Privacy policy

Privacy notice updated on 11 November 2026. Items marked for confirmation must be completed before publication.

Controller and contact

Ital eventi Srl, Piazza delle Coppelle 44, 00186 Rome, Italy. VAT number 05444131006. Privacy questions and requests: reservations@ristorantemaccheroni.com.

Reservation requests

The form collects contact and request details, including name, email, telephone, date, time, guest count, table preference, reply language and optional notes.

The information provided in the form is used to handle the reservation request and subsequent communications. The restaurant receives the request by email. The upcoming release is intended to send the customer an automatic acknowledgement, which does not confirm the reservation. Availability is confirmed separately by the restaurant.

Only the owners and authorised staff can access reservation requests through Roundcube. Roundcube is the interface used to access the mailbox, not the name of the hosting or email provider.

Emails relating to past reservations are deleted monthly, including copies in the Sent and Trash folders. Requests for future reservations are retained until they have been handled and are then included in the subsequent monthly deletion. This is an operational procedure, not deletion automated by the reservation form software. This confirmation covers the mailbox folders and does not extend to the provider’s backups, which still need to be verified.

For requests concerning your personal data, please email reservations@ristorantemaccheroni.com.

Legal basis and completing the form

The legal basis for handling your reservation request and necessary communications is Article 6(1)(b) GDPR: taking steps at your request prior to entering into a contract. The “I have read the privacy notice.” checkbox acknowledges that you have read the notice; it is not consent to processing for handling your reservation request.

The form technically requires a valid future date and time, number of guests, seating preference, first name, last name, mobile number, email address and reply language (Italian or English). If you select “30+ guests”, you must enter the exact number, from 31 to 100; the overall limit is 100 guests. You must also tick the checkbox acknowledging that you have read the privacy notice. You cannot submit a request through the form without validly completing these fields and acknowledging the notice. These are technical requirements of the form, not fields described as mandatory by law: a technical requirement does not, by itself, establish the legal necessity of each item of data.

Notes are optional: leaving them blank does not prevent you from submitting a request. Do not include sensitive data or other unnecessary personal information in your notes. For requests by email, you can use the restaurant’s contact address provided in this notice.

This legal basis applies only to handling your request and necessary communications. It is not extended to Analytics, security, logs or the deduplication archive, which require separate assessments.

Protection against duplicate submissions

The upcoming release provides for a private technical store to recognise repeated requests and avoid duplicate emails. It stores an HMAC fingerprint derived from the request data, a hash of the submission identifier, a technical creation timestamp, the processing state and a summary outcome for acquisition and the receipt. It does not store contact details or booking contents in plain text, or the IP address. The fingerprints can nevertheless link identical requests: they are not regarded as anonymous merely because they are hashed.

Request records expire 24 hours after creation; repeated submissions do not renew this period. Expired records and their linked identifiers are deleted during request-acquisition operations that complete their database transaction or when the cleanup procedure runs. If there are no requests and cleanup does not run, expired records can remain stored: periodic cleanup must be configured on the server. The technical key needed for comparisons remains in the store throughout its operational lifetime and has no automatic expiry. Deleting records is not equivalent to securely erasing database pages or any backup copies, whose handling remains to be verified.

The store is intended to reside outside the public website directory, with access restricted to the owners and appointed technicians. The application account, permissions and actual server administration privileges must be checked during configuration. It is separate from temporary abuse-prevention counters and the emails in the mailbox accessed through Roundcube, which follow the monthly procedure described above. The legal basis for this mechanism requires a separate assessment that has not yet been approved; it is not automatically attributed to the pre-contractual steps for handling a booking request.

The restaurant does not currently have a newsletter, and no newsletter service is active. Collection of newsletter sign-up requests through the reservation form has been suspended.

Hosting and email service provider

The controller uses UPANE S.R.L., VAT number 12013781005, to provide website hosting and email services.

Browsing and measurement

The confirmed choice for this release is to retain Google Analytics G-8E1C89952Y as an optional statistics service, enabled only after consent to statistics (the performance category), with blocking before a choice and after refusal. The local code keeps ad_storage, ad_user_data and ad_personalization denied, disables Google Signals and advertising personalisation signals, and does not configure user-provided data collection. No marketing services are being introduced. These code restrictions remain distinct from the settings permitted in the Google interface and the limitations of automatic-measurement verification described below.

A local preference remembers cookie choices. The local code starts Google Analytics 4 only after performance consent has been successfully saved; optional services remain disabled before a choice, after refusal or when storage is unavailable. Local browser checks with simulated external requests observed no Analytics loading, requests or pings before consent or after refusal. The application code uses the page URL without query strings or fragments, limits referral information to the origin and sends only predefined targets for navigation clicks. The application commands and simulated payloads examined contained none of the synthetic first name, last name, email, phone, notes or reservation details. This does not verify the contents of automatic measurements generated by Google’s library and remote configuration, which require separate checks. The service may process browser identifiers and usage data. Meta Pixel is disabled and has no ID in the local configuration. See the Cookie policy for details and preference controls.

Details verified in the Google Analytics panel: property “Maccheroni — Sito web”, stream “Maccheroni — Web”, URL https://ristorantemaccheroni.com, measurement ID G-8E1C89952Y. Enhanced measurement is enabled. This check identifies the stream but does not demonstrate that tracking is correctly blocked before consent or that events contain no personal data. The actual use of advertising features on the site, the status of the service provided by the studio and the service terms still need to be verified; the Analytics section remains provisional.

According to confirmation from the account creator, the Analytics administrator accounts are limited to the studio and the restaurant; no other users, groups or access by UPANE have been reported. The account screenshot referred to shows both with administrator permissions. These permissions describe technical access and do not automatically determine the studio’s legal role in processing personal data: the status of the service provided by the studio still needs to be clarified.

In the property settings, granular location and device data collection is enabled in all 307 of 307 regions; location is described at city level, not as precise GPS geolocation. Ads personalisation is allowed at property level in all 307 of 307 regions. The earlier screenshots show Google Signals and user-provided data collection as disabled. The “User data collection acknowledgement” section displays an acknowledgement button, labelled “Ne prendo atto” in the Italian panel, which was not pressed during the check.

These settings describe what is allowed in the panel, not what is actually used on the site. They do not demonstrate active campaigns, remarketing or sharing with Google Ads. Nor do they establish that all advertising features are disabled. The “Maccheroni — Sito web” property has no completed Google Ads links, links pending approval or requested links. This is separate from ads personalisation, which remains allowed in the property settings, and does not demonstrate that there are no other advertising tags on the site. The local application code examined does not configure User-ID or user_data and contains no Analytics transmission of form data, including hashed form data. This finding concerns the local sources and does not certify the remote configuration or live site; the User-ID screen only describes the feature.

The verified Analytics data-sharing settings disable sharing for “Google products and services” and contributions to modelling and business insights. Sharing for “Recommendations for your business” is also disabled, while sharing for Google technical support is allowed. This authorisation is separate from the administrator accounts and does not demonstrate that support staff have actually accessed the data. The Google data processing terms provide, for covered services, for processing on behalf of the customer in countries where Google or its subprocessors have facilities, including countries outside the European Economic Area (EEA). According to Google’s international data transfer documentation, covered transfers of EEA data to the United States rely on the EU-U.S. Data Privacy Framework; standard contractual clauses may apply to certain other transfers under the service terms and Appendix 3A. Storage exclusively in Italy or Europe is therefore not claimed. These mechanisms do not automatically guarantee compliance of the entire site. The provider of the standard Google Analytics service is Google Ireland Limited, identified as the contracting party in the official Italian service terms. The provider’s Irish location does not mean that all data remains in the EU. The organisation details in the DPA and the actual application of the terms and transfer mechanism to the service used still need to be verified.

The following retention settings have been verified in the “Maccheroni — Sito web” property: event data 2 months; user data 14 months; “Reset on new user activity” enabled. New activity can therefore restart the user-data retention period. These controls do not affect most standard reports based on aggregated data: they do not mean that all Analytics data is deleted within 2 or 14 months. These periods are separate from the configured lifetime of Analytics cookies (180 days) and the duration of the consent choice (6 calendar months), which remain unchanged.

External links

Google Maps, reviews and social accounts are links, not embedded services. Opening them leaves the Maccheroni site and their respective privacy policies apply.

Rights and outstanding information

Contact the controller to exercise, where applicable, rights of access, rectification, erasure, restriction, objection and portability, or to withdraw consent. You may lodge a complaint with the Italian Data Protection Authority.

Before publication, confirm: separate assessments for Analytics, security and logs; the legal basis and operational configuration of the deduplication store; the hosting and email provider’s contractual terms and data processing agreement, processors and recipients; any transfers and safeguards; retention of technical logs and backups; other aspects of Analytics processing; Google contractual terms. Missing information is not replaced with assumptions.