Privacy notice

Last updated: 1 novembre 2026

This page explains which personal data we process when you visit lacantinapizzeria.it, order or book a table from here, ask about availability for a party or contact us by phone, WhatsApp or email. It also explains why we process it, who we share it with, how long we keep it and how you can exercise your rights. It is provided under Article 13 of Regulation (EU) 2016/679 (the "GDPR") and Legislative Decree 196/2003 (the Italian "Privacy Code"), as amended by Legislative Decree 101/2018.

In short

The site has no shopping cart of its own: Order and Book open GloriaFood, an external service. Until you tap one of those buttons, the page does not connect to GloriaFood.
If you ask about availability for a party, we use the details from the form to call you back and prepare a quote. If the party goes ahead, we also keep them for tax records.
If you call us or write to us on WhatsApp or by email, the site collects nothing: we use your number or address and what you tell us to reply to you.
On the site, statistics and marketing tools are switched on only if you accept them from the banner. You can change your mind at any time from the "Cookie preferences" link at the bottom of every page. The GloriaFood panel has tools of its own, which the banner does not control: we describe them in section 2.1.
We do not sell your data and we do not use it for newsletters or promotional messages.
To access, correct or delete your data, write to info@lacantinapizzeria.it.

1. Who the data controller is

The data controller, that is the person who decides how and why we process the data, is:

Name: La Cantina di Gentile Giovanni, ditta individuale
Registered office: Via Giardino 9, 84020 San Gregorio Magno (SA)
VAT number: 06005560658
Companies Register entry (REA): SA-491825
Privacy email: info@lacantinapizzeria.it

We have not appointed a data protection officer (DPO), because for the type and volume of processing we carry out it is not required. For any question about privacy, use the email address above.

2. Which data we process

2.1 If you order online or book a table

The Order and Book buttons on the site open GloriaFood, Oracle’s online ordering service that we use to receive orders and bookings. The panel appears on top of the site’s page, but it belongs to GloriaFood.

The page loads nothing from GloriaFood when you open it. On the first tap on Order or Book, your browser downloads a script from GloriaFood’s servers (www.fbgcdn.com) and opens the panel, which communicates with www.foodbooking.com. From that moment GloriaFood receives your IP address and your browser’s technical data, as does every site you visit. If JavaScript is off, the buttons lead to the Order or Book page on our site, which has the link to GloriaFood; if the panel does not open within a few seconds, the browser opens GloriaFood’s ordering page.

The data you enter in the panel goes to GloriaFood and does not pass through our site’s server. For an order it is, for example, your name, phone number, the contents of the order, whether you collect or want delivery, the chosen time and the notes; for delivery, also the address. For a table it is the number of people, the date, the time, the notes and your contact details. We receive it in GloriaFood’s management panel, to prepare the order, deliver it or hold your table.

Today you do not pay online: you pay on delivery or on collection. The site receives no card numbers.

In the notes of an order or a booking, write only what we need. If you mention an allergy or an intolerance, that information concerns your health and we use it only to prepare your dish safely. By writing it, you give us your consent to use it for this purpose, and you can withdraw it at any time. If you prefer not to write it, tell us when you order or when you arrive.

Inside the panel, services from other companies chosen by GloriaFood also run, for example Google maps for the delivery address, an anti-bot check (hCaptcha) and performance measurement (mPulse). The privacy notices of GloriaFood and of those services apply (see the cookie policy).

Statistics and advertising inside the panel. The pizzeria’s GloriaFood account is configured with Google Tag Manager, which in turn loads statistics and campaign measurement tools (in today’s configuration: Google Analytics 4, Google Ads and Meta Pixel). They start when you open the panel: GloriaFood runs them inside its panel and our site’s cookie banner does not control them, so, unlike the site’s own tools, they do not wait for your choice. They do not start until you tap Order or Book. If you prefer not to open the panel, you can also order or book by phone or on WhatsApp.

2.2 If you ask about availability for a party

On the private parties page there is the "Check availability" form. It is a single screen and collects:

contact details: first name and surname, phone number, email (optional);
the party: what kind of party it is (one option to choose), the date, even approximate, the town and the kind of place, the approximate number of guests;
a free, optional message, for the time, the space available or requests about the menu;
confirmation that you have read this notice.

The required fields are marked in the form. We ask you not to write passwords or details that are not needed for the party in the message. If there is an allergy we need to take into account, section 2.1 applies. What you write in the form reaches us only when you press the send button: if you leave the form half-filled, nothing reaches us. As soon as you start filling it in, the browser asks our server for a one-time code (see section 2.5), without sending your data.

2.3 The route the form data takes

The browser sends the answers, over an encrypted connection (HTTPS), to the program that receives them on the site’s server at Hostinger. The program checks the fields and forwards the request without saving a copy on the server.
The server passes it, again over an encrypted connection, to a Google script (Google Apps Script) linked to a Google Sheet of ours, which writes it in a row. Google receives the request from our server: it does not receive your IP address, only the answers and the technical data described in section 2.4.
Right after, the script sends us a notification email from our Google account, with the form answers, the technical data and the link to the row in the sheet.
If Google does not respond in time or returns an error, our server sends the same information in a plain-text fallback email, from Hostinger’s server to our mailbox. We then copy the request into the sheet by hand. For this reason, in rare cases, the same request may reach us both ways.

We tell you that the request has arrived only when the sheet has recorded it or the fallback email has actually been sent. If sending fails, the form tells you and gives you the phone number and WhatsApp. We do not send form requests to other services, and in particular to no statistics or advertising platform.

2.4 Technical data attached to the request

Together with what you write, the form adds by itself:

the page you send the request from and the page or site you came from (referrer);
the site the request starts from and a random code that identifies the request;
the language of the page;
any campaign codes that links and adverts add to the page address (UTM parameters: source, medium, campaign, content, term);
the codes that advertising platforms add to the link when you tap an advert (for example gclid, fbclid), only if you have accepted marketing cookies: without your consent the browser does not send them and also removes them from the page address and the referrer; if they arrived anyway, the server discards them;
the state of your cookie choices at the time of sending;
date and time of sending.

We need them to understand which channels the requests come from and to avoid using data for marketing when you have not given consent.

If you have accepted statistics or marketing cookies, the site tells the active tools that you have started filling in the form (statistics tools only) and that the request has been sent, with the kind of party and the random request code. It never passes on your name, phone number, email, date, place or message.

2.5 Security data

To block spam and repeated submissions, the server derives from your IP address and your network, with a secret key, an anonymous code (a fingerprint, or hash) and uses it to count submission attempts. It counts them also when the browser asks for the one-time code, that is as soon as you start filling in the form: that request contains nothing of what you write. The counters are kept in a private folder on the server and expire after 10 minutes or one hour: once expired, the server no longer uses them and deletes them. The fingerprint is not linked to your request and your IP address is not written in the sheet. The form also uses invisible anti-bot checks, such as a hidden field and a one-time code valid for a limited time, which require no further data. In the server’s error log the program writes only technical codes, never the contents of the requests.

2.6 If you call us or write to us on WhatsApp or by email

The "Call" and "WhatsApp" links and those with the email address open the app on your phone or computer: the site does not see what you do afterwards and collects nothing. If you call us, we process your number and what you tell us in order to reply, take an order or a booking. If you write to us on WhatsApp or by email, we process your number or address, your profile name and the text of the messages. For people in the European Economic Area, WhatsApp is provided by WhatsApp Ireland Limited, a company of the Meta group, which processes the data as an independent controller under its own privacy notice. Our mailbox is a Gmail account, so messages also pass through Google. The channel is your choice: if you prefer, phone us.

2.7 Browsing data

Like every site, the Hostinger server hosting lacantinapizzeria.it, and its content delivery network (CDN), record some technical data about visits in their logs: IP address, date and time, page requested, result of the request, browser and operating system. They are needed to make the site work, find errors and defend it from attacks. We do not use them to identify you, except in case of abuse or at the request of the authorities.

Fonts, images and scripts are on our server. For this reason the browser does not contact Google Fonts or other font services, and does not send your IP address to them. The map on "Where we are", on the home page and on the Sunday lunch page starts as our own aerial photo (orthophoto from the Italian National Geoportal, stored on our server) over a drawing of the streets derived once from OpenStreetMap data: looking at it, your browser connects to no one. The Google Maps map loads only if you tap "Show the Google map" or if you have accepted marketing in the cookie banner: from that moment Google receives your IP address and may use its cookies, as the cookie policy explains.

2.8 Cookies and similar tools

The site uses two technical tools: a cookie to remember your choices on the banner and, only if you use the switch, an entry in the browser’s storage to remember whether you prefer the light or the dark page. Only with your consent does it also use statistics and marketing tools and remember, until you close the tab, which page or advert you came from (the sb_attr entry in the browser’s session storage). The details, including the list of active tools, are in the cookie policy.

2.9 Links to other sites

The site contains links to other people’s services: Google Maps for directions, La Cantina’s Google listing and the page for writing a review, Facebook, Instagram, WhatsApp, the map credits on OpenStreetMap and, if the ordering panel does not open, GloriaFood’s ordering page. At the bottom of the pages there is also a link to the site of SalesBooster, the technical provider that looks after the site. They are plain links: we load nothing from those services into the page and the site sends them no data (the only exception is the Google map described above, which starts only at your request or with consent to marketing). When you tap them you leave the site and the notices of whoever runs them apply. If you write a review on Google, you write it with your Google account, on Google’s service.

The rating and the number of reviews we show are copied from our Google listing, with the date on which we read them. The site does not connect to Google to update them.

3. Why we process the data and on which legal basis

Purpose	Data used	Legal basis
Receiving and preparing orders, delivering them or holding them for collection, holding the table you have booked	Data entered on GloriaFood, phone, WhatsApp	Performance of a contract or pre-contractual steps taken at your request (Art. 6(1)(b) GDPR)
Handling a party request: reading it, being notified of it, calling you back, agreeing together on date, place, menu and price	Form data, technical data, phone, WhatsApp, email	Pre-contractual steps taken at your request and, if the party goes ahead, performance of the contract (Art. 6(1)(b) GDPR). If you write on behalf of a business: our legitimate interest, see below (Art. 6(1)(f))
Replying to those who contact us in other ways, for example for information	Number, email address, contents of the messages	Legitimate interest in replying to those who write to us (Art. 6(1)(f) GDPR)
Taking into account an allergy or intolerance you tell us about	What you write or say about your health	Explicit consent, which you give by telling us (Art. 9(2)(a) GDPR)
Understanding which channels party requests come from	Sending page, referrer, UTM parameters	Legitimate interest in measuring the effectiveness of our communication (Art. 6(1)(f) GDPR)
Protecting the site and the form from spam, abuse and attacks	IP fingerprint, server logs, anti-bot checks	Legitimate interest in the security of the site (Art. 6(1)(f) GDPR)
Browsing statistics, including knowing how many people start filling in the form	Cookies and data collected by the statistics tools	Consent (Art. 6(1)(a) GDPR and Art. 122 of the Privacy Code)
Measuring advertising campaigns, including telling the platforms that a visit led to a request, and showing you relevant adverts	Marketing cookies, click identifiers	Consent (Art. 6(1)(a) GDPR and Art. 122 of the Privacy Code)
Statistics and campaign measurement inside the GloriaFood panel (section 2.1)	Cookies and data collected by the tools loaded in the panel	Consent (Art. 6(1)(a) GDPR and Art. 122 of the Privacy Code): today the GloriaFood panel does not ask for it, see section 2.1
Accounting, tax obligations and record keeping	Data about the order or the party and the related documents	Legal obligations (Art. 6(1)(c) GDPR)
Establishing or defending a right in case of a dispute	Only the data relevant to the dispute	Legitimate interest (Art. 6(1)(f) GDPR)

If you write on behalf of a business. When you ask for a work party as an employee or collaborator, the pre-contractual relationship concerns the business. In this case we process your contact details on the basis of our legitimate interest in replying to the requests we receive: it is a use you expect, because it is you who writes to us.

Legitimate interest. Where we rely on legitimate interest, we have checked that the processing is limited, predictable for visitors to the site and does not override your rights. You can ask us for the details of this assessment and you can object at any time (section 9).

The checkbox at the end of the form ("I have read the privacy notice") confirms that you have read this page. We do not ask you for consent to the processing: the legal bases are those in the table.

We do not sell personal data and we do not take decisions based solely on automated processing that produce legal or similarly significant effects on you (Art. 22 GDPR): a person reads and handles every order, booking and request.

4. Are you required to provide the data?

No, ordering, booking or asking about a party is your choice. But to provide the service we need some data: without a name and a contact detail we cannot prepare the order, deliver it, hold your table or call you back about the party. Optional fields, such as the notes or the email in the form, can be left empty. Browsing data is needed to show you the pages and cannot be avoided. Consent to statistics and marketing cookies is optional: if you refuse, the site works just the same and you can order and book as usual.

5. Who may receive the data

The data is processed by the controller and by those who work with us, who use it only for their task and are bound to confidentiality: for example, those who prepare the orders and those who deliver them receive name, address, phone number and the contents of the order. We also rely on suppliers that process data on our behalf, as processors (Art. 28 GDPR), only according to our instructions:

Hostinger International Ltd (Cyprus): hosting of the site and of the program that receives the form, content delivery network (CDN) and sending of the form’s fallback email. For part of the service Hostinger relies on other suppliers (sub-processors), listed in its data processing agreement;
SalesBooster, the technical provider that builds and manages the site on our behalf: it has access to the site, the hosting and, when the form is active, the request sheet. It intervenes only for maintenance and support.

Google. The spreadsheet in which we store the form requests, the script that records them (Google Apps Script), the sending of the notification email and our Gmail mailbox are Google services that we use with our account. For people in the European Economic Area they are provided by Google Ireland Limited (Ireland).

We use a standard Google account and not a Google Workspace business account: for this type of account Google does not sign a data processing agreement as a processor (Art. 28 GDPR). Google processes the data we keep in the account under its own Terms of Service and Privacy Policy, and not under instructions agreed with us. The requests stay in our account: the sheet is not public and we do not share it with others.

Other parties receive data on the basis of a choice of yours, such as opening the ordering panel or writing on WhatsApp, or of the law:

GloriaFood (an Oracle service): the platform on which we receive and manage the orders and bookings made from the site. It processes the data to provide us with the service and partly for its own purposes, under its own terms and privacy notice;
Google and Meta, for the statistics and advertising tools that GloriaFood loads inside its panel on behalf of the pizzeria (section 2.1), under their own notices;
the services you use to contact us, such as WhatsApp (WhatsApp Ireland Limited), process the data as independent controllers, under their own notices;
the statistics and marketing providers listed in the cookie policy, for the site’s tools only if you have given consent. Some of them process the data as independent controllers, under their own notices. For the Meta Pixel, Meta Platforms Ireland Limited and we are joint controllers for the collection and transmission of data through the pixel only, under Meta’s Controller Addendum, which is the joint controllership arrangement (Art. 26 GDPR);
those who assist us with accounting and tax obligations, and the authorities, when the law requires it.

If you want the up-to-date list of processors, write to us.

6. Transfers outside the European Union

Hostinger is based in the European Union, but among the suppliers it relies on there are companies located outside the European Economic Area (EEA), for example in the United States. Its CDN may also serve the pages from nodes outside the EEA. For these transfers Hostinger’s agreement applies the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914, Art. 46(2)(c) GDPR); where a Commission adequacy decision exists (Art. 45 GDPR), that applies. The agreement is published at hostinger.com/legal/dpa.

Google, GloriaFood (Oracle) and the statistics and marketing tools, such as Meta, may also process data in the United States or in other countries outside the EEA. With a standard Google account we cannot choose where Google stores the data. The transfer takes place only with the safeguards provided for by Articles 44 to 49 of the GDPR:

the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, for the US suppliers that adhere to it. Google LLC and Meta Platforms, Inc. are among the certified companies: you can check the list at dataprivacyframework.gov;
the standard contractual clauses approved by the European Commission with Implementing Decision (EU) 2021/914, where there is no adequacy decision or in addition to it;
the Commission’s other adequacy decisions, for the countries that benefit from them.

For the safeguards that apply to each supplier, write to info@lacantinapizzeria.it. Beyond what is described here, we do not transfer your data outside the EEA.

7. How long we keep the data

Data	Retention
Party requests from the form (row in the sheet, notification email and any fallback email) if the party does not go ahead	12 months from the last contact. We then delete the row from the sheet, the version history (which would otherwise keep the deleted rows) and the related emails, bin included. Google then completes the deletion from its own systems with some delay, as its privacy policy explains
WhatsApp messages, emails and notes from phone calls	The time needed to handle the request and, if no order or party follows, normally no longer than 12 months from the last message
Orders and bookings in the GloriaFood management panel	The time needed to handle the order or the table and to deal with any dispute. Accounting and tax documents are kept for 10 years (Art. 2220 of the Italian Civil Code and tax rules)
Data about a party that goes ahead: quote, agreements, tax documents	For the duration of the relationship and then 10 years, as required for accounting records (Art. 2220 of the Italian Civil Code)
IP address fingerprint used to limit submissions and one-time code requests	Each counter expires after 10 minutes or one hour; the server deletes it on the next write or with the automatic clean-up of old files
Server and CDN logs	They stay only with Hostinger for the hosting service’s rotation period, then Hostinger deletes them. We keep no copies, except the lines needed to handle an abuse or a request from the authorities, for the duration of that case
Cookie choice (`sb_consent` cookie) and consent state recorded with the request	The cookie lasts 180 days, then we ask for your choice again; the state recorded with the request follows the retention of the request
Light or dark preference (`lc-tema` entry in the browser’s storage)	It stays in your browser until you clear the site’s data; we do not receive it
Statistics and marketing cookies	The durations given in the cookie policy
Data needed to handle a dispute	For the time needed to close it

You can ask us to delete your data earlier, by writing to info@lacantinapizzeria.it, except the data the law requires us to keep.

8. How we protect the data

We protect the data with technical and organisational measures proportionate to the risks:

encrypted connection (HTTPS) from the browser to our server and from our server to Google;
security headers;
no third-party scripts in the pages until you tap Order or Book or give consent;
server-side check of every form field;
protection against spam and automated submissions;
access to the sheet, the mailbox and GloriaFood restricted to authorised people;
the key that lets our server write to the Google Sheet is kept only in a server folder outside the public part of the site and in the Google script’s settings: it never appears in the pages.

No measure removes the risks entirely: should a breach concerning your data occur, we will handle it as provided for by Articles 33 and 34 of the GDPR, informing you where necessary.

9. Your rights

At any time you can:

access your data and receive a copy of it (Art. 15 GDPR);
ask us to rectify or complete it (Art. 16);
ask us to erase it, for example when it is no longer necessary or when you withdraw consent (Art. 17);
ask us to restrict its processing, for example while we check a dispute you have raised (Art. 18);
receive the data you have given us in a structured, machine-readable format, or have it transmitted to another controller (portability, Art. 20);
withdraw consent to statistics and marketing cookies from the "Cookie preferences" link at the bottom of every page, and consent about health information by writing to us: withdrawal applies to the future and does not make what was done before unlawful (Art. 7(3)).

Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR). In that case we stop processing your data, unless there are compelling legitimate grounds or the need to defend a right.

To exercise your rights, write to info@lacantinapizzeria.it. It is free of charge. We reply within one month; in complex cases we may take two further months, and we tell you so within the first month. If we have reasonable doubts about your identity, we may ask you for information to verify it. For the data held on GloriaFood we act on the management panel ourselves; if you ask us to delete a form request, we remove the row, the history and the emails as described in section 7. Only the data the law requires us to keep remains.

If you believe the processing infringes the law, you can lodge a complaint with the Garante per la protezione dei dati personali, the Italian Data Protection Authority (www.garanteprivacy.it), or with the supervisory authority of the EU Member State where you live, work or where the alleged infringement took place (Art. 77 GDPR). If you wish, write to us first: it is often resolved faster.

10. Minors

We do not knowingly collect data from children under 14. If a minor has written to us or placed an order and you want us to delete their data, write to us.

11. Changes to this notice

We update this notice when the services we use change, for example the platform for orders and bookings, our activities or the law. The date at the top of the page indicates the version in force. If the changes concern the purposes or the providers of cookies subject to consent, we ask for your consent again.