Last updated: 15 September 2026
This notice explains how we process personal data of website visitors, people booking a table and people contacting us, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.
1. Data controller
RISTORANTE PIZZERIA PAPILLON
Via Lungolago Zanardelli, 69 — 25087 Salò (BS) Italia
VAT number: 01551320987
Email: [email protected]
Phone: 0365 41 429
2. Data we process
Website reservations: first name, last name, phone number, email, date, time, number of guests and any notes. We also record when you confirmed reading this notice.
Allergies and intolerances: if you mention them in the Notes field, this is health data (Article 9 GDPR). Providing it is optional. If you choose to do so, we use it only to prepare your meal safely.
Direct contact: if you call, email or message us on WhatsApp, we process the details you provide (number, name, message content) to respond.
Browsing data: website systems record technical data such as IP address, browser type, requested pages and time to ensure operation and security. To protect the form from spam and abuse, reservation IP addresses and emails are associated with temporary pseudonymised counters (codes that cannot be reversed without the website secret key), automatically deleted within 24 hours.
For cookies and external services, see the Cookie policy.
3. Purposes and legal bases
Managing and confirming reservations, sending receipts and contacting you when needed: pre-contractual and contractual steps requested by you (Article 6(1)(b) GDPR).
Taking account of allergies and intolerances you disclose: your explicit consent, expressed by voluntarily providing the information (Article 9(2)(a) GDPR). You may withdraw it at any time by asking us to delete the information.
Responding to phone calls, emails and WhatsApp messages: steps requested by you (Article 6(1)(b) GDPR). Website security and prevention of abuse and spam: the controller’s legitimate interest (Article 6(1)(f) GDPR). Compliance with legal obligations and defence of legal claims: legal obligation (Article 6(1)(c)) and legitimate interest (Article 6(1)(f)).
Displaying Google Maps: your consent (Article 6(1)(a) GDPR), which can be withdrawn in Cookie preferences.
We do not use your data to send advertising and do not make automated decisions concerning you.
4. Is providing data mandatory?
Required form fields are needed to handle the reservation; without them we cannot accept it. Notes are optional. You can always book by phone instead.
5. How we process data
Data is processed using protected electronic tools by authorised, trained staff. The website uses an encrypted connection (HTTPS), and reservations are accessible only through the restricted area of the website.
6. Recipients
Data is not made public or sold. Access may be granted to authorised restaurant staff and the following processors under Article 28 GDPR:
website hosting provider; email service provider; Studio Analitica Marketing for website maintenance
Meta Platforms Ireland Limited receives data only if you choose to contact us on WhatsApp, under the WhatsApp terms; Google Ireland Limited only if you enable the map; public authorities where required by law.
7. Transfers outside the European Union
Some providers, including Google and Meta, may process data outside the EU, particularly in the United States. Transfers rely on GDPR safeguards such as the EU–U.S. Data Privacy Framework adequacy decision or standard contractual clauses approved by the European Commission.
8. Retention periods
Website reservations, including notes: 12 months after the booked date, then automatically deleted. Related emails are deleted on the same schedule. Contact messages and emails: as long as necessary to respond, no more than 12 months unless needed for a reservation or legal obligation.
Technical security data: pseudonymised anti-abuse counters for up to 24 hours; data from forms not submitted because of errors for 10 minutes, solely to display it again; server logs for the period set by the hosting provider, normally no longer than a few months. Cookie choices: 6 months. Longer retention is possible only where required by law or to defend a legal claim.
9. Your rights
You may request access and a copy (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20); object to processing based on legitimate interest (Article 21); and withdraw consent without affecting prior processing (Article 7(3)).
To exercise your rights, write to [email protected]. We respond within one month. If you believe processing breaches the rules, you may complain to the Italian Data Protection Authority: www.garanteprivacy.it.
10. Minors
Online booking is restricted to adults. We do not knowingly collect data of children under 14.
11. Changes
We may update this notice, for example when the services used by the website change. The last update date appears above.