Privacy notice

Data controller

Il Giardino S.r.l., Calata Ponticello a Marechiaro, 19, 80123 Napoli, VAT no. 08040881214.

For any privacy request, write to us at ilgiardinomarechiaro@yahoo.it.

What data we process

When you book, we process:

• your full name, e-mail address and phone number;
• if you ask for a company invoice: the billing details (company name, VAT number or tax ID, codice fiscale, registered office, SDI recipient code or PEC);
• the room you chose, the number of guests, the amount and the status of the booking;
• the date and time you accepted this notice;
• your device's IP address, only to protect the website from abuse (see below).

Why we process it

To manage your booking: send you the bank transfer instructions, check the payment, send you your entry ticket and prepare the guest list. The legal basis is taking the pre-contractual steps and performing the contract you asked for (art. 6(1)(b) GDPR).

If you ask for an invoice, to issue it: this is a legal obligation of the restaurant (art. 6(1)(c) GDPR).

To protect the website from automated requests and abusive e-mail sending, with the Cloudflare Turnstile check and a limit on the number of requests. The legal basis is our legitimate interest in the security of the service (art. 6(1)(f) GDPR).

We do not use your data for advertising or newsletters, and we do no profiling.

Providing your data

Providing this data is required to book: without it we cannot record the booking or send you the ticket.

Who receives the data

The data is only visible to the restaurant staff in charge of bookings and to the technical providers that help us run the website, appointed as data processors:

• Cloudflare, Inc. (website hosting and the Turnstile anti-abuse check);
• Neon (database, servers in the European Union);
• Resend (sending the e-mails).

Transfers outside the European Union

Some of these providers are based in the United States. Transfers rely on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.

How long we keep it

Periods are counted from the date of the event, and deletion is automatic:

• bookings not confirmed (cancelled or expired): deleted from 31 January 2027;
• confirmed bookings: name, e-mail and phone deleted from 31 December 2027; only the code, room, number of guests and amount are kept;
• billing details: deleted from this site together with the booking data; the invoice issued is kept by the restaurant in its accounts for the period required by law (10 years);
• IP address and e-mail used to limit requests: deleted after 48 hours.

Browser storage

After booking, the website saves in your browser (local storage) the secret code that opens your booking page. It is a strictly necessary technical tool; we use no profiling cookies and no analytics.

Your rights

You can ask at any time to access, correct or delete your data, to restrict its processing, for its portability, and object to processing based on legitimate interest (arts. 15–22 GDPR), by writing to ilgiardinomarechiaro@yahoo.it.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).