Effective from 01/03/2024. Last updated: 25/07/2026
1. Data Controller and contact details
The Data Controller is HOTEL DONATELLA S.R.L., registered office at Via Antonio Gramsci 66, 08020 Posada (NU), Italy, tax code 01582220917.
For questions concerning personal data and to exercise your rights, email privacy@ristorantedonatella.it.
This notice covers www.ristorantedonatella.it, the online booking form, the chatbot, booking-related communications and other contacts initiated through the website.
2. Personal data we process
Depending on the service used, we may process:
- navigation and security data, such as IP address, date and time, requested page, browser and device information, anti-spam results and minimised technical identifiers;
- identity and contact data, including first name, surname, telephone number, email address and preferred language;
- booking data, including date, service, time, number of guests, restaurant or pizzeria preference, requested area, dog, special occasion, source channel, request status and operational communications;
- optional notes and requests entered by the guest;
- health-related data, such as allergies or intolerances, only when voluntarily provided to help us manage the request;
- conversation data from the chatbot or staff communications, including the original text, language, translation and transfer to an operator;
- job application data, including CV and information submitted voluntarily.
3. Purposes, legal bases and whether data is required
| Purpose | Data | Legal basis | Requirement |
|---|---|---|---|
| Receive, check and manage booking requests | Identity, contact and booking details | Pre-contractual steps and performance of the requested service, Art. 6(1)(b) GDPR | Fields marked as required are necessary to submit and manage the request |
| Send confirmations, changes, cancellations and reminders by email or WhatsApp | Contact details, language and booking data | Performance of the requested service, Art. 6(1)(b) GDPR | Necessary for the channel selected or used |
| Manage requests containing allergies, intolerances or other health information | Data voluntarily provided by the guest | Explicit consent, Art. 9(2)(a) GDPR | Optional; refusal does not prevent booking |
| Provide the chatbot and, when needed, transfer the conversation to an operator | Messages, language, context and data supplied in the conversation | Performance of the requested service, Art. 6(1)(b) GDPR | Optional |
| Protect the website and booking system against abuse, duplicate submissions, fraud and unauthorised access; reconstruct relevant operations | Minimised technical data, request identifiers, security and audit events | Our legitimate interest in security and service protection, Art. 6(1)(f) GDPR | Automatic and necessary for secure use |
| Manage job applications | Contact details, CV and professional information | Pre-contractual steps requested by the applicant, Art. 6(1)(b) GDPR, and legal obligations where applicable | Data needed to assess the application must be provided |
| Meet legal, administrative and tax obligations and establish, exercise or defend legal claims | Data strictly necessary for the relevant purpose | Legal obligation, Art. 6(1)(c) GDPR, and establishment, exercise or defence of legal claims | Required where provided by law |
| Measure website use with non-essential analytics | Online identifiers and usage data | Consent, Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code | Optional and revocable through the cookie panel |
| Send review invitations or promotional communications | Name and selected contact channel | Specific consent, Art. 6(1)(a) GDPR and Art. 130 of the Italian Privacy Code, except for the limited statutory email exemption | Optional; refusal does not affect the booking |
4. Allergy and intolerance information
Information about allergies, intolerances or other health conditions is optional and should be supplied only when useful for the booking. It is available only to authorised staff who need it to organise the service. Consent may be withdrawn by emailing privacy@ristorantedonatella.it, without affecting processing already carried out. Refusal or withdrawal does not prevent booking, but we may be unable to take the stated requirement into account.
5. Email and WhatsApp communications
Communications necessary to manage a booking may be sent by email and, when used or requested, through WhatsApp. They may include confirmations, clarification requests, changes, cancellations and service reminders. We use Aruba SMTP infrastructure for email and Meta’s WhatsApp Business services for WhatsApp. Each provider receives only the data needed to deliver the message.
Review invitations and promotional communications are separate from operational messages and are sent only where an appropriate legal basis exists. Consent can be withdrawn, or an objection made, using the instructions in the message or by contacting the Controller.
6. Chatbot and artificial intelligence
The website provides a virtual assistant that may answer questions, collect requests, support takeaway orders where available and transfer conversations to a member of staff. The system may detect the conversation language and retain both the original text and the Italian translation used by staff.
We use OpenAI services to generate and translate replies. Requests are configured not to be stored through the technical option store: false; a copy of the conversation is nevertheless retained in our system for the period stated below. Do not enter health data, documents, credentials or other unnecessary information into the chatbot.
The chatbot may make mistakes. If it cannot handle a request correctly or human intervention is required, the conversation may be transferred to an operator.
7. Automated availability checks
The form displays available times based on date, service, number of guests, kitchen, requested area and configured occupancy rules. After submission, the system may automatically confirm an available solution or refer the request to staff. These operations organise the booking and do not involve profiling or solely automated decisions producing legal or similarly significant effects.
8. Recipients and authorised persons
Data may be accessed, within the limits of each role, by authorised restaurant and hotel personnel, including the maître, dining-room and kitchen managers, administration, management and system administrators.
Data may also be received by processors, sub-processors or independent controllers, depending on the service:
- hosting, maintenance, security and IT support providers;
- Aruba for email transmission;
- Meta Platforms and WhatsApp for WhatsApp Business messages;
- OpenAI for chatbot processing and translation;
- Google for Google Tag Manager and consent-based Google Analytics;
- CookieYes for cookie preference management;
- professional advisers, public authorities and other bodies where required by law.
Personal data is not sold or publicly disclosed.
9. Transfers outside the European Economic Area
Some technology providers may process data outside the European Economic Area. In such cases, transfers are based on an adequacy decision of the European Commission or on safeguards under Articles 44 and following of the GDPR, such as Standard Contractual Clauses, together with any additional measures considered necessary. Further information may be requested from the Controller.
10. Retention periods
| Category | Ordinary retention period |
|---|---|
| Incomplete, rejected or unanswered booking requests | Up to 90 days after closure |
| Bookings, guest profile and operational communications | Up to 24 months after the visit, cancellation or last interaction, unless legal obligations or defence needs require longer retention |
| Allergies, intolerances and other health data | Up to 30 days after the visit, unless consent is withdrawn earlier or retention is necessary for a documented legal claim |
| Chatbot conversations | 30 days; conversations transferred to an operator are retained only as long as necessary and then become subject to the same deadline |
| Technical, anti-spam and security logs | Normally 30 to 90 days, unless an event requires further investigation |
| Operational audit trail | For as long as justified by security, accountability and legal defence, with content minimised |
| Job applications | Up to 12 months after receipt, unless employment begins or earlier deletion is requested |
| Administrative and tax records | For the period required by applicable law |
| Consent and objection records | For the duration of processing and afterwards for as long as necessary to demonstrate proper management |
At the end of the applicable period, data is deleted or anonymised unless longer retention is required by law, an authority or the need to protect a legal right.
11. Security
We adopt technical and organisational measures appropriate to the risk, including role-based access, credential protection, audit trails, anti-spam and anti-abuse controls, rate limiting, duplicate-submission prevention, encryption in transit where available, backups and recovery procedures. Technical identifiers in security records are minimised where possible.
12. Your rights
Where applicable under Articles 15–22 GDPR, you may request access, rectification, erasure, restriction, data portability, object to processing based on legitimate interests and withdraw consent at any time without affecting prior lawful processing.
Requests may be sent to privacy@ristorantedonatella.it. We may ask for information needed to verify the requester’s identity. You may also lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority.
13. Cookies and tracking technologies
For details about cookies, retention and preference controls, please read our Cookie Policy.
14. Updates
This notice may be updated when services, providers or applicable law change. The version published on the website shows the date of the latest update.