers we see the details your bank includes in the transfer; cash on delivery is paid to the courier.
  • Gift Card: if you tell us the name of the person receiving it, we use it only to deliver the card.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with legal, tax and accounting obligations (Art. 6(1)(c) GDPR). Retention: invoices and accounting records for 10 years (Art. 2220 of the Italian Civil Code); other order data for as long as needed to handle warranty, returns and complaints, and no longer than 10 years.

LangheMyFood newsletter and offers

With separate, optional consents you can:

  • subscribe to the newsletter, from the form at the bottom of the pages or when you register: one letter per season with news from the shop, a travel idea and a recipe. Together with your email we keep the date, IP address and page of the subscription, so that we can prove your consent;
  • receive LangheMyFood offers and promotions, using the dedicated box when you register. If you have given us your date of birth, we may send you birthday wishes with a special offer.

This data is used by us only: we do not pass it on to other companies for their own advertising.

Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 130 of the Privacy Code). You can withdraw it at any time with the link in every email, from your account (Personal information) or by writing to us. Retention: until you withdraw your consent.

Requests and contacts

If you email us, call us or use a form on the website (for example "Corporate gifts"), we use the data you give us (name, company, email, phone number, content of the request) to reply and, for corporate requests, to prepare a proposal. Requests sent with the "Corporate gifts" form reach our mailbox and are not stored on the website.

Legal basis: replying to your request and pre-contractual steps (Art. 6(1)(b) GDPR). Retention: for as long as needed to handle the request and then no longer than 24 months, unless it leads to a contract.

Sofia, the chat assistant

Sofia is an automated assistant based on artificial intelligence: she suggests products and experiences based on what you write, and she can make mistakes. For ingredients, allergens and availability, the product page is what counts. This is how we handle your messages:

  • Before sending, the text is cleaned of email addresses (including ones spelled out in words), phone numbers, IBANs, tax codes, dates and references to illnesses or health conditions, which are replaced with placeholders such as "[email rimossa]" (email removed). The cleaning happens in your browser and a second time in the chat service, before the text reaches the model.
  • The cleaned message goes to the service that runs the chat (n8n, on servers of Render Services, Inc., United States) and to the artificial intelligence model that writes the replies, provided by DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., People's Republic of China). The model receives the cleaned text of the conversation and the catalogue information, not your IP address or your account details.
  • The filter removes the most common contact and identification details but cannot recognise everything: do not write your full name, address or other personal information in the chat. For orders and bookings use your account or write to us.
  • The conversation is saved, with a random identifier, in the chat service's database, to keep track of the conversation and improve the replies. A copy stays in your browser for 12 hours, so you find it again if you reload the page.
  • If the service does not respond, a backup assistant that runs on our servers, without external services, answers instead and remembers the details of the conversation for 24 hours.
  • If you type an email address or phone number in the chat, it is not sent: it stays on your device and Sofia asks whether you want to be contacted. Only if you confirm do we save it, with the reason you chose (to be contacted, or to receive the welcome code and news from the shop). The contact is saved in the chat database or, if that is unavailable, sent to our mailbox.

Legal basis: to answer your questions, performance of the service you request by using the chat (Art. 6(1)(b) GDPR); to improve the replies, our legitimate interest (Art. 6(1)(f) GDPR); to contact you, your request (Art. 6(1)(b) GDPR); for the welcome code and news, your consent (Art. 6(1)(a) GDPR). Retention: conversations no longer than 12 months; contacts left in the chat until you withdraw consent or, for requests to be contacted, no longer than 24 months.

3. External resources on some pages

The website's pages use fonts, images and videos hosted on our own servers. However, some technical shop pages (cart, checkout, registration, login, password recovery and contact form) load a font from Google Fonts, a Google service, and the contact form page also loads some graphic images from Shopify's content delivery network. To download them, your browser sends these providers your IP address and the technical details of the request. We are replacing these resources with copies hosted by us.

4. Who we share data with

Data is processed by our authorised staff and by the providers that help us run the service, each only for its own part:

  • Aruba S.p.A. (Italy): hosting of the website and database, email and certified email;
  • Render Services, Inc. (United States): server and database of Sofia's chat service;
  • DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China): Sofia's artificial intelligence model, which receives only the cleaned text of the messages;
  • the consultants and IT providers who develop and maintain the website, and the firm that keeps our accounts.

Aruba, Render and the IT providers process data on our behalf, as processors (Art. 28 GDPR).

We also share the necessary data, as independent controllers, with the operators of the experiences you book, couriers, banks for payments, companies that sell and ship the products shown as sold by them and, where the law requires it, the authorities. We do not sell your data.

5. Transfers outside the European Union

  • United States: Render (chat service) and Google (Google Fonts) participate in the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023.
  • China: there is no adequacy decision for China. This is why DeepSeek receives only the text of the messages, cleaned of contact and identification details, without IP address or account details, and why we ask you not to write personal information in the chat.
  • The images on the contact form page come from Shopify's content delivery network, which may serve them from servers outside the European Union.

6. Cookies and browser storage

The website uses technical cookies and the browser's local storage only for features you ask for: cart, login to your account, cookie choices and the chat with Sofia. We currently use no analytics, profiling or advertising cookies. The full list, with durations, is in the cookie policy, where you can also change your choices. The choices you make in the banner are recorded with the date and an anonymised IP address, so that we can prove your consent.

7. Mandatory data and automated decisions

The data marked as mandatory is needed to create the account, complete the purchase or answer your request: without it we cannot do so. Consents to the newsletter and offers are optional and do not affect your purchase. We do not take decisions based solely on automated processing that produce legal effects concerning you: Sofia's proposals are suggestions, which you are free to follow or not.

8. Your rights

At any time you can ask us to access your data, to correct or erase it, to restrict its processing, to receive it in a commonly used format (portability) and to object to processing based on our legitimate interest. You can withdraw any consent you have given, without affecting processing already carried out (Arts. 7 and 15-22 GDPR). You can change your details from your account; for anything else write to info@langhemyfood.com or to our certified email langhemyfood@pec.it. We reply within one month.

If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.

9. Children

The website is not intended for children under 14 and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.

10. Security

All pages of the website use encrypted connections (HTTPS), passwords are stored only in encrypted form and access to data is limited to the people who need it for their work.

11. Changes to this notice

We may update this notice, for example when we add a service or change a provider. The date at the top shows the latest version; if the changes are significant, we will tell you on the website or by email.