Privacy and cookie policy

Data controller

Ristorante Caffè Cavour di Fabrizio Nacci, Corso C. Benso di Cavour 5, 72017 Ostuni (BR), Italy. VAT 01829200748. Email: fabrizionacci@gmail.com, phone: +39 0831 301709.

What data we collect

Booking requests. When you fill in the booking form you give us your name, phone number, email, date, time, number of guests and any notes. With each request we record the IP address it was sent from, only to prevent abuse of the form.

Allergies and intolerances. If you tell us about them (in the notes or in person), this is health data: we use it only to prepare your meal and, if you wish, to remember it on your next visits.

Phone bookings. If you book by phone, we record the same details in our booking system.

Browsing data. Like any web server, the server hosting the site logs IP addresses and requested pages for technical and security reasons.

Why we use it and on what legal basis

We use booking details to answer your request, confirm or cancel your table and contact you if needed (Art. 6(1)(b) GDPR: steps taken at your request). You will only receive emails about your booking: we do not send advertising or newsletters.

We keep a history of bookings to recognise returning guests and plan the service (Art. 6(1)(f) GDPR: legitimate interest). You can object at any time.

Information about allergies and intolerances is processed on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give by telling us and can withdraw at any time by asking us to delete it.

Browsing data and IP addresses are used to run and protect the site, including against automated form submissions (Art. 6(1)(f) GDPR).

How long we keep it

Booking data and customer records are kept for up to 24 months after your last booking and are then deleted automatically by the booking system. The IP address stored with website requests is deleted after 90 days. Server logs are kept by the hosting provider for the period stated in its own policy.

Who sees your data

Your data is handled by the owner and the restaurant staff who manage bookings; the technician who looks after the website may access it only for support and maintenance. The website and booking system are hosted by Host.it (Italy), acting as data processor.

New-booking notifications and replies to our emails reach the restaurant’s Gmail mailbox, a Google service, which may process data outside the European Union with the safeguards required by the GDPR (EU-US Data Privacy Framework and standard contractual clauses), under Google’s privacy policy.

Booking data is never sold, published or used for advertising.

Cookies

The site uses Google Analytics 4 (Google Ireland Limited, with possible transfer of data to the United States) for visit statistics: pages viewed, origin, device and clicks on Book, Phone and email. The tool is activated only if you accept in the banner; if you decline, it is not loaded and no Analytics cookies are set. Your choice is kept for 12 months and can be changed at any time from “Cookie preferences” at the bottom of the page. The cookies are _ga and _ga_* (maximum 2 years); personalised advertising and Google signals are turned off. Legal basis: your consent (art. 6(1)(a) GDPR). More information: Google’s privacy policy.

The website sets no profiling cookies of its own. If you choose “Remember my choice” on the map, your browser stores only that preference (browser local storage), which you can delete at any time in your browser settings.

The staff-only area (booking system) uses a single technical session cookie, needed to log in, which is deleted when the browser is closed.

The Location page can show a Google Maps map, which is loaded only if the visitor presses “Show the map”: before that click the site does not contact Google. Once shown, the map is loaded from Google’s servers, which receive the visitor’s IP address and may set their own cookies, including transfers of data to the United States, under Google’s privacy policy.

Your rights

You can ask at any time to access, correct or delete your data, restrict or object to its processing, or receive a copy of it (Arts. 15-22 GDPR) by writing to fabrizionacci@gmail.com. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).