Our mission is to provide the Client with products and services of the highest quality. This implies, on one hand, the constant search for producers and suppliers of excellent products, the availability of reliable, professional and competent partners to meet the highest expectations of our customers. This requires the use of modern communication and data processing technologies, because without them we would not be able to provide the products and services that distinguish us.

Our company has always placed privacy, confidentiality and discretion as elements that distinguish us. For this reason, the management of the personal and sensitive data of our customers is extremely important to us.

Although ARVI SA offers its products and services in Switzerland and does not address abroad, nor does it offer products or services in the European Union, nor does it actively profile users of the website residing in Euope, in order to ensure transparency and protection for our customers and users of our website, we believe it is important to provide this information in any case prepared taking into account the principles introduced by the General Data Protection Regulation, official regulation (EU) No 2016/679 and better known as the GDPR (hereinafter referred to as the “GDPR”). ARVI SA is subject to Swiss Law, in particular, in addition to the other regulations governing its activities, in required to comply with the Federal Data Protection Act (DPA otherwise known as LPD in Italian).

The DPA is currently being completely revised. Although it is likely to incorporate most of the principles introduced by the GDPR and the current DPA have not yet been defined. For this reason, if you have any doubts about the application of this information, please report to the Federal Data Protection and Information Commissioner.

Your data will them be collected, processed, transmitted and stored in accordance with the applicable regulations.

The purpose of this declaration is to provide you with all information in accordance with the above-mentioned regulations and in particular:

• A. Who we are
• B. What data do we collect and why do we do so?
• C. Consent
• D. What are your rights
• E. Security measures (how we protect your data)
• F. Duration of data retention
• G. Transmission of your data to third parties
• H. Transmission of your data abroad
• I. Cookies, analysis and tracking systems, social media plug-ins and external links
• L. Minors
• M. General provisions
• N. Amendments to this declaration

In case of discrepancies between the original text and its subsequent translations, only the original Italian version is valid.

May 2019 Version

1. When you visit our website, our servers record temporary files. The following technical data is saved automatically with almost every connection to a web server, without any action being require on the part of the visitor, and is stored for a maximum of 12 months, after which it is automatically deleted. This applies in particular to the following data:

• Transmission protocop (ie. http);
• Name of the owner of the IP addresses of which your device is part (usually your internet access provider);
• Time and date of access;
• If applicable, the page from which the access was made, or the keyword search;
• The name and URL address of the data transmitted;
• Search words on the website;
• The status code;
• The operating system of your device;
• Information about your browser (type, language in use and version)

The data described above are necessary in order to establish a connection with our servers and for statistical purposes. This allows us to optimize our online services. In the sense, the company has a legitimate interest in processing this data.

2. If you decide to open a customer account, we need the following data:

• First and last name;
• Postal address;
• Email address;
• Time and date of access;
• Cell phone number and/or landline number, if applicable;
• Username;
• Date of birth (necessary to verify the age of majority necessary for the purchase of alcoholic beverages);
• Password

The abovementioned data are indispensable to allow the opening of an adequately protected customer account (by means of a password), which allows the Client to monitor his orders, requests, etc.

The legal basis for processing is your consent.

3. If you intend to purchase through our online shop, we need the following data in order to finalize the purchasing agreement:

• First and last name;
• Date of birth (necessary to verify the legal age to purchase alcoholic beverages);
• Billing address;
• Delivery address, if different from billing address;
• Contact person, if any, at the delivery address;
• Credit card details.

The above information is collected exclusively for the purpose of concluding the contract and therefore allowing us to sell and deliver the chosen products. The legal basis for processing this data is therefore, the fulfillment of a contract.

In order to be able to provide our services, we need some personal data from our clients and website users.

Some of this data is automatically transmitted by the device with which you visit our website. If you wish to prevent this automatic transmission, you must access the settings of your browser or device and deactivate the transmission of personal data.

1. The previous point indicates the type of data collected and the legal basis necessary for their lawful use.

The consent is to be understood as an expression of free will, specified and aware. It may be given by means of a statement or by an unequivocal affirmative action. If the processing concerns data worthy of special protection, consent must be given explicitly.

In the unlikely event that the Company should collect particularly sensitive personal data, your explicit consent will be required.

Regarding the rest, the request for a service or product implies that the Client agrees to provide the Company with the data necessary for the execution of the order.

Other data are instead intended for our marketing and communication activities, explicitly collected for this purpose. Of course, you may not give your consent for the processing of your data for this purpose and you may always revoke it if you have already given it. In this regard, we note that the Company's policy is to guarantee that adequate information is provided to our clients regarding the availability of new products or special products, respectively information about wine related events and subjects.

Should you have any doubts or questions in regards to this, please contact us at: [email protected]

For any further requests, please refer to point IV below.

ARVI SA, regardless of whether or not the GDPR is applicable, intends to, in any case, guarantee its customers that they will be asked for their personal data:

• Updated, rectified or (if the data is incomplete) integrated;
• Date of birth (necessary to verify the legal age to purchase alcoholic beverages);
• Deleted, if:
• your data is no longer necessary for the purposes for which they were collected or processed;
• you have revoked your consent or you object to processing;
• your data is processed unlawfully or must be deleted in order to comply with a legal obligation;
• Limited processing, if:
• your data is not accurate or is processed unlawfully or you have objected to processing;
• although the Company no longer needs the data for processing purposes, it is necessary for the Company to enforce your rights legally
• Transferred to another data processor (“right to transfer”), if the processing is based on consent and is carried out by automated means

We would like to inform you that, in compliance with fiscal, administrative and customs obligations, the Company is required to retain a part of your personal data; see also the chapter "Duration of data retention", below.

Provided you believe, that despite your requests to ARVI and their responses, there has been a violation of your rights, please contact the Federal Data Protection and Transparency Commissioner, who can be reached at the following address: https://www.edoeb.admin.ch

1. The Company implements, through appropriate technical and organizational measures, the protection of your personal data against unauthorized processing and / or loss of the same. The technical systems are maintained, taking into account - appropriately - constant technological development.

The Company, in order to guarantee, not only the absolute discretion of services offered to its customers, but also a confidential management of personal data; the Company has further strengthened their policies used to process your personal data. You personal data is only accessible to the staff that need it to offer services and products requested by you.

In addition, our employees, as well as the service providers, are required to observe and ensure compliance with applicable data protection regulations.

1. The Company, in order to provide its services, in some cases, it must provide third parties (outsourcing) access to your data. Particularly, in the context of managing the website, sending newsletters, profiling, marketing purposes and above all, to enable payment for the goods or services ordered and delivery of the goods to the address indicated by the Client. In any case, any transmissions shall only take place to the extent that your consent is given (see point III. above) and/or to the extent that this is provided for and/or in accordance with applicable law. In any case, the Company's Partners contractually commit to ensure compliance with the applicable regulations.

2. In particular, in order to be able to provide its services, the Company uses a data center, called moresi.com, which it and it’s servers are based in Switzerland. In addition, ARVI may refer to other companies in the management of IT and other related services.

3. Your data is also transmitted to the transport companies, as this is necessary to fulfill an order; the companies in charge of the transport and all the necessary administrative procedures (import/export, customs clearance, insurance, etc.). See also in this respect the following paragraph (H).

1. In order to deliver the goods to places outside Switzerland, the Company must therefore provide part of the data received from the customer to third parties, in the recipient and/or transit countries (as the case may be). Usually, this is done through the carrier designated by the Company, which will therefore need all the necessary data to be able to carry out customs operations, import and export operations and other formalities required by the applicable legislation.

2. In Europe, the provisions of the GDPR are in force, as well as, the regulations of the individual European States, which therefore guarantees the citizen residing in Europe the protection of his/her personal data in accordance with the aforementioned regulations. In order to ensure the security of citizens’ personal data, the above-mentioned regulations prohibit the transfer of data to third parties when there is not a sufficient degree of security in regards to the handling of personal data. However, data may be transferred to third parties, on the basis of contractual agreements given that adequate security is offered, the provided consent of the person concerned, or the necessity of the transfer for the purposes of contractual measures or other overriding interests.

The Company cooperates with international transport companies that meet the required data protection standards. If the transport companies in charge cannot guarantee adequate protection, ARVI reserves the right to suspend the shipment of the goods, or to request the customer's explicit written authorization, with the assumption of responsibility, for any shipment. ARVI encourages the Client in such a case to consult a trusted lawyer before authorizing the transmission of data in such circumstances.

3. Clients that reside in Switzerland should be aware that the transmission of data in the United States, if not within the framework of the privacy shield program or in the event of appropriate contractual obligations, does not guarantee them adequate protection of personal data. Therefore, we encourage our Clients residing in Switzerland to properly consider whether or not to give their consent to data transmission in the United States.

With regards to Clients residing in the European Union, please note that the European Union considers that the United States does not have an adequate data protection system. Also in this case, the protection of privacy can take place through the adoption of contractual measures or through the privacy shield program.

The data transmitted abroad, as part of the shipment are:

• first and last name of the recipient;
• destination address;
• contact person, telephone number or e-mail address, respectively;
• company name and, if applicable, import license;
• the contents of the consignment (accompanied by the documents required for customs and import-export formalities);
• value of the goods (necessary for customs formalities)

1. Cookies are small packets of data, a sort of identification card, which your device exchanges with our server while browsing our site. The information collected in this way allows in particular, to make navigation more pleasant and effective. Cookies are automatically saved on your device via the browser that you use to surf the net and allow, among other things, to keep track of your choices and settings, so that each access will be made more effective. Each browser allows you to set the management of cookies, and even prevent their transmission. You may, among other things, delete cookies in part or in full, be notified whenever a system asks for the exchange of cookies, etc.. Please be aware that without the use of cookies your browsing experience may be partially impaired and some services may not work partially or totally. Below you can find details of the cookies in use:

You can find instructions on how to manage cookies for the major browsers below:

Google: https://support.google.com/chrome/answer/95647?hl=en

Mozilla: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer

Safari: https://support.apple.com/en-euro/guide/safari/sfri11471/mac

Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies

2. Our website is equipped with tracking systems that allow us to collect the necessary information for management and implementation. Cookies are used here, as well as throughout tracking systems offered by third parties, such as Google Analytics, Google Merchant and AdWords.

3. In order to allow our customers to choose whether and how to stay in contact with our company, communication is available also via the most popular social media applications. In this regard, our site is equipped with systems (called "plug-ins") that allow the user to activate a connection with the selected social media. Only at that moment, and therefore at the explicit request of the customer, the exchange of data necessary for the use of the social media in question takes place.

4. Our website offers links to useful external sites of interest for the provision of our services. The Company does not constantly monitor such sites and therefore you are invited to consult the relevant data protection declarations before you start browsing. Any responsibility for the content or implementation of the Company's data protection regulations is excluded. In any case, unless expressly stated otherwise, the Company does not provide the operators of such sites with any personal data of the Client.

1. The Company provides services and products exclusively to customers of legal age. If the customer is residing outside of Switzerland, the Company reserves the right not to process an order, provided the customer is not of legal age in the country where the goods are to be shipped, in accordance with the relevant national legislation.

2. In the unlikely event that a user of legal age should believe that a minor in his custody has provided us with personal data, please inform us immediately. Our staff will take the appropriate action.

3. The Company is constantly committed to protecting children and minors and therefore encourages the parental authority holders to be constantly vigilant that minors cannot access confidential documents and/or information, which could allow them to circumvent measures to determine the age of majority.

1. We invite the Client to keep their computer system up to date at all times, especially taking care of antivirus systems, in order to prevent data theft and potentially harmful activities. If there are any doubts or questions regarding this information, we invite our Clients to contact us at [email protected]

1. The Company reserves the right to update this statement to ensure adequate protection in accordance with applicable law. For this reason, in particular if there are significant legislative or jurisprudential changes, this declaration may be updated and/or amended.

2. As already mentioned, the total revision of the DPA is currently in progress. ARVI SA therefore reserves the right to adapt this information as soon as the new DPA comes into force, or as soon as there is an international framework that will allow for a better interaction between the Swiss and European data protection law.