Privacy notice
This translation is provided for your convenience. In case of doubt, the Italian version prevails.
This website presents the restaurant: opening hours, menu, directions. It sells nothing online and has no contact or booking forms, no customer accounts, no newsletter and no visitor statistics.
Information under Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”).
1. Who the data controller is
[TO BE FILLED IN: company name]
Registered office: [TO BE FILLED IN: registered office]
VAT number: [TO BE FILLED IN: VAT number]
Email: [TO BE FILLED IN: email for privacy requests]
Restaurant: Via Stazione, 5, 37011 Calmasino di Bardolino (VR), tel. +39 045 723 6769
The site's technical platform (software, private area, configuration) is managed by [TO BE FILLED IN: name of the platform manager, appointed as processor under Art. 28 GDPR].
2. What data we process
Visitors to the site
When you open a page, your browser automatically sends some technical data: IP address, browser and device type, the page requested, date and time. This data is processed by Cloudflare, the provider that hosts the site (see point 4), to deliver the pages and protect them from abuse. The site does not use it to build profiles, contains no analytics tools and loads nothing from other websites: fonts, images and software are all hosted on the site itself.
Only technical reminders are stored in your browser, never data about you: that you have already seen the opening animation of the home page, that you closed a notice or an offer, the language you chose. The site sets no cookies, except the session cookie of the private area after logging in: the details are in the cookie policy.
Users of the private area (owners and managers of the site)
To give access to the private area we process: email, name (optional), password (stored only as an encrypted fingerprint, never in plain text), the link to the authenticator app (stored encrypted), the emergency codes (only as a fingerprint), login sessions and an access log with the email entered, IP address, outcome and date of the attempt. The log covers anyone who tries to log in and is used to block repeated attempts.
Phone, Google Maps and other links
If you tap the phone number, the call takes place outside the site. If you tap “Directions”, Google Maps opens: from then on, Google's privacy policy applies. The site does not embed maps, videos or social media buttons.
3. Why we process it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Showing you the site and protecting it from attacks | technical browsing data | legitimate interest (Art. 6(1)(f) GDPR) in a working, secure website |
| Letting only authorised people into the private area | account data, sessions, access log | performance of the site management agreement (Art. 6(1)(b)) and legitimate interest in security (Art. 6(1)(f)) |
Your consent is not needed because we do not use the data for any other purpose, including advertising or profiling.
4. Who we entrust it to (providers) and transfers outside the EU
The site, the database and the image storage are provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, United States), which processes the data on our behalf as a processor under its data processing agreement (Data Processing Addendum).
Cloudflare runs a worldwide network, so the data may also be processed outside the European Union, in particular in the United States. The transfer is protected by Cloudflare's certification under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and by the standard contractual clauses approved by the Commission (decision 2021/914), included in the agreement. The site's database is preferably located in Western Europe. Cloudflare's privacy policy: cloudflare.com/privacypolicy.
The data is not sold or passed on to anyone else, except for requests from the authorities provided for by law.
5. How long we keep it
- Technical browsing data: for as long as needed to deliver the pages and for Cloudflare's security periods; the site does not store it in its own database.
- Private area access log (email entered, IP, outcome): 90 days, then it is deleted automatically.
- Login sessions: 8 hours at most, then they are deleted.
- Private area accounts: for as long as the account is active; it is deleted when the agreement ends.
- Database backups: deleted data stays in Cloudflare's backups for 7 days at most.
6. Your rights
You can ask at any time to access your data, to have it corrected or erased, to restrict its processing, to object to processing based on legitimate interest and, where applicable, to receive it in a readable format (portability), under Articles 15–22 GDPR.
How: write to the controller's email given in point 1. We reply within one month.
If you think the processing breaks the law, you can lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it) or with the authority of the country where you live or work.
7. Do I have to provide data?
You don't need to provide anything to visit the site: the technical data is sent by your browser. For the private area, email and password are required: without them you can't log in.
8. Images on the site
The photos of dishes and rooms are real photos of the restaurant. No image on the site is generated with artificial intelligence.
9. Credits and licences
- Fonts Libre Caslon (© 2012 The Libre Caslon Text Project Authors) and Source Sans 3 (© 2010-2020 Adobe), hosted on the site under the SIL Open Font License 1.1: licence text.
- Animations with GSAP, ScrollTrigger and SplitText (© GreenSock), under GSAP's free standard licence.
- Logo and graphics: original work for the site.
Last updated: [TO BE FILLED IN: publication date], draft of 7 November 2026.