Privacy policy

Privacy Notice under Articles 13-14 of the GDPR 2016/679

In compliance with the General Data Protection Regulation (GDPR) 2016/679, Ida Varazze (hereinafter referred to as “the Company”) is committed to protecting the privacy of every visitor (hereinafter referred to as “User”) of the website https://idavarazze.it (hereinafter referred to as “the Site”). In order to ensure maximum transparency in this regard, we kindly ask you to carefully read, before starting navigation or accessing the available services, in addition to the General Terms and Conditions (available at the website https://idavarazze.it) and the Cookie Policy (available at the website https://idavarazze.it), this privacy notice (hereinafter referred to as “Privacy Notice”). By accessing this Site and starting navigation, you declare to have understood and accepted, in addition to the Cookie Policy and the General Terms and Conditions, also this Privacy Notice, authorizing the Company to use your personal information as described therein. Users who do not consent to the processing of their data and do not accept this Privacy Notice, as well as the Cookie Policy and the General Terms and Conditions, are expressly requested not to access the Site, navigate through it, and/or access the offered services.

Useful Definitions

According to Article 4 of the GDPR, which is specifically referred to for further information on privacy matters, the following definitions shall apply: “personal data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person; “processing” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction; “data controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; “data processor” means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the data controller; “data subject’s consent” means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; “cookies” means text files sent from a web server to the User’s browser when they access a website for the first time, to store data and customization settings related to the service the website offers.

Data Controller and Data Protection Officer

The Data Controller is IDA di Ilaria Caprioglio – Via Famagosta 1 17100 Savona (SV) – VAT number 01856080096.

The Data Protection Officer is IDA di Ilaria Caprioglio – Via Famagosta 1 17100 Savona (SV) – VAT number 01856080096.

Data Collection Methods

The personal information collected is obtained during your interaction with the Site and/or the services provided therein. In particular, information is collected when you browse and use the Site, when you create an account (such as when making a reservation) or modify the settings of an existing account, when you place an order (including

for order delivery) through the Site and/or via email, when you contact the Site and/or the Company via email, phone, mail, message, or chat.

Types of Data Collected

The Company is committed to protecting the privacy of Users and, in this context, to providing maximum transparency about the information that will be collected. When, in addition to visiting the Site, the User wants to place an order, they are asked to send an email to the Company containing a series of information (including, for example, name, delivery address, phone number for delivery-related issues, order details, any specific information the User wants to provide about the order, etc.). The Company collects information related to the User or their use of the Site when the User contacts the Company or sends a communication via email and/or phone. The Company will collect information regarding the User’s health only if voluntarily provided by the User (for example, if the User has expressly informed the restaurant and indicated an allergy/intolerance in the order placed through the Site). When the User browses the Site, the Company also collects technical information regarding the device (phone, computer, tablet, etc.) used to access the Site (such as operating system, IP address used to access the Site, device type, connection type, etc.).

Legal Basis and Purposes of Data Processing

The Company aims to protect User data and bases its processing on the principles of fairness, lawfulness, and transparency. Therefore, such data will be processed using tools and procedures suitable for ensuring maximum security and confidentiality, through paper archives and supports, as well as digital, computer, and telematic means. The information collected by the Company will be transferred and stored on its servers located within the EU.

The legal basis for the collection and use of User’s personal information, as described above, will depend on the specific context in which they are collected. For example, if the User accesses the Site to place an order, the main reason for the Company to collect and process their personal information would be to fulfill the service provided. However, the Company may also use the User’s personal information in other circumstances, such as when it is in its legitimate commercial interest (not conflicting with the User’s interests) or when there is a legal obligation to do so (e.g., in the case of a legal proceeding). For questions and further information about the legal basis for the Site’s collection and use of your personal information, please contact the Site using the details provided in Article 11) titled “Contact.”

The Company is committed to processing User data only when there is a lawful basis according to the regulations concerning data protection. The processing of User data is allowed when, following the User’s consent and based on a legitimate interest of the Company, such processing is necessary to provide the requested services, establish/execute a contract, fulfill a legal obligation, or comply with accounting/tax/administrative requirements. For example, the User’s information may be used by the Company to grant access to restricted areas of the Site, create their account, provide the requested services, respond to messages or inquiries received through the Site or via email, contact them if necessary regarding a requested service, or contact third parties involved in the provision of a requested service. Furthermore, the User’s information may be used to facilitate and expedite navigation or ordering on the Site, allow customer service to efficiently handle any requests/complaints, exercise the rights of the Company and the individuals/legal entities it interacts with. The Company will assess, on a case-by-case basis, the relevance and adequacy of the data provided to make subsequent decisions and avoid processing data beyond the intended purposes. The Company is committed not to use the User’s personal data for different and/or additional purposes than those described in this privacy notice without providing information and obtaining the

User’s consent.

Cookies

The Company informs that the User can modify the Cookie settings from their browser to refuse them, partially or entirely. However, disabling/rejecting Cookies may result in certain sections of the Site being inaccessible and/or not functioning properly. For more information, please refer specifically to the Cookie Policy available at the link: https://idavarazze.it.

Data Retention and Security

The User’s data collected will be stored, from the moment of collection, for a reasonable period of time in relation to the aforementioned processing purposes, and in compliance with the relevant legislation. They will not be retained for a longer period than necessary. The criteria taken into account to determine the necessary retention period for data include, for example, contractual obligations and rights related to the information involved, legal obligations, the limitation period under the applicable law, (potential) disputes, guidelines issued by data protection authorities. It should be understood that, when the User’s data is no longer necessary to be retained, the Company will securely delete them. The Company adopts technologies and policies suitable to ensure that the User’s personal information is adequately protected, implementing measures to protect such information from unauthorized access, unlawful processing, accidental loss, destruction, and damage. However, it should be noted that the transmission of information over the internet is not entirely secure, and therefore, despite the Company’s and the Site’s efforts to provide adequate protection, the security of transmitted data cannot be guaranteed. Any changes to this Privacy Notice will be published on the Site, and therefore, Users are encouraged to periodically review the Site to stay updated on the latest information regarding privacy practices.

Data Disclosure

The Company pays great attention and seeks to be transparent about the parties with whom User information is shared. For the purposes mentioned in the previous Article 5), and generally based on this Privacy Notice, the Company may disclose User data to third parties to fulfill legal obligations, provide requested services, address (potential) disputes, etc. For all the purposes mentioned in this Privacy Notice, User data may also be disclosed abroad, both within and outside the European Union, while ensuring compliance with the rights and guarantees provided by the relevant legislation and verifying that the country in question guarantees an adequate level of protection. In order to execute the services offered on the Site and, generally, for the purposes described in this Privacy Notice, the Company, depending on the circumstances, may share User’s personal information with the following parties: restaurants where orders are placed (e.g., for delivery purposes); entities responsible for delivering the order; third parties performing various activities to promote and support the Company’s services (such as customer support agents, website hosting and support service providers, marketing service providers, IT professionals, companies sending notifications to the User when an order is being delivered and/or confirmed); third parties who may contact the User, with their consent, to provide information about goods or services that may be of interest; in the event of a merger or transformation of the Company, User information may be disclosed/transferred to such companies, as well as new business partners, new partners, and/or their consultants (subject to the condition that, in such cases, the Company will inform such entities that they must process the shared personal information only for the purposes stated in this Privacy Notice); public/governmental/judicial security bodies, and in any case, entities to which the Company may deem necessary to disclose User’s personal data in accordance with laws/regulations, to exercise/protect the rights of the Company, or to protect the vital interests of the User or third parties.

Links to Third-Party Websites

The Site may contain links to or from third-party websites. For example, the Site may link to partner websites or, more generally, to websites that may provide useful information to Users (such as the websites of restaurants where orders

can be placed). The Company assumes no responsibility for the content, privacy practices, or actions of such third-party websites. The Company encourages Users to carefully read the privacy policies of any third-party websites accessed through the Site.

Rights of the Data Subject

As a User, you have the right to access your personal information held by the Company, as well as the right to rectify, delete, restrict or object to the processing of your data, and the right to data portability. To exercise these rights, or if you have any questions or concerns regarding the processing of your personal information, please contact the Company using the details provided in Article 11) titled “Contact.” The User also has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Contact

For any questions, concerns, requests, or clarifications regarding this Privacy Notice, the User may contact the Company by email at info@idavarazze.it or by mail at IDA di Ilaria Caprioglio – Via Famagosta 1 17100 Savona (SV) – VAT number 01856080096.

Last update: [insert date]

This Privacy Notice is subject to change and was last updated on the date indicated above.