Privacy Policy
PRIVACY POLICY
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)
1. Data Controller
Ristorante Aromatico – VAT no. 04213230131, registered office at Viale Vittorio Veneto 22, 23832 Margno (LC), Italy, phone +39 351 874 3671 (hereinafter, the “Data Controller”).
For any inquiries, please write to info@ristorante-aromatico.it.
Website: ristorante-aromatico.it
2. Categories of Personal Data Processed
| Type | Examples | Source |
|---|---|---|
| Browsing data | IP addresses, logs, cookie identifiers | Website usage |
| Data voluntarily provided | Name, surname, email, phone number, messages, any allergies/intolerances | “Contact”, “Book a Table”, “Gift an Aromatic Experience” forms on ristorante-aromatico.it |
| Payment data | Last 4 digits of card, amount, transaction ID | E-commerce/gift voucher platform |
| Marketing data | Preferences, newsletter opens | Subscription/consent forms |
3. Purposes and Legal Bases
| Purpose | Legal Basis |
|---|---|
| Website operation and security | Legitimate interest of the Data Controller (Art. 6(1)(f) GDPR) |
| Managing contact or booking requests | Execution of pre-contractual measures (Art. 6(1)(b) GDPR) |
| Providing gift voucher services | Execution of a contract (Art. 6(1)(b) GDPR) |
| Managing food allergies/intolerances | Explicit consent (Art. 9(2)(a) GDPR – special categories of data) |
| Sending newsletters and marketing communications | Consent of the data subject (Art. 6(1)(a) GDPR) |
| Fulfilling legal obligations (e.g., invoicing) | Legal obligation (Art. 6(1)(c) GDPR) |
4. Methods of Processing
Data are processed using both electronic and paper-based tools, with appropriate technical and organizational measures in place (Art. 32 GDPR).
5. Retention Period
| Data | Retention Period |
|---|---|
| Contacts and Reservations | 24 months from the last interaction |
| Contract/Billing Data | 10 years (civil and tax obligation) |
| Cookie | as indicated in the Cookie Policy |
6. Data Provision
The provision of data marked as mandatory in the forms is necessary to provide the requested service; failure to provide such data will prevent the booking or response to the request.
7. Recipients and Categories of Recipients
- Hosting and IT maintenance providers with servers located in the EU;
- Accounting and tax consultants;
- Public authorities in compliance with legal obligations
- Third-party providers (e.g., Google LLC, Meta Platforms Inc.) for analytics services and social plugins.
8. Third-party providers (e.g., Google LLC, Meta Platforms Inc.) for analytics services and social plugins.
Some providers (Google, Meta) may process data in the USA. The transfer is carried out based on Standard Contractual Clauses and/or the EU–US Data Privacy Framework, where applicable.
9. Data Subject Rights
You may, at any time, exercise your rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, as well as lodge a complaint with the Supervisory Authority (www.garanteprivacy.it).
10. Methods for Exercising Your Rights
Send an email to info@ristorante-aromatico.it, a certified PEC to ristorantearomatico@pec.it, or a letter to the registered office indicated in §1. The Data Controller will respond within 30 days.
11. Cookie Policy
The website uses:
- Technical cookies necessary for operation;
- Third-party analytics cookies with anonymized IP addresses (treated as technical cookies);
- Third-party profiling/marketing cookies (activated only with prior consent).
- A banner appears upon first access to manage preferences. Further details are available in the dedicated Cookie Policy.
12. Updates to this Policy
This policy may be subject to revisions. Version 1.0 – last updated on June 12, 2025.