Privacy notice

1. Data controller

The data controller is Kamel Ben Salem, owner of the business “Ristorante Pizzeria Al Sole”, Vicolo del Sole 5, 39057 Appiano sulla Strada del Vino (BZ), Italy — sole proprietorship, VAT number 03063660215.

Contact details for any matter concerning the processing of personal data: telephone +39 0471 342550, email kamelbensalem19@yahoo.it.

The controller is not required to appoint a Data Protection Officer under Article 37 GDPR, as none of the conditions set out there apply; no DPO has therefore been designated.

2. Subject matter and scope

This notice covers the Al Sole website, booking requests and gift voucher purchases. Voucher purchases involve your name, email, amount, optional personal message, and records of the order, payment and voucher use. These details are used to process the purchase, issue and email the voucher, record the remaining balance and provide support. Payment takes place on a page hosted by Stripe; this website does not receive your full card number. Vouchers are emailed through Google Apps Script and Gmail. See Stripe’s privacy notice at https://stripe.com/privacy.

This notice does not apply to third-party sites, platforms or social networks reachable through links published on these pages: only the notices of their respective controllers apply to those services.

3. Categories of data, purposes, legal bases and retention

3.1 Navigation data

The computer systems and software procedures used to operate this site acquire, in the course of their normal operation, certain data whose transmission is inherent in the use of internet communication protocols: in particular IP address, date and time of the request, URL of the requested resource, response method and status, browser type and operating system. These data are recorded in the hosting provider's log files.

• Purpose: delivery of the pages requested, IT security, prevention and detection of abuse or intrusion attempts, fault diagnosis.
• Legal basis: Article 6(1)(b) GDPR for delivering the requested page and Article 6(1)(f) GDPR — the controller's legitimate interest in the security and sound administration of its systems.
• Retention: logs are kept only as long as necessary for the purposes stated, in line with the hosting provider's configuration, and are then deleted or anonymised, unless they must be kept longer for the investigation of offences at the request of the authorities.

3.2 Map display

The pages showing the location of the restaurant embed a map provided by Google Maps. Loading the page sends a request to Google's servers, which receive the visitor's IP address and technical connection data and may set their own cookies or similar technologies, under Google's privacy policy (policies.google.com/privacy).

• Purpose: to show the location of the restaurant and make it easier to reach.
• Legal basis: Article 6(1)(f) GDPR — the controller's legitimate interest in making the location immediately recognisable. Data subjects may object under Article 21 GDPR and may use the external link or the address details alone instead of the map.
• Third-party recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as an independent controller for the processing carried out through Google Maps. The transfer to the United States is covered by the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework.

The same pages contain a link that opens Google Maps in a new window for route planning: in that case the processing takes place entirely on the destination platform, outside this site (policies.google.com/privacy).

3.3 Fonts

The typefaces used on the site (Cormorant Garamond and Lora) come from the Google Fonts library and are requested from Google's servers. Viewing the pages therefore sends a request to Google, which thereby receives the visitor's IP address and the technical data needed to transmit the files; no cookies are set.

• Purpose: correct typographic rendering of the pages.
• Legal basis: Article 6(1)(f) GDPR — the controller's legitimate interest in presenting its content in a consistent and legible way.
• Third-party recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, under its own privacy notice (policies.google.com/privacy).

The controller reserves the right to host the font files on its own domain, thereby eliminating any transfer of data to third parties: this notice will be updated accordingly.

3.4 Telephone and online booking requests

To handle a booking request, the restaurant processes the guest's full name, telephone number, email address, date, time, number of guests and any optional notes. The purpose is to check availability, contact the guest and organise the service; the legal basis is Article 6(1)(b) GDPR. An online request does not itself confirm a table.

Requests are stored on Cloudflare and emailed to the restaurant through Google Apps Script and Gmail. When the restaurant confirms or declines, the guest receives a reply by email. For processing by Google, see its privacy notice. Data stored by the restaurant is deleted when it is no longer needed to manage the booking, subject to legal obligations.

Do not enter health information, allergies or intolerances in the notes field. Please telephone the restaurant directly for these matters.

4. Cookies and other storage technologies

The website does not use traffic analytics or profiling tools. The protected administration area uses a technical session cookie to keep administrators signed in. Google Maps and the Stripe payment page may use their own cookies and technologies under their respective privacy notices.

The exception is any cookie Google may set as a result of the map described in section 3.2 loading. These can be managed and removed at any time through the browser settings.

5. Nature of the provision of data

Providing navigation data is necessary for the technical use of the website. The processing described in section 3.2 is optional. Fields marked as required in the form are necessary to handle the booking request; guests may book by telephone instead.

6. Recipients and categories of recipients

Technical providers process the information needed for their services: Cloudflare for hosting and storage, Google Apps Script and Gmail for emails, and Stripe for voucher payments. Disclosures required by law remain applicable.

Personal data is never disseminated, transferred, sold or disclosed to third parties for marketing purposes.

7. Transfers to third countries

The controller favours providers that process data within the European Economic Area. As regards Google Maps and Google Fonts, loading the map and requesting the font files involves a transfer of data to the United States: that transfer is covered by the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, to which Google LLC adheres, and further by the standard contractual clauses adopted by the European Commission. A copy of the applicable safeguards can be requested using the contact details in section 1.

8. Automated decision-making and profiling

No automated decision-making or profiling within the meaning of Article 22 GDPR is carried out.

9. Children's data

The site is not specifically aimed at minors and does not knowingly collect personal data from minors. If a parent or guardian believes that a minor's data has been processed, they may report it using the contact details in section 1: the data will be deleted without delay.

10. Rights of the data subject

Under the conditions set out in Articles 15 et seq. GDPR, the data subject has the right to obtain access to their personal data and information about the processing (Art. 15), rectification of inaccurate data and completion of incomplete data (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to processing based on legitimate interest (Art. 21), and to withdraw consent at any time (Art. 7(3)), without affecting the lawfulness of processing carried out on the basis of consent before withdrawal.

Requests may be made in any form using the contact details in section 1. The controller replies without undue delay and in any case within one month of receipt, a period that may be extended by two months in particularly complex cases, with notice to the data subject. Exercising these rights is free of charge, except in the case of manifestly unfounded or excessive requests.

Anyone who believes the processing infringes applicable law has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome (garanteprivacy.it), or to bring proceedings before the competent court.

11. Changes to this notice

The controller reserves the right to update this notice following changes in the law or the introduction of new tools on the site. The version in force is the one published on this page, with its last-updated date. Where processing based on consent changes substantially, consent will be sought again.