Privacy Policy

The Data Controller is GIOVANNI SANTARPIA S.R.L. SOCIETA’ CON UNICO SOCIO, trading as Pizzeria Giovanni Santarpia.

• Registered office and restaurant address: Via Senese 155/R, 50124 Firenze (FI), Italy.
• VAT number and tax code: 07232140488. European VAT number: IT07232140488.
• REA: FI-689131.
• Public email and privacy enquiries: [email protected].
• Certified email (PEC): [email protected].
• Telephone: +39 055 936 0052.
• Website: giovannisantarpia.com.

Personal data enquiries may be addressed to Giovanni Santarpia using the Controller’s contact details.

Depending on the form or service you use, you may provide your first name, surname, email address, telephone number, event or booking date, number of guests, event or enquiry type and a free-text message.

Browsing and using the services may involve processing your IP address, browser and device information, language, requested page, date and time of access, and technical data relating to operation and security. If you authorise optional tools, cookie identifiers, pages visited and information about your interactions with the website may also be processed.

Include only information relevant to your enquiry. Avoid sending documents, payment details or health information, including diagnoses or details of allergies. If a dietary requirement involves sharing health information, contact the restaurant to agree how it should be handled. When providing another person’s details for a booking, keep them to the minimum necessary and make this policy available to that person.

• Answering enquiries and quote requests; handling table bookings, events and Pizza Making Classes: performance of a contract or steps requested by you before entering into a contract, Article 6(1)(b) GDPR. General correspondence unrelated to a contract or its preparation is handled on the basis of our legitimate interest in responding to and managing communications, Article 6(1)(f).
• Meeting administrative or other applicable legal requirements: compliance with a legal obligation, Article 6(1)(c).
• Operating the website and preventing spam, fraud and unauthorised access: the Controller’s legitimate interest in keeping the service secure and available, Article 6(1)(f), while respecting individuals’ rights.
• Statistics through Google Analytics 4, advertising tracking through Meta Pixel and optional external content: consent, Article 6(1)(a), where required for the particular processing. Consent to non-essential cookies and other trackers is collected separately through the preference manager.

Sending an enquiry does not subscribe you to a newsletter or authorise promotional email, SMS or WhatsApp messages. The website does not handle online food orders, delivery orders, online payments or gift card sales.

The forms on the website allow visitors to send contact enquiries, quote requests, event requests or bookings, and Pizza Making Class requests or bookings. The information is used to reply, clarify the details and organise the requested service.

Submissions are sent by email and may be stored in the website’s management system. The stated retention period for these submissions is 1 year, unless a legal obligation requires a longer period.

Fields marked as required are needed to handle the enquiry: without the necessary information we may be unable to reply or organise the service. Other fields are optional. The wording “I have read the Privacy Policy” records your acknowledgement and does not constitute marketing consent; processing necessary for your request relies on the legal bases described above.

Guestplan is embedded in the website so that you can book a table. Details entered into the widget, such as your name, contact details, date, number of guests and any notes, are processed through Guestplan to handle availability and your booking. The service may also receive technical information needed for communication, such as your IP address, browser and request URL.

Guestplan is provided by eTender B.V. Processing necessary for your booking relies on Article 6(1)(b) GDPR. Retention within Guestplan depends on the booking lifecycle and the settings applied by the restaurant; the website form retention period does not automatically apply to that platform.

For further information, see the Guestplan Privacy Policy. Contact the restaurant with requests about your booking data.

Cloudflare Turnstile protects forms against automated submissions and abuse. It may analyse technical signals including IP addresses, TLS connection characteristics, browser information and a site identifier. The Controller uses it for service security on the basis of legitimate interests under Article 6(1)(f) GDPR.

Cloudflare states that it acts as a processor when protecting the website and as a separate controller when improving its bot detection capabilities. See its Turnstile privacy notice. If the check prevents you from sending an enquiry, you can contact us by email or telephone.

Google Analytics 4 (GA4) helps analyse visits and use of the website. It may process identifiers, browsing data, device information and interactions. The Analytics cookies listed in the Cookie Policy require statistics consent; they are not automatically treated as strictly necessary cookies.

Google Tag Manager (GTM), when used, manages the loading of tags and scripts. GTM does not by itself determine the processing: this depends on the tags enabled, which must respect your choices. Whether a GTM container is active in the current configuration remains to be confirmed.

Meta Pixel / Facebook Pixel may send browser identifiers, pages visited and interactions to Meta for advertising measurement and personalised advertising, subject to marketing consent. These tools may allow the provider to connect this information with other data it holds, depending on its settings and policies.

Google Consent Mode communicates consent status to the tags. Some configurations can send signals to Google without cookies, so the absence of cookies does not necessarily mean that no data is transmitted. The configuration used and the processing of these signals are to confirm with legal advisor.

See the Google Privacy Policy and Meta Privacy Policy. You can change your choices through Cookie settings.

The website includes Google Maps and a social wall displaying content from Instagram. Loading resources from these services can disclose your IP address, browser information and referring page to the providers; cookies or similar technologies may also be used, depending on the service.

The maps have a control for activating external content. Optional content involving tracking requires prior consent, including where consent is given through a specific, informed loading action. Social wall behaviour depends on the integration: images hosted on Instagram servers can create an external connection even without cookies. The blocking or loading behaviour of Instagram resources is to confirm with legal advisor.

Refusing optional content may prevent it from being displayed. The restaurant’s address and contact details remain available. Social profile links open external services governed by their own privacy policies.

Data may be accessed by authorised restaurant staff and providers supporting hosting, email, maintenance, forms, bookings, security and optional services, within their respective activities.

External services that may process personal data include Guestplan for bookings, Cloudflare for anti-spam and security protection, Google for Analytics and Maps, and Meta for Instagram and the advertising tools described in this policy.

Parties processing data on the Controller’s behalf must be governed as processors under Article 28 GDPR; providers may act as separate controllers for their own purposes or as joint controllers for particular processing. Their actual roles depend on the service and applicable agreements. Data may also be disclosed to advisers or authorities where necessary to meet legal obligations. You can request current information about recipients from the Controller.

Using Google, Meta/Instagram, Cloudflare, Guestplan and their infrastructure or support networks may involve data processing or access outside the European Economic Area (EEA), including in the United States. It should not be assumed that all data remains in Italy or the European Union.

Such transfers require a valid basis under Chapter V GDPR, such as an adequacy decision applicable to the recipient or appropriate safeguards, including standard contractual clauses and supplementary measures where needed. Cookie consent does not replace these requirements. The countries, recipients and mechanisms actually applicable to the restaurant’s contracts are to confirm with legal advisor. For information and to request a copy of applicable safeguards, email [email protected].

• Form submissions, email copies and records in the website’s management system: 1 year, unless a legal obligation requires longer retention.
• Guestplan bookings: for the time needed to handle the booking and related obligations; the platform’s operational retention period is to confirm with legal advisor.
• Records subject to legal retention requirements: for the period required by the applicable obligation, limited to the necessary data.
• Technical logs and security data: for the time needed to maintain operation and investigate abuse. Operational time limits and backup rotation are to confirm with legal advisor.
• Cookies: for the periods set out in the Cookie Policy, subject to earlier deletion or browser limits. A cookie expiring does not delete data already received by a provider.
• Data held in analytics and advertising platforms: according to the service’s purposes, settings and applicable terms. The configured GA4 retention period and other actual periods are to confirm with legal advisor.

At the end of the applicable retention period, data must be deleted or anonymised. Withdrawing consent stops future processing based on that consent without affecting the lawfulness of earlier processing.

Where the GDPR conditions are met, you can request access, rectification, erasure and restriction of processing. Data portability applies where automated processing is based on consent or a contract. You can object to processing based on legitimate interests for reasons relating to your particular situation, and to direct marketing, including related profiling, at any time. You can withdraw consent without affecting the lawfulness of earlier processing.

Send requests to [email protected] or the Controller’s registered office. A response is due without undue delay, normally within one month. Where the GDPR permits, a reasoned extension of up to two further months is possible, with notice within the first month. If there are reasonable doubts about your identity, only information necessary to verify it may be requested.

You may lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali: rights and remedies. You may also complain to the competent authority where you habitually live, work or where the alleged infringement occurred. You do not need to contact us before making a complaint.

Optional tracking services may contribute to the advertising profiling described above. Turnstile uses automated checks to detect bots and may prevent suspicious submissions. The available documentation does not identify solely automated decisions with legal or similarly significant effects under Article 22 GDPR; this is to confirm with legal advisor. Contact the restaurant directly if you have difficulty with an enquiry or booking.

See the Cookie Policy for the cookie inventory and preference controls. You can reopen the panel through Cookie settings. This policy is updated when the services or processing described change.

Last updated: 5 September 2026.