Privacy notice and cookie policy

Privacy and cookies

Here I explain, in plain words, which data I process when you use the website, book, buy a gift card, join the Tessera del Nipote, ask me for a party or a company event, use the Wi-Fi in the restaurant or apply for a job, and how to use your rights. I is the restaurant: the data controller is Samanao S.r.l.

Last updated: 15 October 2026

This English version is a translation provided for convenience. In case of doubt or discrepancy, the Italian text prevails: Privacy policy in Italian.

1Who the data controller is and how to contact them

The data controller is Samanao S.r.l., the company that runs the Nonna Emilia restaurant and this website. When the text says «I», it is the restaurant speaking.

Company name

Samanao S.r.l.

Registered office

Via Monte Bianco 33, 20097 San Donato Milanese (MI)

Tax code and VAT number

07224210968

REA number (Milan Companies Register)

MI-1944550

Share capital

10,000 euro, fully paid up

PEC (certified email)

info@pec.nonnaemilia.it

Email

info@nonnaemilia.it

Phone

+39 02 5275176

No Data Protection Officer (DPO) has been appointed, because it is not mandatory for a restaurant. For anything concerning privacy, write to privacy@nonnaemilia.it.

2Which data I process

• Contact detailsExamplesFirst name, surname, phone, emailWhere it comes fromYou give them to me in the forms, by phone, on WhatsApp or by email
• Booking detailsExamplesDay, time, number of guests, occasion, notesWhere it comes fromBooking forms and phone
• Allergies and intolerancesExamplesWhat you write in the notes or tell the staff in the dining roomWhere it comes fromYou give them to me, only if you wish
• PurchasesExamplesGift cards and packages, amounts, billing details if you ask for an invoiceWhere it comes fromGift card form and the restaurant till. Payment card details are handled only by the payment provider: I never see them
• Tessera del Nipote (loyalty card)ExamplesSign-up, points, rewards, visits, preferences if you consentWhere it comes fromLoyalty card form and the restaurant till
• Job applicationsExamplesContact details, answers to the questions, CV, experienceWhere it comes fromThe Work with me form (in Italian) or email
• Browsing dataExamplesIP address, pages viewed, device, referral source, events such as a click on «Book»Where it comes fromThe website, even without consent, for aggregate statistics and the signals sent to Google, both without cookies (see Cookies); if you consent, also the statistics and advertising tools
• Wi-Fi in the dining roomExamplesThe data you enter on the login page and the technical connection dataWhere it comes fromThe restaurant's Wi-Fi login page, managed by Pienissimo
• ImagesExamplesPhotos and videos of guests and staff published on the websiteWhere it comes fromFilmed with the written consent of the people shown

If you book or buy a gift card for someone else and give me their details, make sure they agree: I will use them only for that booking or that card.

3Why I process them, on which legal basis and for how long

Each processing activity has its own purpose and its own retention period, or the rule that sets it. When that period ends, the data is deleted or made anonymous.

• Booking a table, a Percorso (tasting menu) or an event, and confirming it to youLegal basisContract and pre-contractual measures (Art. 6(1)(b) GDPR)For how long24 months from the last booking
• Taking allergies and intolerances into accountLegal basisExplicit consent, which you give by writing them down (Art. 9(2)(a) GDPR)For how longKept with the booking, then deleted
• Selling and managing gift cards and packagesLegal basisContract; tax and accounting obligations (Art. 6(1)(b) and 6(1)(c))For how longTax documents 10 years (Art. 2220 of the Italian Civil Code)
• Tessera del Nipote: sign-up, points and rewardsLegal basisContract of the loyalty programme (Art. 6(1)(b))For how longAs long as you remain a member, then 12 months
• Tessera del Nipote: tailored offers based on your visitsLegal basisSeparate, optional consent (Art. 6(1)(a))For how long12 months from consent, renewable
• Promotional messages by email, SMS and WhatsAppLegal basisSeparate, optional consent (Art. 6(1)(a); Art. 130 of the Italian Privacy Code)For how longUntil you withdraw it, and in any case 24 months from the last contact
• Requests for parties, ceremonies, companies and groupsLegal basisPre-contractual measures (Art. 6(1)(b))For how long24 months from the request
• Job applicationsLegal basisPre-contractual measures (Art. 6(1)(b); Art. 111-bis of the Italian Privacy Code)For how long12 months from submission; 24 months if you consent to future recruitment
• Replying to messages, phone calls and emailsLegal basisPre-contractual measures or legitimate interest in replying to you (Art. 6(1)(b) and 6(1)(f))For how longThe length of the conversation, then 24 months
• Providing free Wi-Fi in the dining roomLegal basisContract, i.e. the service you request (Art. 6(1)(b)); separate consent if you choose to receive messages (Art. 6(1)(a))For how longThe length of the connection for technical data; the data you enter to log in, 24 months from the last connection; consent to messages until you withdraw it
• Website visit statistics with cookies (Google Analytics, Microsoft Clarity)Legal basisConsent (Art. 6(1)(a); Art. 122 of the Italian Privacy Code)For how longCookie duration as listed in the Cookies section; data in Google Analytics 14 months
• Aggregate statistics on visits and page speed, without cookies (Vercel Web Analytics and Speed Insights)Legal basisLegitimate interest in understanding how the website is used and keeping it fast (Art. 6(1)(f))For how longThe period set by Vercel's service; only totals remain, which do not identify visitors
• Estimating how many visits and bookings come from ads, even without consent, through cookieless signals to Google (see Cookies)Legal basisLegitimate interest in measuring the results of ads in aggregate form (Art. 6(1)(f))For how longThe period set by Google for these signals
• With cookies: measuring bookings that come from ads and showing ads to people who already know the restaurant, including through lists of customers who have given their consentLegal basisConsent (Art. 6(1)(a); Art. 122 of the Italian Privacy Code)For how longCookie duration as listed in the Cookies section; lists updated at every upload
• Website security and abuse preventionLegal basisLegitimate interest in protecting the website (Art. 6(1)(f))For how longThe technical period set by the hosting provider
• Legal obligations and requests from the authoritiesLegal basisLegal obligation (Art. 6(1)(c))For how longThe period required by law
• Photos and videos of guests and staff on the websiteLegal basisWritten consent of the person filmed (Art. 6(1)(a))For how longAs long as the consent remains valid

The data marked as mandatory in the forms is needed to give you what you ask for: without it I cannot confirm the booking, issue the gift card or assess the application. Everything else, consents included, is optional and does not change the service. No decision concerning you is made by solely automated means.

4Who processes the data with me

To run bookings, payments, the website and messages I rely on a few suppliers. They process data on my behalf, under a contract that obliges them to protect it (Art. 28 GDPR), or as independent controllers for their own services.

• Pienissimo ProWhat they doBooking and customer management system; booking, gift card and Tessera del Nipote forms; sending confirmations and, with consent, messages by email, SMS and WhatsApp; Wi-Fi login page in the dining room. The forms are Pienissimo pages embedded in my website, with their own cookie rulesWhere and with which safeguardRepublic of San Marino, with standard contractual clauses
• TheForkWhat they doIf you book through TheFork, I receive the booking details from their service. TheFork is the controller of the data you leave with TheForkWhere and with which safeguardFrance, European Union, according to its privacy notice
• Stripe, PayPal and SatispayWhat they doOnline payment for gift cards, inside the form, with the method you choose: this is the only use I make of them. They are independent controllers of payment dataWhere and with which safeguardEuropean Union and United States, according to their privacy notices
• Vercel Inc.What they doHosts the website and records its technical data; receives the forms for parties, companies and job applications and passes them to Brevo without keeping their content; counts visits and measures page speed in aggregate form, without cookies (Web Analytics and Speed Insights)Where and with which safeguardUnited States, EU-US Data Privacy Framework
• BrevoWhat they doSends the emails from the forms for parties, companies and job applications, and the confirmations to the people who writeWhere and with which safeguardFrance, European Union
• Aruba S.p.A.What they doThe restaurant's emailWhere and with which safeguardItaly
• Google (Analytics, Ads, Tag Manager)What they doVisit statistics, measurement of bookings from ads, and advertising: on the pages of my website, cookies only with your consent; without consent Google receives the cookieless signals described in the Cookies sectionWhere and with which safeguardIreland and United States, EU-US Data Privacy Framework
• Meta Platforms Ireland (Facebook and Instagram Pixel)What they doMeasurement of bookings from ads, and advertising, on the pages of my website only with your consent. For the collection and transmission of this data to Meta I am joint controller with Meta (Art. 26 GDPR). If you accept marketing cookies, my server sends Meta the same actions measured by the pixel, with the same identifier and together with your IP address and browser type, so they are not counted twice (Conversions API)Where and with which safeguardIreland and United States, EU-US Data Privacy Framework
• Microsoft (Clarity)What they doHeatmaps and session recordings, to understand where the website is awkward to use, only with your consentWhere and with which safeguardIreland and United States, EU-US Data Privacy Framework
• Metricool Software (statistics)What they doCounts visits to the website and which page you come from, to compare them with the results of my social media; only with your consent to statistics. It does not store cookies on your device: it receives the page viewed, the window size, the referring page, the IP address and the browser typeWhere and with which safeguardSpain, European Union
• Usercentrics (Cookiebot)What they doShows the cookie banner and keeps proof of your choicesWhere and with which safeguardDenmark, European Union
• WhatsApp (Meta)What they doIf you write to me on WhatsApp, the conversation goes through their serviceWhere and with which safeguardIreland and United States, EU-US Data Privacy Framework

The data can also be seen by authorised restaurant staff, the accountant, the payroll consultant (for accepted applications) and, if required by law, the authorities. Internal notifications of new requests and applications sent via Telegram contain only the type of request, a reference number and, for applications, whether a CV is attached: no name, contact details or content of the request.

5Data outside the European Union

• Some suppliers are based or have servers in the United States: the transfer is based on the European Commission's adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) and, if a supplier does not participate in it, on the standard contractual clauses approved by the Commission.
• The booking management system processes data in the Republic of San Marino, with standard contractual clauses.
• You can ask me for a copy of the safeguards by writing to privacy@nonnaemilia.it.

6Your rights

• Access: know what data I hold and receive a copy (Art. 15 GDPR).
• Rectification: correct or complete it (Art. 16).
• Erasure: have it deleted, unless I am required by law to keep it (Art. 17).
• Restriction: have its use suspended (Art. 18).
• Portability: receive it in a readable format or have it transferred to another controller (Art. 20).
• Objection: object to processing based on legitimate interest and, always, to marketing (Art. 21).
• Withdrawal of consent: at any time, without affecting what was done before. For promotional messages, the unsubscribe link or keyword in every message is enough.
• Complaint: you can contact the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Art. 77).

Write to privacy@nonnaemilia.it or ask in the restaurant. I reply within one month; if the request is complex I will let you know and may take up to two more months (Art. 12 GDPR). It is free of charge.

7Minors

The website, the forms and the Tessera del Nipote are not intended for children under 14: under 14, consent is given by a parent (Art. 2-quinquies of the Italian Privacy Code). You must be at least 16 to apply for a job. If I find data of a minor collected without consent, I delete it.

8How I protect the data

• The website uses encrypted connections only (HTTPS).
• The booking and payment forms belong to specialised suppliers: card details never pass through the website.
• Only authorised staff, with personal credentials, can access my management system and the email.
• If a data breach occurs that puts you at risk, I notify the Italian Data Protection Authority within 72 hours and, where necessary, you as well (Arts. 33 and 34 GDPR).

9Cookies and similar tools

• Technical cookies are needed for the website and the forms to work and to protect them from fraud: they do not require consent.
• On the pages of my website, until you choose, and even if you refuse, I do not store statistics or advertising cookies on your device. Google does, however, receive cookieless signals: the page viewed, the time, the browser type, the language, the screen size and the IP address, which Google processes under its own rules. They are used to estimate, in aggregate form, how many visits and bookings come from ads. If you accept, I also activate the Google Analytics, Google Ads, Meta and Microsoft Clarity cookies listed below and, with statistics, the Metricool counter, which does not store cookies.
• Without consent I also count visits and measure page speed with Vercel's tools, in aggregate form and without cookies.
• In the banner you can accept all or reject all; with «Customise» you choose category by category. On the pages of my website I do not use cookies in the «Preferences» category. Your choice is saved and I will not ask you again for at least 6 months, unless something important changes.
• You can change your mind at any time with the button below or with «Cookie preferences» at the bottom of every page.
• The banner and the record of your choices are managed by Cookiebot. On the pages of my website Google receives your consent signals (advanced consent mode) and its tools adapt accordingly.

The list above comes from Cookiebot's latest automatic scan (9 September 2026, on the previous version of the website) and is limited to the tools this website uses. Below you will also find Cookiebot's full list, which updates itself at every new scan.

You can also delete or block cookies in your browser settings: some parts of the website, such as the forms, may stop working.

10Changes to this notice

If something important changes (new suppliers, new purposes), I update this page and the date at the top; if your new consent is needed, I will ask you for it. This version replaces the privacy notice of 6 February 2025.