PRIVACY POLICY (ART. 13 GDPR)
Last updated: 11/09/2026
This Privacy Policy describes how personal data collected through the website and its online booking form is processed, in accordance with EU Regulation 2016/679 (GDPR) and Legislative Decree 196/2003 as amended (Italian Privacy Code).
1. Data Controller
The Data Controller is Osteria San Leonardo S.r.l., with registered office in Via S. Pietro, 47 – 35139 Padua (PD), VAT no. [insert real VAT number].
Contact details:
The Controller has not appointed a Data Protection Officer (DPO), as it does not fall under the mandatory categories defined by Art. 37 GDPR.
2. Types of Data Processed
2.1 Data provided voluntarily via the booking form
The booking form on the website collects the following data entered directly by the user:
- First and last name
- Phone number
- Email address
- Reservation details (number of guests, date, time)
- Any additional information spontaneously entered in the notes field (e.g., dietary restrictions, allergies, or special events)
The reservation system is managed directly by the Controller: data is securely transmitted to an electronic log (a password-protected spreadsheet), accessible exclusively to the Controller and authorized personnel. No third-party booking services are involved.
2.2 Browsing data collected via Google Analytics (only upon consent)
During standard browsing, and only upon explicit user consent provided via the cookie banner, Google Analytics 4 indirectly collects data such as: IP address (subject to automatic masking/protection mechanisms), device and browser identifiers, pages visited, time spent on the site, and traffic sources. This data is processed in an aggregated and statistical form and does not allow direct identification of the user in reports.
2.3 Aggregated data from Google Search Console
Google Search Console provides aggregated data regarding search queries that led users to the website. This data does not allow the identification of individual visitors and does not require consent.
3. Purpose and Legal Basis of Processing
- Management, organization, and confirmation of bookings — performance of pre-contractual measures taken at the request of the data subject (Art. 6, par. 1, letter b GDPR). Providing this data is necessary to use the service.
- Response to unsolicited contact requests — performance of pre-contractual measures (Art. 6, par. 1, letter b GDPR).
- Legal obligations (tax, accounting, administrative) — compliance with a legal obligation (Art. 6, par. 1, letter c GDPR).
- Statistical analysis of website traffic — user consent (Art. 6, par. 1, letter a GDPR), collected via the cookie banner and revocable at any time.
- Sending promotional communications on similar services — Art. 130, paragraph 4 of the Privacy Code (so-called “soft spam”), according to the terms described in section 3.1.
3.1 Promotional communications to existing customers (soft spam)
Customers who have already used the services of the Osteria may receive communications relating exclusively to similar services to those already enjoyed: seasonal menus and tasting menus, special evenings and events organized at the Osteria, reserved table offers, and holiday openings.
- Information provided at collection: a notice is clearly displayed below the booking form on the website.
- Free and immediate opt-out: the user can object at any time, without formal requirements, by clicking on the unsubscribe link present in every communication or by writing to osteriasanleonardo@gmail.com. The objection is recorded by the delivery system and respected for all subsequent communications.
- Limits: communications will not concern products or services other than the catering services offered by the Osteria, nor third-party promotions.
- Termination: the capability to send communications ceases upon user objection or in the event of inactivity (no bookings or contact) for a period exceeding 24 months.
- Delivery tools: communications are sent via the Brevo platform (Sendinblue SAS), which automatically manages the unsubscribe link and maintains the record of opt-outs.
- Email tracking: communications may contain technologies to measure opens and clicks, used exclusively in aggregated form to evaluate the effectiveness of the communications.
4. Processing Methods and Data Retention
Data is processed using secure IT tools with access restricted to authorized personnel. Data will not be disseminated, sold, or transferred to third parties for commercial purposes.
Retention periods:
- Booking data: retained until the date of the event and for the following 12 months for internal administrative purposes, unless legal obligations require longer retention periods.
- Data used for promotional communications: retained until user objection and, in any case, no longer than 24 months from the last reservation or contact.
- Google Analytics data: retained for 14 months, as configured by the Controller in the GA4 property.
- Cookie preference (
cookieConsent): retained for 12 months.
Data collected through the booking form is not used for purposes other than those specified in this Privacy Policy.
5. Data Access and Communication Scope
Access to data is limited to:
- Internal personnel of Osteria San Leonardo S.r.l., duly authorized and instructed.
- Website maintainer / technical manager, designated as External Data Processor pursuant to Art. 28 GDPR, limited to the IT management of the infrastructure.
- Google Ireland Limited, as External Data Processor, limited to the Google services used (booking log spreadsheet, Google Analytics 4, Google Search Console). Any transfer of data outside the European Economic Area takes place on the basis of Standard Contractual Clauses approved by the European Commission and the EU-U.S. Data Privacy Framework.
- Brevo (Sendinblue SAS), based in France (EU), as External Data Processor, limited to sending email communications and managing unsubscribes. Data processed by Brevo remains within the European Union.
6. Rights of the Data Subject
At any time, the user may exercise the rights provided by Articles 15–22 of the GDPR:
- Access to personal data
- Rectification of inaccurate or incomplete data
- Erasure (“right to be forgotten”)
- Restriction of processing
- Objection to processing, including for promotional purposes
- Data portability
- Withdrawal of consent previously given, without affecting the lawfulness of processing based on consent before its withdrawal
For promotional communications, objection can be exercised at any time by clicking the unsubscribe link in any email or by writing to osteriasanleonardo@gmail.com.
To exercise other rights or request information, you may contact the Controller at the contact details provided in Section 1. Data subjects also have the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).
7. Register of Processing Activities
The Controller maintains an updated Register of Processing Activities pursuant to Art. 30 GDPR, available upon request to data subjects and competent authorities.
8. Changes to this Privacy Policy
Any updates to this Privacy Policy will be published on this page with an indication of the new update date.