Privacy notice

1. Data controller

The data controller is Kamel Ben Salem, owner of the business “Ristorante Pizzeria Al Sole”, Vicolo del Sole 5, 39057 Appiano sulla Strada del Vino (BZ), Italy — sole proprietorship, VAT number 03063660215.

Contact details for any matter concerning the processing of personal data: telephone +39 0471 342550, email kamelbensalem19@yahoo.it.

The controller is not required to appoint a Data Protection Officer under Article 37 GDPR, as none of the conditions set out there apply; no DPO has therefore been designated.

2. Subject matter and scope

This notice describes the processing of personal data through this website, which presents the restaurant and allows visitors to submit online booking requests. The website has no user registration and does not accept online purchases or payments.

This notice does not apply to third-party sites, platforms or social networks reachable through links published on these pages: only the notices of their respective controllers apply to those services.

3. Categories of data, purposes, legal bases and retention

3.1 Navigation data

The computer systems and software procedures used to operate this site acquire, in the course of their normal operation, certain data whose transmission is inherent in the use of internet communication protocols: in particular IP address, date and time of the request, URL of the requested resource, response method and status, browser type and operating system. These data are recorded in the hosting provider's log files.

• Purpose: delivery of the pages requested, IT security, prevention and detection of abuse or intrusion attempts, fault diagnosis.
• Legal basis: Article 6(1)(b) GDPR for delivering the requested page and Article 6(1)(f) GDPR — the controller's legitimate interest in the security and sound administration of its systems.
• Retention: logs are kept only as long as necessary for the purposes stated, in line with the hosting provider's configuration, and are then deleted or anonymised, unless they must be kept longer for the investigation of offences at the request of the authorities.

3.2 Map display

The pages showing the location of the restaurant embed a map provided by Google Maps. Loading the page sends a request to Google's servers, which receive the visitor's IP address and technical connection data and may set their own cookies or similar technologies, under Google's privacy policy (policies.google.com/privacy).

• Purpose: to show the location of the restaurant and make it easier to reach.
• Legal basis: Article 6(1)(f) GDPR — the controller's legitimate interest in making the location immediately recognisable. Data subjects may object under Article 21 GDPR and may use the external link or the address details alone instead of the map.
• Third-party recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as an independent controller for the processing carried out through Google Maps. The transfer to the United States is covered by the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework.

The same pages contain a link that opens Google Maps in a new window for route planning: in that case the processing takes place entirely on the destination platform, outside this site (policies.google.com/privacy).

3.3 Fonts

The typefaces used on the site (Cormorant Garamond and Lora) come from the Google Fonts library and are requested from Google's servers. Viewing the pages therefore sends a request to Google, which thereby receives the visitor's IP address and the technical data needed to transmit the files; no cookies are set.

• Purpose: correct typographic rendering of the pages.
• Legal basis: Article 6(1)(f) GDPR — the controller's legitimate interest in presenting its content in a consistent and legible way.
• Third-party recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, under its own privacy notice (policies.google.com/privacy).

The controller reserves the right to host the font files on its own domain, thereby eliminating any transfer of data to third parties: this notice will be updated accordingly.

3.4 Telephone and online booking requests

To handle a booking request, the restaurant processes the guest's full name, telephone number, email address, date, time, number of guests and any optional notes. The purpose is to check availability, contact the guest and organise the service; the legal basis is Article 6(1)(b) GDPR. An online request does not itself confirm a table.

The form is transmitted through FormSubmit and delivered to the email inbox used to manage booking requests. FormSubmit states that submissions are archived for 30 days; see the service's privacy notice. Data stored by the restaurant is deleted when it is no longer needed to manage the booking, subject to legal obligations.

Do not enter health information, allergies or intolerances in the notes field. Please telephone the restaurant directly for these matters.

4. Cookies and other storage technologies

The site sets no cookies of any kind — neither technical, analytical nor profiling — uses no tracking pixels or other identifiers on the user's device and performs no fingerprinting. No statistics or traffic-measurement tools are used. As there are no storage technologies requiring consent under Article 122 of the Privacy Code, no consent banner is shown.

The exception is any cookie Google may set as a result of the map described in section 3.2 loading. These can be managed and removed at any time through the browser settings.

5. Nature of the provision of data

Providing navigation data is necessary for the technical use of the website. The processing described in section 3.2 is optional. Fields marked as required in the form are necessary to handle the booking request; guests may book by telephone instead.

6. Recipients and categories of recipients

Data may be processed by the technical providers needed for hosting, form delivery and email delivery, only to the extent required to provide their respective services. Data may also be disclosed to the competent authorities to comply with legal obligations or investigate offences.

Personal data is never disseminated, transferred, sold or disclosed to third parties for marketing purposes.

7. Transfers to third countries

The controller favours providers that process data within the European Economic Area. As regards Google Maps and Google Fonts, loading the map and requesting the font files involves a transfer of data to the United States: that transfer is covered by the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, to which Google LLC adheres, and further by the standard contractual clauses adopted by the European Commission. A copy of the applicable safeguards can be requested using the contact details in section 1.

8. Automated decision-making and profiling

No automated decision-making or profiling within the meaning of Article 22 GDPR is carried out.

9. Children's data

The site is not specifically aimed at minors and does not knowingly collect personal data from minors. If a parent or guardian believes that a minor's data has been processed, they may report it using the contact details in section 1: the data will be deleted without delay.

10. Rights of the data subject

Under the conditions set out in Articles 15 et seq. GDPR, the data subject has the right to obtain access to their personal data and information about the processing (Art. 15), rectification of inaccurate data and completion of incomplete data (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to processing based on legitimate interest (Art. 21), and to withdraw consent at any time (Art. 7(3)), without affecting the lawfulness of processing carried out on the basis of consent before withdrawal.

Requests may be made in any form using the contact details in section 1. The controller replies without undue delay and in any case within one month of receipt, a period that may be extended by two months in particularly complex cases, with notice to the data subject. Exercising these rights is free of charge, except in the case of manifestly unfounded or excessive requests.

Anyone who believes the processing infringes applicable law has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome (garanteprivacy.it), or to bring proceedings before the competent court.

11. Changes to this notice

The controller reserves the right to update this notice following changes in the law or the introduction of new tools on the site. The version in force is the one published on this page, with its last-updated date. Where processing based on consent changes substantially, consent will be sought again.