Privacy Policy

Protecting the privacy of Users of our website is a top priority for us. CANNAVACCIUOLO BISTROT SOCIETA’ A RESPONSABILITA’ LIMITED SIMPLIFICATA, therefore, in accordance with Articles 13 and 14 of the EU Regulation 2016/679 (so-called “GDPR” – General Data Protection Regulation), wishes to inform you about the processing of your personal data operated by means of our website, premising that it is intended for users over 14 years old, in accordance with Art. 8(1) GDPR and Art. 2-quinquies of Legislative Decree. n. 196/2003. By connecting to the site and, if necessary, providing their own data or expressing consent to their processing (when required, for specific purposes), the User declares that they are over the age of 14.

A) PERSONS INVOLVED IN THE PROCESSING OF DATA
The Data Controller is the natural or legal person, public authority, service or other body which, individually or jointly with others, determines the purposes and means of the processing of personal data. This entity is also obliged to identify and adopt appropriate technical and organizational measures to ensure a level of security of personal data processed by it that is adequate to the risk generated by the processing operations carried out.
The Data Controller is CANNAVACCIUOLO BISTROT SOCIETA’ A RESPONSABILITA’ LIMITATA SEMPLIFICATA C.F. 02522260039, headquartered in VIALE MARAZZA 4, 28021 – Borgomanero (NO), Italy, tel.: +39 032285054, ordinary e-mail: [email protected]
The Data Processor is the natural or legal person, public authority, service or other body that processes personal data on behalf of the Data Controller. With reference to the processing operations of personal data of Users operated by means of the site, pursuant to Art. 28 GDPR the Data Controller may appoint one or more Data Processors – for example – from among the suppliers who provide hosting, domain management, IT maintenance, etc., for the benefit of the Data Controller itself.
The updated list of Data Processors can be found at the Data Controller’s office.

(B) THE PERSONAL DATA BEING PROCESSED

By means of our site, the following personal data of Users may be collected and processed by the Owner (as well as any Responsible Parties):

Common personal data of the User, suitable for identification: first and last name, e-mail address, telephone number, tax data (where the issuance of an invoice is required), as well as any additional personal data voluntarily provided by the User.
Special data: data related to health, related to food allergies or intolerances, as well as additional data related to special dietary regimes followed by the User.

(C) PURPOSE, LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF PROCESSING

The purposes for which the data referred to in the preceding paragraph are processed by the Holder are as follows:
1. Handling of reservation requests at the Restaurant;
2. Fulfillment of obligations imposed by current legislation (accounting, tax, etc.);
3. Sending newsletters containing business proposals related to the activities of the Owner;
4. Sending newsletters containing business proposals related to the activities of partner companies of the Owner;
5. Management of site statistics based on non-anonymized data.
The legal bases for personal data processing operations related to the pursuit of the above purposes are those listed below.
For the purposes stated above in no. 1 the legal basis is the performance of a contract to which the User is a party or the performance of pre-contractual measures taken at the User’s request, pursuant to Art. 6 para. 1 lett. b) GDPR; for the same purpose, the legal basis for the processing of any special data is the free, specific, informed and unambiguous consent of the User, pursuant to Art. 6 para. 1 lett. (a) GDPR.
For the purpose stated above in no. 2 the legal basis is the fulfillment of a legal obligation to which the Holder is subject in accordance with the relevant legislation in force, pursuant to Art. 6 par. 1 lett. c) GDPR.
For the purposes set out above in nos. 3, 4 and 5, the legal basis is the free, specific (i.e. relating to a single purpose), informed and unambiguous consent given by the User, pursuant to Art. 6 par. 1(a) GDPR.
For the purpose stated above in no. 1 the User has a contractual obligation to provide the data: without it, the Owner will not be able to enter into the contract with the User and execute it, providing the performance or service requested by the User.
For the purposes stated above in no. 2 the User has a legal obligation to provide the data: without it, the Owner will not be able to fulfill the obligations placed on it by the current legislation and the User will benefit from the performance or service requested.
For the purposes indicated above in nos. 3, 4 and 5, the provision of data is optional: without it, depending on the purpose, the User will not be able to receive newsletters and the Owner will be able to collect statistics based on non-anonymized data.

D) RECIPIENTS

The data processed by means of this site, and exclusively for the purposes indicated above, may be communicated to parties external to the Owner (external collaborators, suppliers, etc.) appointed as Data Processors.

(E) TRANSFERS

No data transfers to third countries will ever be made that do not comply with the conditions set forth in Art. 45 et seq.-particularly Art. 46 – of the GDPR.

(F) DATA RETENTION

Personal data collected or otherwise processed by means of this site will be treated in accordance with the principles set forth in Art. 5 GDPR (lawfulness, fairness, and transparency; purpose limitation; minimization; accuracy; storage limitation; integrity and confidentiality; accountability) in paper or computer-based methods, exclusively for the pursuit of the purposes indicated above.
Personal data will be retained for a period of time not exceeding that which is strictly necessary to achieve the purposes indicated, unless further retention is imposed by current legislation or permitted by the legitimate interest of the Owner.
In particular, for the purpose indicated in no. 1 data will be retained for as long as necessary to execute the contract, as well as – based on the Owner’s legitimate interest in the possible defense in court – until the expiration of the statute of limitations for any actions based on the contract.
For the purpose stated in no. 2 the data will be retained for the time stipulated by current legislation (e.g., accounting records, invoices, letters and telegrams received and sent must be retained for 10 years in accordance with Art. 2220 of the Civil Code).
For the purposes indicated in n.re 3, 4 and 5, the data will be retained until the individual purpose is pursued or, if earlier, the User revokes consent.
Once the retention period has ended, the personal data will be deleted or radically anonymized, so as to prevent any re-identification of the User. The computer systems used to manage the data collected are configured, already at the outset, in such a way as to minimize the use of data when they are not absolutely necessary for the achievement of the purpose from time to time pursued.

(G) HIS RIGHTS

The Data Controller informs the User about the rights recognized to the same by Articles 13, par. 2, letters b) and d), 15, 16, 17, 18, 19 and 21 GDPR and precisely the rights of: access to data (art. 15 GDPR); rectification (art. 16 GDPR), cancellation (art. 17 GDPR), restriction of data processing (art .18 GDPR); data portability (art 20 GDPR); objection to processing (art. 21 GDPR); revocation at any time of one’s consent that may have been given (art. 13 par. II lett. c GDPR).
Requests may be addressed to the Controller, without formalities or, alternatively, using the model provided by the Guarantor for the Protection of Personal Data, by sending a registered letter with return receipt to the Controller at the above addresses or an e-mail to the address: [email protected]
If the processing is based on the User’s consent, the User has the right to revoke it at any time without affecting the lawfulness of the processing carried out prior to the said revocation.
At the same time, if the User believes that with the processing of personal data carried out by this site the current legislation has been violated, he/she has the right to lodge a complaint with the competent Supervisory Authority (in Italy the Guarantor for the Protection of Personal Data).