Privacy notice

Under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”). Last updated: [date]. The Italian version prevails in case of differences.

1. Who is responsible for your data

[Nome e cognome o ragione sociale], [Indirizzo completo], [Codice fiscale / partita IVA], trading as “infine” (the data controller). Email for any privacy request: infinedining@gmail.com.

2. What data we process

• Data you give us in the booking form: name, email, phone (optional), number of guests, location, preferred date, menu of interest and any extra requests.
• Technical data: with your request we store the country your connection comes from (derived from your IP address, which we do not store) and your browser type, to detect automated submissions and abuse. Our hosting provider also logs technical data such as IP addresses for security.
• Email: if you write to us directly, we process the data in your messages.

Please do not include health information (such as allergies) in the form: we will discuss it with you directly by email if needed.

3. Why we process it and on what legal basis

• To answer your request and organise the dinner — steps taken at your request before a contract, and performance of the contract (Art. 6(1)(b) GDPR).
• Website security and preventing spam and abuse — our legitimate interest (Art. 6(1)(f) GDPR).
• Tax and accounting obligations, if your request becomes a booking — legal obligation (Art. 6(1)(c) GDPR).

We do not use your data for marketing or newsletters, we do not sell it, and we do not carry out profiling or automated decisions. Name, email, location and date are needed to reply; all other fields are optional.

4. Who receives your data

• Cloudflare, Inc. (USA) — website hosting and the database of requests.
• Resend (USA) — sending the email notification of a new request.
• Google (Gmail) — our email inbox.

We do not share your data with anyone else, except where required by law (for example our accountant or public authorities). Transfers to the United States rely on the EU-U.S. Data Privacy Framework, for certified providers, and/or the European Commission's Standard Contractual Clauses (Art. 46 GDPR).

5. How long we keep it

• Requests that do not become a booking: up to [24 months] after our last contact, then deleted.
• Bookings: as long as needed for the service and, for tax records, 10 years as required by Italian law (Art. 2220 Civil Code).
• Form draft: while you type, the text is saved only in your browser and deleted once sent; we have no access to it.

6. Cookies

This website uses no profiling, analytics or advertising cookies and loads no third-party content. It only uses your browser's local storage for the form draft (a technical feature you requested). The staff-only area uses a technical login cookie, which does not concern visitors.

7. Your rights

At any time you can ask to access, correct or delete your data, restrict its processing, receive it in a portable format and object to processing based on legitimate interest (Arts. 15–22 GDPR) by writing to infinedining@gmail.com. We reply within one month. You can also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).