Privacy notice

This page explains what personal data we collect through this website, why, who we entrust it to and what rights you have. It is the information required by Article 13 of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

Which law applies

The restaurant is based in Italy and processes the data collected through the website as part of its business, so the GDPR, which applies throughout the European Union, and Italian data protection law (the Personal Data Protection Code, Legislative Decree 196/2003, as amended by Legislative Decree 101/2018) apply. They apply even if you connect from another country (Article 3(1) GDPR).

Who processes your data

The controller is Via di Guinceri S.r.l., registered office Via di Guinceri 6, 57014 Collesalvetti (LI), VAT no. and tax code 01822940506, REA LI-141709, share capital €10,000. For any question about your data you can write to guinceripervoi@gmail.com or to our PEC (certified email) address ristoranteviadiguinceri@pec.it.

In short: what we keep and for how long

• Booking request: confidential data is deleted two days after the date of the booking.
• Booking with a deposit: allergies and notes are deleted the day after the meal; payment data is kept for 10 years, as the law requires.
• Gift voucher and shop: payment and order data is kept for 10 years, as the law requires.
• Emails: 30 days with the service that sends them; at most 12 months in the restaurant’s mailbox.

Booking requests

When you fill in the booking form we collect your name and surname, phone number, email address, number of guests, date, service and time, the tasting menu if you choose one, whether you have any allergies and which ones, and anything you write in the notes.

• Why: to reply to your request, confirm the booking and contact you if needed. This is necessary to provide the service you ask for (Article 6(1)(b) GDPR): without this data we cannot make the booking.
• How: the website saves the request in a protected archive, with name, contact details, allergies and notes encrypted, so that staff can see it on their page. It also sends it by email to the restaurant’s mailbox, with the data and notes: the email says only that there are allergies, and they can be read on the staff page. It sends you a receipt with a summary (without the notes and allergies). The emails are sent through Resend, which keeps a copy for 30 days.
• How long: the encrypted data in the archive is deleted two days after the date of the booking: only the day, time, number of people and status remain, without your name. Emails in the restaurant’s mailbox are kept for at most 12 months.

Bookings with a deposit

Some menus are booked by paying a deposit. As well as the request data, the payment goes through Stripe: your card details are collected directly by Stripe and we never see them.

• Why: to take the deposit, deduct it from the bill and refund it when due. This is necessary to provide the service you ask for (Article 6(1)(b) GDPR); accounting records are a legal obligation (Article 6(1)(c)).
• How: name, email, telephone, date, time, number of people and menu stay on the payment, with Stripe. Allergies and notes are stored there only in encrypted form, and are deleted the day after the meal.
• How long: payment data is kept for 10 years, as the law requires for accounting documents (Article 2220 of the Italian Civil Code).

Gift vouchers

When you buy a voucher we collect your first name, surname, email and telephone, and whatever you choose to write on it: who it is for, the signature and the message. Payment goes through Stripe. When the voucher is used, we record when, how much and which of the restaurant’s phones did it.

• Why: to issue the voucher, send it to you, recognise it at the restaurant, keep track of what is left and handle any refund (Article 6(1)(b) GDPR); accounting records are a legal obligation (Article 6(1)(c)).
• How long: the data stays on the payment, with Stripe, for 10 years (Article 2220 of the Italian Civil Code).
• If you were given a voucher: your name and the message were given to us by the person who bought it, and we use them only for the voucher: getting the gift to the person it is meant for is our legitimate interest (Article 6(1)(f)). If you don’t want them kept, write to us: you have the same rights as everyone else (Article 14 GDPR).

Shop orders

When you order from the shop we collect your name, email, telephone, the products and, if you ask for delivery, your address. With wine we ask you to confirm that you are of legal age, and on collection we check an identity document without copying it: we record only that it was checked. On the order we also write the tracking number and the seal numbers of the bottles, which are needed for returns.

• Why: to prepare, ship or hand over your order and to handle cancellation and refunds (Article 6(1)(b) GDPR), and to comply with the rules on selling alcohol and with accounting obligations (Article 6(1)(c)).
• How long: the data stays on the payment, with Stripe, for 10 years (Article 2220 of the Italian Civil Code).

Allergies and intolerances

The form asks whether you have any allergies or intolerances: you can answer no and tell us in person at the restaurant. This is data concerning health, which the law protects in a special way (Article 9 GDPR). If you answer yes, we ask you to describe them and to give us your explicit consent, by ticking a dedicated box, to use them only to prepare your meal safely (Article 9(2)(a) GDPR). You can withdraw it at any time by writing to guinceripervoi@gmail.com.

We use them only for that booking. They are deleted from the archive two days after the date, and from the deposit payment the day after the meal. They are not in the emails.

If you write to us or call us

If you contact us by email or phone, we use the data you give us (your address or number and what you tell us) only to reply to you. If you ask us for a booking or for information about visiting us, we do so to respond to your request before providing a service (Article 6(1)(b) GDPR); for other questions, on the basis of our legitimate interest in replying to you (Article 6(1)(f) GDPR).

Browsing the website

• Statistics: we count visits with Vercel Web Analytics, which uses no cookies and does not record your IP address: it recognises a visit by a code that is deleted after 24 hours, and shows us only overall figures (pages viewed, where visitors come from, type of device).
• Technical logs: like any website, for security and operational reasons the server records some data about requests, such as the IP address. The booking form also uses the IP address and the email address you enter to stop automated submissions and abuse: it keeps them in memory for 10 minutes. Protecting the website is our legitimate interest (Article 6(1)(f) GDPR).
• Images: the website’s photos come from Sanity’s service, which receives your device’s IP address in order to send them to you. Showing you the website is our legitimate interest (Article 6(1)(f) GDPR).
• Map: the Google map in the “Location” panel loads only if you open it; from then on Google processes your data under its own privacy policy. We explain this in the cookie policy.

Who we entrust the data to

Your data is not sold or used for advertising. It is processed on our behalf by:

• the restaurant staff responsible for bookings;
• Aruba S.p.A., of Ponte San Pietro (BG), Italy, which manages the email for the restaurant’s domain;
• Plus Five Five, Inc. (Resend), of San Francisco, which sends the website’s emails from its infrastructure in Ireland. It is based in the United States, so the data may be transferred there: the transfer takes place under the EU-U.S. Data Privacy Framework, under which it is certified, and the European Commission’s standard contractual clauses included in its data processing agreement;
• Vercel Inc., which hosts the website and provides its statistics. It is based in the United States: the transfer takes place under the EU-U.S. Data Privacy Framework, under which it states it is certified, or the European Commission’s standard contractual clauses.
• Stripe Payments Europe, Limited, in Ireland, which handles payments. It may transfer data to other companies in its group, including in the United States, with the safeguards provided by the GDPR (Chapter V). For anti-fraud checks and anti-money-laundering obligations Stripe decides on its own how to process the data, as an independent controller, under its own privacy policy;
• Sanity AS, in Norway, in the European Economic Area, which hosts the website’s content and the archive of requests. It relies on Google Cloud, in Belgium and the United States;
• the courier delivering your order, if you ask for delivery: it receives your name, address and telephone.

If you ask for the private room, staff may also write to you on WhatsApp, at the number you gave us. In that case WhatsApp Ireland Ltd. (Meta group) processes the message data under its own privacy policy, including in the United States.

Your rights

You can ask us at any time to access your data, to correct it, to erase it, to restrict its use or to receive it in a readable format, and you can object to its processing (Articles 15–22 GDPR). On grounds relating to your particular situation, you can also object at any time to processing based on our legitimate interest (Article 21 GDPR): we will then stop, unless there are compelling legitimate grounds that override your interests or we need the data to establish, exercise or defend legal claims. If you have given your consent, you can withdraw it whenever you like, without affecting anything done before. Just write to guinceripervoi@gmail.com. We do not take automated decisions or carry out profiling (Article 22 GDPR).

If you believe your data is not being processed properly, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the data protection authority of the EU country where you live or work (Article 77 GDPR).

This is a translation of the Italian text; in case of discrepancy, the Italian version prevails.