Privacy Policy

1. Data controller

The data controller is Donna Anna di Ferraioli Francesco, with registered office at Via Cavallotti 50, 27011 Belgioioso (PV), Italy, VAT number 06223260651.

For questions about personal data processing or to exercise your rights, you may write or call using the contact details below.

2. Personal data that may be processed

The website has no registration or contact forms. Data is collected automatically while you browse or when you choose to contact us by telephone, email or an external booking service.

• Browsing dataIP address, date and time of the request, requested page, response status, browser, device, operating system, referring page where available, and technical data required for website operation and security.
• Data provided voluntarilyname, contact details, message content and information required to answer enquiries about rooms, tables, events or other services.
• Customer relationship databooking, accommodation or restaurant information and administrative data required to manage the service and comply with legal obligations.

3. Purposes and legal bases

Personal data is processed only for specified and relevant purposes. The website does not use personal data for profiling, behavioural advertising or automated decision-making.

• Website operation and securitypage delivery, abuse prevention, troubleshooting and infrastructure protection, based on the controller’s legitimate interests (Article 6(1)(f) GDPR).
• Enquiries and bookingsresponding to messages and taking requested pre-contractual or contractual steps (Article 6(1)(b) GDPR).
• Legal obligationsadministrative, accounting and tax requirements or requests from competent authorities (Article 6(1)(c) GDPR).
• Protection of legal rightsestablishing, exercising or defending legal claims and managing disputes, based on the controller’s legitimate interests (Article 6(1)(f) GDPR).

4. Whether providing data is mandatory

The processing of technical browsing data is necessary to make the website available. Providing data by email, telephone or TheFork is optional; without essential information, however, we may be unable to answer or manage the request.

Please do not send special-category, health-related or otherwise unnecessary data. If such information is essential for a specific request, it will be handled only within the limits permitted by applicable law.

5. Processing methods and security

Processing is carried out using digital and, where necessary, manual tools in accordance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation.

Technical and organisational measures proportionate to the risk are used to reduce unauthorised access, loss, disclosure or unlawful use. No Internet-connected system can guarantee absolute security.

6. Recipients of personal data

Personal data may be processed by authorised staff and providers supporting hosting, technical maintenance, communications or professional compliance, appointed as processors where required.

Data may also be disclosed to public authorities or other parties when required by law or necessary to protect a legal right. Personal data is not published or sold.

7. External services and international transfers

The website loads typefaces through Google Fonts. The technical request may disclose connection data such as the IP address, browser and requested page to Google.

On the Contact page, the interactive Google Maps map is embedded in an iframe and is requested from Google’s servers when the page loads. This may transmit technical data to Google, such as the IP address, browser information and referring domain. The TheFork link becomes active only when you choose to use it. Processing by these providers is governed by their respective privacy notices, and they act as independent controllers for their own services.

Where a provider processes data outside the European Economic Area, the transfer must comply with Chapter V of the GDPR and rely on one of the safeguards recognised by applicable law.

8. Retention periods

Browsing data is kept only for as long as required for operation, security and technical diagnostics under the hosting provider’s settings, unless it is needed to investigate unlawful activity.

Enquiry data is kept for the time required to reply and manage any follow-up. Data connected with bookings, contractual relationships and administrative records is kept for the duration of the relationship and the subsequent periods required by law or necessary to protect legal rights.

9. Your data protection rights

Where applicable under Articles 15-22 GDPR, you may request access, rectification, erasure, restriction, data portability and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting processing lawfully carried out before withdrawal.

Requests may be sent to the controller by email. You also have the right to lodge a complaint with the Italian Data Protection Authority under Article 77 GDPR or bring proceedings before a court.

10. Cookies and tracking technologies

This website uses only technical cookies or equivalent tools that are strictly necessary for operation and security. It does not use profiling, advertising or analytics cookies to monitor user behaviour.

Consent is not required for technical cookies under Article 122 of the Italian Privacy Code and the Italian Data Protection Authority’s Guidelines of 10 June 2021. If non-technical tools are introduced in the future, this notice will be updated and prior consent will be requested where required.

11. Updates and contact details

This notice may be updated following legal, technical or service changes. The version published on this page is the applicable version; the latest update date appears at the top.

For questions about this Privacy Policy or personal data processing, contact Hotel Ristorante Cavaliere using the email address shown in the data controller section.