Booking privacy notice

Data controller

The data controller is ALF S.r.l.s., Via Hallgarten n. 1, 06012 Città di Castello (PG), VAT no. 04035430547, which runs “Alice e Leopoldo in Limonaia”. Privacy contact: servizi.alf@gmail.com.

What data we collect

When you book we collect your name, email address, phone number, date, time and number of guests.

In the “dietary needs” and notes fields you may mention allergies, intolerances or preferences. When they relate to your health they are special-category data, which we process only with your explicit consent.

We also record the consents you give in the form, with date and time.

Why we use it and on what legal basis

• To manage your booking (confirm or decline it, contact you, prepare your table): steps taken at your request before entering into a contract (art. 6(1)(b) GDPR). Providing this data is necessary; without it we cannot handle your request.
• To take your allergies and intolerances into account: your explicit consent (art. 9(2)(a) GDPR). Optional: you can leave the field empty.
• To send you news and offers, and to ask for your feedback after your visit, by email, WhatsApp or SMS: your consent (art. 6(1)(a) GDPR). Optional and separate from the booking: not consenting has no effect on your booking.
• To tailor those messages, if you gave marketing consent we keep a history of your visits (dates, times, number of guests, on confirmed bookings) and use it to work out how often you come and which days you prefer, for example to remind you of us after a long time. This is profiling based on the same consent (art. 6(1)(a) GDPR): withdraw it and the history is deleted.
• To be able to prove the consents we received: date, time and version of the text you accepted (art. 7(1) GDPR).
• Advertising on Facebook and Instagram: if you accepted marketing cookies, when you book we send Meta Platforms Ireland Limited your email address and phone number in encrypted (hashed) form, so it can recognise you among its users, show you the restaurant's ads and measure their results. Legal basis: your consent to marketing cookies (art. 6(1)(a) GDPR), which you can withdraw at any time from the “Cookie preferences” link at the bottom of the page.

How long we keep it

• Booking data: until 48 hours after the booking time. After that we delete name, email, phone, dietary needs and notes; only date, time and number of guests remain, in anonymous form.
• Marketing contacts (only if you consented): until you withdraw your consent and in any case no longer than 24 months after your last interaction (for example a new booking). After that we delete the contact unless you consent again. We keep only name, email and phone, never allergies or notes.
• If you withdraw your consent we delete your name, phone number and visit history and keep only your email address, so that we do not contact you again.
• The providers listed below keep technical logs of messages for the time set by their own policies. Backups of the website are kept for a limited period and then overwritten.

Who processes your data for us

We do not sell your data. Only authorised restaurant staff access it, to manage your booking.

• Aruba S.p.A. (Italy): the servers hosting the website and our customer-management system.
• Resend, Inc. (United States): sending the emails related to your booking and, if you consented, our promotional messages.
• Twilio, Inc. (United States): sending SMS and WhatsApp messages, when enabled.
• Meta Platforms Ireland Limited (Ireland): advertising and measurement on Facebook and Instagram, only with your consent to marketing cookies. Meta processes this data under its own privacy policy (facebook.com/privacy/policy).

Transfers outside the EU

Resend and Twilio are based in the United States. Transfers take place under the safeguards provided by the GDPR (the EU-US Data Privacy Framework adequacy decision for participating companies, or standard contractual clauses) adopted by each provider. You can ask us for a copy of these safeguards.

Your rights

You can ask us for access, rectification, erasure, restriction, portability of your data and object to processing. You can withdraw any consent at any time (for marketing, via the link in our messages or by writing to servizi.alf@gmail.com) without affecting the processing carried out before. You can also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it). We reply within one month.

We do not use automated decision-making that produces legal effects concerning you. The only profiling we carry out is the one described above (history of your visits), based on your consent.