Privacy Policy

Data controller

The data controller is Gemar S.r.l. (VAT no. 09865100961), with registered office at Via Pellegrino Tibaldi 7, 20017 Rho (MI), Italy, which operates the Il Conte restaurant at Via Giacomo Leopardi 8, Pregnana Milanese (MI).

To exercise your rights or obtain information about the processing you can contact the controller at antonio@ilconteristorante.it or on +39 340 079 7655.

Types of data processed

• Browsing data: the IT systems and software used to run the website acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet protocols (IP address, browser and device type, date and time of the request, pages visited). This is technical data used to keep the website working and secure.
• Data provided for a reservation: when you book through the Locario form embedded on the Reservations page you provide your first name, last name, phone number, email address, party size, date and time, and any notes you enter (for example dietary needs or special occasions).
• Contact data: if you email or call us, we process the data you choose to share in order to respond to your request.
• Analytics and marketing data: if you give consent via the cookie banner, pseudonymous data about site usage (Google Analytics 4) and data for campaign measurement and remarketing (Google Ads) are collected. See the Cookie Policy for details.

Purposes and legal bases

• Managing reservations and contact requests — legal basis: performance of pre-contractual measures and of the service requested by the data subject (Art. 6(1)(b) GDPR).
• Compliance with legal obligations in tax, accounting and administrative matters — legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Operation and security of the website preventing abuse, diagnosing faults, defending legal claims — legal basis: the controller's legitimate interest (Art. 6(1)(f) GDPR).
• Aggregated website usage statistics — legal basis: the data subject's consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time.
• Marketing and remarketing via Google Ads — legal basis: the data subject's consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time.

Whether providing data is mandatory

Providing browsing data is necessary to use the website. Providing data for a reservation or a contact request is optional, but refusing makes it impossible to handle the reservation or answer the request. Providing data for analytics and marketing purposes is entirely optional and subject to consent: refusing does not affect your ability to browse the website.

How data is processed

Data is processed by electronic means, for the time strictly necessary to achieve the purposes described, and with technical and organisational measures appropriate to ensure its security and confidentiality, so as to reduce the risks of destruction, loss, unauthorised access or unlawful processing.

Recipients of the data

Data may be processed by the controller's authorised staff and disclosed to third parties that carry out activities on the controller's behalf, appointed as data processors under Art. 28 GDPR, or that act as independent controllers. In particular:

• Locario — provider of the online booking system embedded in the website (data processor).
• Hosting provider — the company hosting the website and its technical logs on cloud infrastructure (data processor).
• Google Ireland Limited — Google Analytics 4 and Google Ads services, activated only with consent.
• Professionals and advisors — e.g. the accountant, for legal compliance.
• Competent authorities — where disclosure is required by law or necessary to protect a right.

Transfers of data outside the European Union

Some providers (in particular Google and the hosting provider) may also process data in the United States or in other third countries. In such cases the transfer takes place on the basis of appropriate safeguards under Articles 45 and 46 GDPR, such as the Standard Contractual Clauses adopted by the European Commission and/or certification under the EU-US Data Privacy Framework. You can request a copy of the safeguards in place by contacting the controller.

Retention period

• Browsing data and technical logs: kept for as long as needed for website security, as a rule no longer than a few months, except in the case of incident investigations or requests from the authorities.
• Reservation data: kept for as long as needed to manage the reservation and, where document or accounting obligations arise, for the periods required by law.
• Contact data: kept for as long as needed to handle the request and for a reasonable period thereafter, then deleted unless further obligations apply.
• Analytics and marketing data: kept for the lifetime of the relevant cookies and in any case according to the retention periods set on the Google services (for Google Analytics 4, as a rule 14 months).

Your rights

In relation to the data processed, you have the right to ask the controller for access to your personal data, and for its rectification, erasure or restriction, to object to the processing, and to obtain data portability, in the cases and within the limits set out in Articles 15 to 22 GDPR.

Where processing is based on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal: for cookies you can use the "Cookie preferences" link in the footer.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) if you believe the processing infringes the GDPR.

Automated decision-making and minors

No automated decision-making producing legal effects on the data subject is carried out. Remarketing via Google Ads involves profiling for advertising purposes, activated only with consent and not producing legal effects.

The website is not directed to children under 16 and does not knowingly collect their data; reservations are made by adults.

Changes to this notice

The controller may update this notice to reflect changes in the law, in its organisation or in the services used. The updated version is published on this page together with the last-updated date.