Partner
Press
B2B
Ticket
Sector Professionals
Gourmet’s International Srl organises and runs advanced training seminars, refresher meetings and gastronomy courses, both independently and in collaboration with partners, institutions and universities; it organises events dedicated to the food and wine sector in Italy and abroad, as well as training courses sponsored by the European Social Fund (ESF) In compliance with the provisions of EU Reg. 2016/679 (European General Data Protection Regulation), we process your data in accordance with the principles of lawfulness, transparency, purpose limitation and data minimisation as laid down in Art. 5 GDPR. We hereby provide you with the required information regarding the processing of the personal data provided. This notice is not to be considered valid for other websites that may be reached through links on the websites belonging to the controller’s domain; the controller is in no way responsible for third-party websites. This notice is given pursuant to Art. 13 and 14 of EU Reg. 2016/679 (European General Data Protection Regulation)
«personal data»: any information relating to an identified or identifiable natural person («data subject»).
The IT systems and software procedures responsible for the operation of this website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols. This category of data includes the IP addresses or domain names of the computers and terminals used by users, the URI/URL (Uniform Resource Identifier/Locator) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment.
The optional, explicit and voluntary sending of messages to the contact addresses, as well as the completion and submission of the forms present on the controller’s website, entails the acquisition of the sender’s contact details, necessary in order to reply, as well as of all personal data included in the communications.
Where necessary, specific notices will be published on the pages of the Site in relation to particular services or processing of the Data provided.
The data requested from you will be strictly those necessary to secure your registration for the event or training course
The processing of your Data is intended for:
In order to process the booking, you will be asked for your e-mail address, the hash of the password you choose, and the times and IP addresses of the connections. No personal data relating to the credit cards chosen for payment are processed. This information is necessary in order to authorise the issue of the ticket once payment has been made, to respond to any requests from you, or to produce evidence in the event of a request by institutions (e.g. banks) or of investigations by the authorities. If the purchase is successful, you will also receive the ticket by e-mail. In the event of a request to register as a sector professional, partner or member of the press, the general data collected will be used to send you the accreditation code required to collect the pass. The data collected in this form will be processed by a company duly engaged by us under contract as Data Processor, in its capacity as operator of the reserved area.
The Gourmet’s International Srl website may also incorporate plugins and/or buttons for quick sharing on your favourite social networks (Facebook, Instagram, Telegram, LinkedIn, etc.). By clicking on any plugin and/or button present on our website, your browser connects directly to the server of your social network. The collection and use of information by such third parties (social networks) are governed by their respective privacy policies, to which we invite you to refer
For further information on the cookies used by this website, please see the cookies policy at the following link.
The event organised is public in nature; therefore any personal data that may be collected through photographic images or audio-video recordings will be collected for the prevailing purpose connected with and instrumental to documenting the event held, using for that purpose their dissemination through the most widely used means of communication today, such as the controller’s website and the social networks (Facebook, YouTube, etc.) The images collected will therefore be directed mainly at the environmental setting in which the public event itself takes place, taking care not to film the faces of those present in close-up or head-on, but from angles that limit the recognisability of the subjects and/or from a long distance. It should be noted that, pursuant to Art. 97 of Italian Law 633/1941, “The consent of the person portrayed is not required when the reproduction of the image is justified by their fame or by the public office they hold (...), by scientific, educational or cultural purposes, or when the reproduction is connected with facts, events or ceremonies of public interest or held in public”. Consent will therefore not be requested from the data subject filmed in photographic images or videos taken in places and spaces where public university events are held (conferences, press conferences, workshops, meetings and public outreach activities, initiatives and orientation fairs, etc., also held at non-university locations such as municipal halls, city spaces, etc.). It is indeed more than reasonable to hold that participants in a sporting or social event, or in a scientific congress of national importance, are well aware — if they do not even take satisfaction in it — of the likelihood of being portrayed there, and that such data are processed for the purposes of publicising and promoting the event itself within the scope of the organiser’s activities. It has also been verified that a relevant and appropriate relationship exists between the data subject and the controller, constituted by the purchase of the entrance ticket or by registration for the event and by the data subject’s consequent standing as a participant (cf. Recital 47 GDPR). Where that condition is met, it is possible to invoke, as the legal basis for the processing, the legitimate interest of the operator, which does not require consent from the data subject
Data controller: The data controller is Gourmets International S.r.l., with registered office at via Monte Ivigna 19, 39010 Cermes (BZ), Italy. Mail: info@meranowinefestival.com
The Data Protection Officer (RPD/DPO – DATA PROTECTION OFFICER) pursuant to Art. 37–39 of EU Reg. 2016/679 is Dr. Andrea Repetto. To contact the RPD/DPO: e-mail: dpo@meranowinefestival.com
LEGAL BASIS: legitimate interest, Art. 6(1)(f) and Recital 47: the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that the interests or the fundamental rights and freedoms of the data subject which require the protection of personal data do not override them, taking into account the reasonable expectations of the data subject based on their relationship with the controller. Activities strictly necessary for the operation of the site and for the provision of the browsing service on the platform.
DATA RETENTION PERIOD: for the duration of the browsing session. For browsing, see the cookie policy.
NATURE OF THE PROVISION: except as specified for browsing data (which are necessary in order to allow browsing of the website), the user is free to provide personal data.
LEGAL BASIS: on the basis of the performance of pre-contractual measures taken also at the data subject’s request
DATA RETENTION PERIOD: 5 years for contacts, accreditation requests or ticket purchases for events. For training courses, the data provided will be kept for the entire duration of the course and for the following 10 years for administrative purposes.
NATURE OF THE PROVISION: the provision of data is optional or necessary depending on the specific purpose for which the data are processed. Failure to provide the data marked with the symbol * or the wording (required) will make it impossible to obtain what has been requested or to make use of the controller’s services.
LEGAL BASIS: Art. 6(1)(b) GDPR: the processing is necessary for the performance of a contract to which the data subject is party (e-commerce) or on the basis of the performance of pre-contractual measures taken also at the data subject’s request.
DATA RETENTION PERIOD: until objection, deletion from the web platform, 10 years or a different legal obligation. Art. 2220 of the Italian Civil Code.
NATURE OF THE PROVISION: the provision of data is optional or necessary depending on the specific purpose for which the data are processed. Failure to provide the data marked with the symbol * or the wording (required) will make it impossible to obtain what has been requested or to make use of the controller’s services.
commercial/promotional information activities, newsletters by e-mail to the e-mail address provided at the time of sale, concerning the same type of product and/or service (Soft Spam) as the product/service that was sold – Art. 130(4) of Italian Legislative Decree 196/03 / (Art. 6(1)(f) EU Reg. 2016/679), unless objected to. In order to compare and possibly improve the results of its communications, the Controller uses systems for sending newsletters and promotional communications with reports. Thanks to these reports the Controller is able to know, for example: the number of readers, of openings, of unique “clickers” and of clicks; the devices and operating systems used to read the communication; details of the activity of individual users; details of the e-mails sent, delivered and not delivered, and of those forwarded. All these data are used for the purpose of comparing, and possibly improving, the results of the communications.
LEGAL BASIS: Legitimate interest – Art. 6(1)(f) and Recital 47: the processing is necessary for the purposes of the legitimate interest of the Controller in maintaining contact with its own customers in order to continue the working relationship established, provided that the interests or the fundamental rights and freedoms of the data subject do not override them, and Art. 130(4) of Italian Legislative Decree 196/03
DATA RETENTION PERIOD: until your objection (opt-out) through the “unsubscribe” button or a request sent to the e-mail addresses of the Controllers indicated
LEGAL BASIS: Legitimate interest, Art. 6(1)(f) and Recital 47.
DATA RETENTION PERIOD: The photographic images and the audio and video recordings will be kept in the Controller’s archives, in view of their possible use for the purposes indicated, for a period of five years. Data disseminated on the web and not controllable by the Controller (Facebook, YouTube, Instagram, Twitter, etc.) are excluded.
Where the data subject completes dedicated data collection forms, in specific areas for Direct Marketing purposes: subject to consent and until objection, for the Controller’s direct marketing activities, market research, direct selling, satisfaction surveys, sending of newsletters and of promotional, commercial and advertising material or material concerning events and initiatives, by the Controller through automated means such as e-mail, fax, SMS-type or other messages, as well as by telephone calls through operators, including automated ones, and by paper mail and other information material. In order to compare and possibly improve the results of its communications, the Controller uses systems for sending newsletters and promotional communications with reports. Thanks to these reports the Controller is able to know, for example: the number of readers, of openings, of unique “clickers” and of clicks; the devices and operating systems used to read the communication; details of the activity of individual users; details of the e-mails sent, delivered and not delivered, and of those forwarded. All these data are used for the purpose of comparing, and possibly improving, the results of the communications.
LEGAL BASIS: Consent, Art. 6(1)(a): the data subject has given consent to the processing of their personal data.
DATA RETENTION PERIOD: Until your objection (opt-out/withdrawal of consent)
NATURE OF THE PROVISION: The provision of data for purpose B) is optional and, in its absence, your data will not be processed in pursuit of that purpose; refusal to provide it will not affect the availability of the purposes referred to in point A).
The personal data provided will be shared with parties who will process the data as processors (Art. 28 of EU Reg. 2016/679) and/or as natural persons acting under the authority of the Controller and of the Processor (Art. 29 of EU Reg. 2016/679), for the purposes listed above (e.g. parties providing services for the management of the information system, including e-mail, newsletters, etc. (e.g. Sendinblue), consultants, third parties collaborating with the Controller on direct marketing activities or on training activities, bodies, authorities, etc.). The list of processors is always kept up to date and is available by contacting the Data Controller at the address given above
The personal data provided will be shared with parties who will process the data as processors (Art. 28 of EU Reg. 2016/679) and/or as natural persons acting under the authority of the Controller and of the Processor (Art. 29 of EU Reg. 2016/679), for the purposes listed above (e.g. parties providing services for the management of the information system, including e-mail, newsletters, etc. (e.g. Sendinblue), consultants, third parties collaborating with the Controller on direct marketing activities or on training activities, bodies, authorities, etc.). The list of processors is always kept up to date and is available by contacting the Data Controller at the address given above
The personal data provided will be shared with parties who will process the data as processors (Art. 28 of EU Reg. 2016/679) and/or as natural persons acting under the authority of the Controller and of the Processor (Art. 29 of EU Reg. 2016/679), for the purposes listed above (e.g. parties providing services for the management of the information system, including e-mail, newsletters, etc. (e.g. Sendinblue), consultants, third parties collaborating with the Controller on direct marketing activities or on training activities, bodies, authorities, etc.). The list of processors is always kept up to date and is available by contacting the Data Controller at the address given above
During the Merano WineFestival the notebook keeps track of the tables whose QR code you scan and the wines you open; the stars, notes and categories you give; the producers you star in the digital catalogue («Plan your festival»); and the times of your route.
Everything stays in your phone’s browser storage: we do not receive it and cannot see it. You delete it with «Clear the notebook» or by clearing the site’s data in your browser. When you download or send your notes, this happens on your phone, to whoever you choose.
When they are on, your browser sends us only an anonymous count: a wine opened, a note kept or removed, the stars given, a visit to a producer’s page. We send and keep nothing that identifies you or your phone, and the screens show an order of wines, not numbers. To stop abuse, we keep for one minute a code made from your IP address with a secret key; the address cannot be recovered from that code.
With «Save to my account» your notebook is also kept on our servers, so you can find it on another phone. First we ask you to confirm that you are 18 or over and have read this notice. We keep that confirmation with the notice’s version, the language, the date and the time.
Signing in. You sign in with your e-mail address and a six-digit code we send you by e-mail; there is no password. After the code you can create a passkey (Face ID, a fingerprint or your screen lock). The private key stays on your device and biometric data never leave it; we keep only the public key, the browser you made it in and when you last used it.
The sign-in service (Logto, open-source software) runs on our servers. It keeps your e-mail address, an ID for your account, and when the account was created and last used. For each sign-in it records the date, time, IP address and browser.
Changing the sign-in e-mail. With «Change sign-in e-mail» we send a code to the new address; once you confirm it, you sign in with that address. To the previous address we send a notice with a link that, for 7 days, puts the previous address back, ends the open sessions and removes passkeys created since the change. To protect accounts, a change under way (with both addresses) stays in our database for 10 minutes; the counts behind the limits, with the address only in unreadable form (a hash), for one day; and, for as long as the account exists, the time from which the address can be changed again (7 days after a change, one day after the link) and the time of the link, before which earlier sign-ins no longer count.
With an account the notebook always remembers the producers and wines you open (without one you can stop that with «Remember the producers and wines I open»), and keeps your choices for the site, such as whether to show the profile icon, so they apply on all your devices.
The e-mail with the code is sent for us by Brevo (Sendinblue SAS, France) as our processor. Brevo sees your e-mail address, the message and when it was sent, nothing of the notebook. The sender is no-reply@meranwinefestival.com.
The notebook’s content is kept in the notebook’s database on our servers, linked to your account. It holds the entries described above, the names of wines and producers, the names you give your categories, and your saved routes with the names you choose. Only you can reach it, after signing in.
On your phone the sign-in keys stay: one lasts an hour, the renewal key 90 days and is renewed whenever it is used, until you choose «Sign out». The sign-in service uses a strictly necessary cookie on auth.meranowinefestival.com.
Sharing a day. With «Share» the day becomes readable by anyone with the link: producers, tables, rooms and times, without your name or your e-mail address. It stays that way until you choose «Stop sharing» or delete your account.
B2B appointments from the WH Buyers Club. If you choose «Add to my MWF tasting diary» on whbuyers.club, your B2B appointments (day, times, place, exhibitor and table) come into «Plan» and are kept with your account, together with a shortened code of your buyer profile that holds neither your name nor your e-mail address; the WH Buyers Club receives nothing from the notebook.
With an account you can ask the notebook’s «Assistant» questions. The answers are written by Claude, an artificial intelligence by Anthropic PBC (United States), which processes the data on our behalf as a data processor. To Anthropic we send your question with the conversation so far, the festival’s public information the answer needs (the site’s pages, the catalogue of the producers and their products) and, only when you ask about your notebook, the notebook data the answer needs: wines with stars, notes and categories, producers, «Plan», saved routes and MWF 35 Achievements. We send neither your e-mail address nor your name.
One chat, for 14 days. The chat is kept in the notebook’s database, linked to your account, and is included in «Download my data». It deletes itself, with everything in it, 14 days after its first message; you can delete it sooner with «Delete the chat», and with the account if you delete it. The PDFs you download stay on your device. For the usage limits we count how many questions you ask each day (the count is kept for 15 days); the text of the questions does not go into the server logs.
At Anthropic. Under Anthropic’s commercial terms, the data it receives through its API service is not used to train its models and is kept only for a limited period, for security and against abuse. The transfer to the United States takes place with the safeguards provided by the GDPR (standard contractual clauses). The answers may contain errors: check the details on the festival’s pages.
«Download my data» gives you, in one file, everything the notebook keeps for your account; the sign-in service’s data (your e-mail address, the sign-in log) we give you on request. You can change or delete any entry. «Delete my account» deletes, at once and together, the content, your confirmations and your sign-in account. Of a deleted note only a marker without stars or text remains (which wine, when) while the account exists; a deleted route stays, marked deleted, for 30 days. You also have the rights of access, rectification, erasure, restriction, portability and objection, and you may complain to the Italian data protection authority (Garante per la protezione dei dati personali).
Your account and its content stay until you delete them. The assistant’s chat deletes itself 14 days after its first message.
As for every page of the site, our servers log the IP address, date and time, the address requested and the browser. The site’s statistics (Matomo, without cookies) never receive the notebook’s addresses: sign-in codes, links to shared days and links to wines are removed before a visit is counted.
In the site’s search (the golden «?»), when you press Enter the words you typed are sent to Anthropic PBC (United States): Claude, its artificial intelligence, picks the most fitting entries from the festival’s public index and writes two lines of explanation. Anthropic processes the data on our behalf as a data processor. The words are not linked to an account or a name; if you pick a result directly, we send nothing to Anthropic.
On our server a search with its answer is kept for an hour, so that the same question gets the same answer at once. Against abuse we keep, for 10 minutes, a code made from your IP address with a secret key, from which the address cannot be rebuilt, and we count only how many requests arrive each day. For the data at Anthropic, what is written above for the notebook’s assistant applies.
The controller reserves the right to modify, update, add to or remove parts of this privacy policy at its own discretion and at any time. In order to make such checking easier, the notice will carry the date of its update. Date of update: October 2026
