Privacy & Cookie Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect and Why

We collect the following personal data solely for the purposes stated below:

• Reservations: first name, last name, phone number, e-mail address, date, time, and party size — required to process your reservation and send a confirmation.
• Browsing: technical data (IP address, browser, pages visited) collected automatically by the server for security and diagnostics.
• Third-party functional cookies: if you consent, we load Google Maps to display our location (see Section 4).

We do not collect data for direct marketing, behavioural profiling, or sale to third parties.

3. Legal Basis for Processing

• Performance of a contract (Art. 6.1.b GDPR): processing reservations.
• Legitimate interest (Art. 6.1.f GDPR): site security and server-log diagnostics.
• Consent (Art. 6.1.a GDPR): loading third-party services (Google Maps) via the cookie panel.

4. Cookies and Third-Party Services

We use Klaro as our consent management tool. Cookies are classified as follows:

You can change your preferences at any time by clicking Cookie Settings in the site footer.

5. Data Retention

• Reservation data: retained for 24 months from the reservation date for administrative and fiscal purposes.
• Server access logs: retained for 90 days for security and diagnostics.
• Preference cookie (Klaro): expires after 365 days.

6. Data Transfers

Reservation data is processed on servers located within the European Union. If you consent to Google Maps, Google LLC (headquartered in the USA) may process data in accordance with its own data protection programme and applicable EU-US adequacy decisions.

7. Your Rights (GDPR)

Under Arts. 15–22 GDPR you have the right to:

• Access: obtain a copy of the data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data ("right to be forgotten").
• Restriction: limit how we process your data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, write to info@osteriacancellodeimacci.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

8. Security

The site is served exclusively over HTTPS. We implement appropriate technical and organisational measures (security headers, restricted data access, regular updates) to protect data against unauthorised access, loss or disclosure.

9. Changes

This policy may be updated periodically. The "last updated" date at the top of the page reflects the current version. For material changes we will post a notice on the site.