Privacy policy

Who processes your data

This notice, given under Article 13 of Regulation (EU) 2016/679 (GDPR), explains how the personal data of people who visit www.hyleristorante.it and use its services are processed.

The data controller is:

• LAB S.r.l.
• VAT and tax code 03988910786 · REA CS-270623
• Share capital €10,000 fully paid
• Località Torre Garga 39, 87055 San Giovanni in Fiore (CS), Italy
• Email: info@hyleristorante.it
• PEC: lab87055@pec.it

What data we process

Browsing data. The website is hosted by Aruba S.p.A. on servers in Italy. Like any web server, it automatically records some technical data about requests (IP address, date and time, page requested, browser type), used only to run the website and protect it from abuse. The domain uses Cloudflare DNS servers, which resolve the website address but do not receive the content of visits.

Fonts. Some fonts are provided by Adobe Fonts: to display them, your browser contacts Adobe’s servers, which receive technical data such as your IP address and browser type. Adobe states that it does not use cookies for this service.

Virtual assistant. At the bottom right there is a virtual assistant (chat) provided by Biafora Resort & Spa through biafora.it. It only starts if you open it: the questions you type and technical data about the conversation (IP address, date and time) are sent to biafora.it servers to generate the answer. To display the window, the chat also loads some fonts from Google Fonts, which receives your IP address and browser type. Please do not type unnecessary personal data in the chat, such as health or payment details; to book, use the Book page.

Statistics. Only if you accept in the cookie banner, we use Google Analytics 4 to learn in aggregate how the website is used (pages viewed, origin, device). IP addresses are not logged in full and Google advertising signals are turned off. Details in the Cookie policy.

Bookings. Bookings are made through TheFork, whose form loads only on the Book page. The data you enter (name, contact details, date, number of guests, notes, card guarantee) are collected by TheFork as an independent controller. The restaurant receives from TheFork the data needed to manage the booking; card details are never visible to the restaurant.

Allergies and intolerances. Information about allergies, intolerances and dietary preferences that you give us is health data. We use it only to prepare your menu and keep it only as long as needed; telling us is your choice, and counts as explicit consent to this use.

Gift cards. Gift cards are bought through Bonkdo, which processes buyer and payment data as an independent controller. The restaurant receives the information needed to manage the gift card (code, recipient, amount, status).

Job applications. Through the “Work with us” form we collect first and last name, email, role of interest, message and CV. The form sends these data to us by email; they are not published or stored on the website.

Email. If you write to us, we process your address and the content of your message in order to reply.

Why, and on what legal basis

• Running and protecting the website: the controller’s legitimate interest (Art. 6(1)(f) GDPR).
• Visitor statistics with Google Analytics: consent (Art. 6(1)(a)), which you can withdraw at any time.
• Answering questions in the virtual assistant: pre-contractual steps at your request or legitimate interest in giving information about the restaurant (Art. 6(1)(b) and (f)).
• Managing bookings and gift cards: performance of a contract or pre-contractual steps (Art. 6(1)(b)) and accounting and tax obligations (Art. 6(1)(c)).
• Using allergy and intolerance information for your menu: explicit consent (Art. 9(2)(a)).
• Replying to requests: pre-contractual steps or legitimate interest (Art. 6(1)(b) and (f)).
• Assessing job applications: pre-contractual steps at your request (Art. 6(1)(b)).
• Complying with the law: legal obligation (Art. 6(1)(c)).

Do you have to give us your data?

Browsing data are needed to visit the website. Other data are optional, but without them we cannot complete a booking, sell a gift card, reply to you or assess an application.

How we process them

With IT tools, by authorised and trained staff, with appropriate security measures. We make no decisions based solely on automated processing.

Who we share them with

• Authorised staff and collaborators of the restaurant.
• Aruba S.p.A. (website hosting and email) and Cloudflare (DNS service), as processors.
• Biafora Resort & Spa (biafora.it), for the virtual assistant.
• Adobe (fonts) and Google (fonts loaded by the chat).
• Google Ireland Limited, for Google Analytics statistics, only with your consent.
• TheFork and Bonkdo, as independent controllers for their own services.
• Advisers such as our accountant and payroll consultant, for administrative obligations.
• Public authorities, where required by law.

Transfers outside the European Union

Adobe, Google and Cloudflare may process data in the United States; the same may apply to the technical providers of the virtual assistant. Transfers are based on the EU-U.S. Data Privacy Framework or on standard contractual clauses approved by the European Commission. The website and email are hosted in Italy by Aruba. For TheFork and Bonkdo, their own privacy notices apply.

How long we keep them

• Browsing data: only as long as needed for website security, unless required to investigate crimes.
• Google Analytics statistics: 14 months, then deleted automatically.
• Conversations with the virtual assistant: as long as needed to answer and improve the service, under biafora.it’s rules.
• Email requests: usually up to 12 months after the request is closed.
• Applications and CVs: up to 12 months after receipt.
• Allergies and intolerances: until the day of your visit, unless you ask us to remember them.
• Bookings and gift cards: for managing the service and for accounting and tax obligations, up to 10 years.

After that, data are deleted or anonymised.

Your rights

At any time you can ask to access, correct or delete your data, restrict or object to processing, receive your data in a portable format, and withdraw consent without affecting processing already carried out (Articles 15–22 GDPR).

To exercise them, write to info@hyleristorante.it or, by certified email (PEC), to lab87055@pec.it. You can also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

For processing carried out by TheFork, Bonkdo and Adobe as independent controllers, please contact them directly.

Changes

This notice may change because of new laws or new website services. The version in force is always on this page, with its update date.