Information given under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018). Last updated: 7 November 2026.
1. Data controller
The data controller is QUARTO S.R.L.S., VAT number 15078671003, with its registered office at Campo de' Fiori 34/36, 00186 Roma, which runs Osteria Tavola Magna at the same address.
For any question or request about your data, write to ciao@tavolamagna.it or call +39 06 6819 2721. We have not appointed a Data Protection Officer (DPO), because our activity does not require one (Art. 37 GDPR).
2. What data we use, why, and on what basis
Reservations
When you book a table we collect your name, email, phone, number of guests, date and time, any notes you choose to write, and the language you booked in. We use them to manage your booking, send you the confirmation and contact you if anything changes.
Legal basis: steps you asked for before and under a contract (Art. 6(1)(b) GDPR). This data is necessary: without it we cannot record the booking.
Allergies and intolerances. If you tell us about allergies, intolerances or other health needs in the notes, we use that only to prepare your meal safely. This is special-category data (Art. 9 GDPR): we use it on the basis of your explicit consent, which you give by writing it (Art. 9(2)(a) GDPR), and you can withdraw it at any time. If you prefer, you can tell us in person when you arrive.
Contact form
When you write to us we collect your name, email, phone (if you give it), your message and the language. We use them only to reply. Legal basis: your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering people who contact us (Art. 6(1)(f) GDPR).
IP address and security
We record the IP address of whoever sends a booking or a message and, for bookings, the browser identifier too (the "user agent": the type and version of the browser and operating system). They protect the website from abuse, automated submissions and fake bookings. From the IP address, the management area shows staff the approximate country it comes from, worked out on our own server with a local database (DB-IP) without sending the address to anyone, and the public name of the network it belongs to, obtained with an ordinary DNS query. We do not use this data for anything else. Legal basis: our legitimate interest in keeping the website and the service secure (Art. 6(1)(f) GDPR).
Statistics and marketing, only with your consent
On your first visit a banner asks whether you accept statistics and marketing cookies. Only if you accept them does the website load these services, through Google Tag Manager:
- Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): statistics about visits, such as pages viewed, length of the visit, type of device and browser, approximate country and city, and the website you came from. It shows us the data in aggregate form.
- Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland): how the pages are used (clicks, scrolling, mouse movements), including as recordings of visits and heatmaps. Clarity hides the text you type into forms.
- Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland): measures the visits and bookings that come from our ads on Facebook and Instagram, and lets us show our ads to people who have visited the website. For collecting this data on the website and passing it to Meta, we are joint controllers with Meta (Art. 26 GDPR); what Meta then does with the data it receives is decided by Meta as an independent controller, under its privacy policy.
Google Analytics and Clarity count as Statistics, Meta Pixel as Marketing. Because they all go through Google Tag Manager, they load only once you have accepted both categories; even then, Google's tags start with every consent set to denied (Google Consent Mode). Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). If you reject or close the banner, none of these services loads and the website works just the same. You can change your mind at any time with the cookie button at the bottom left of every page; withdrawing does not affect what was done before.
Google, Microsoft and Meta may transfer data to the United States under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023), in which all three take part.
Booking and message data are never used for advertising or profiling. We make no automated decisions about you (Art. 22 GDPR), and we never sell your data.
3. How long we keep the data
Bookings and messages, including the IP address recorded with them, are kept for 2 years from the date of the booking or message and then deleted. The website's backup copies are encrypted and kept for at most 12 months: data deleted from the website also disappears from the backups within 12 months. If the law requires us to keep something longer (for example during a dispute), we keep it only for that reason and only as long as needed.
Data collected with your consent by Google Analytics, Clarity and Meta Pixel is kept by Google, Microsoft and Meta under their own privacy policies; how long their cookies last is shown in the Cookie Policy.
4. Who handles the data on our behalf
Only the restaurant staff authorised to manage bookings and messages can see the data, along with the providers that help us run the website. These providers act as data processors (Art. 28 GDPR), only on our behalf and on our instructions:
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: hosts the website and its database in data centres in Germany.
- Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy: sends and receives the restaurant's email, including booking confirmations.
- Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: stores the website's backup copies (its R2 service) in data centres in the European Union. The copies are encrypted on our server before they are sent, with a key only we hold, so Cloudflare cannot read them. Cloudflare takes part in the EU-U.S. Data Privacy Framework.
- Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA: receives reports of the website's technical errors, to help us fix them, and keeps them in data centres in the European Union (Germany). We never send it IP addresses, cookies or what you write in our forms. Sentry takes part in the EU-U.S. Data Privacy Framework.
We may disclose data to public authorities only when the law requires it. Booking and message data, backup copies included, are stored only in the European Union.
5. Spam check, social media and reviews
- Spam check. If the forms show the Cloudflare Turnstile check, Cloudflare, Inc. receives your IP address and some technical information about your browser, only to tell a person from an automated program, under its own privacy policy. Legal basis: our legitimate interest in keeping the forms secure (Art. 6(1)(f) GDPR). Cloudflare takes part in the EU-U.S. Data Privacy Framework.
- Photos and videos from Instagram and Facebook. The pictures of our posts are copies kept on this website: viewing them does not put your browser in touch with Meta. If you open a post, you move to the website of Meta Platforms Ireland Limited, where its own privacy policy applies. If you appear in one of our photos and would rather it were not on the website, write to us and we will remove it.
- Google rating. Our server reads the restaurant's Google rating once a day. No visitor data is sent when it does.
6. Security
The website uses an encrypted connection (HTTPS). Only authorised staff can reach the management area, with personal credentials, and the access keys for outside services are stored encrypted. Every night the website saves an encrypted backup copy, and every week we check its integrity automatically.
7. Your rights
At any time you can ask us to:
- tell you what data we hold about you and give you a copy (Art. 15 GDPR);
- correct or complete it (Art. 16);
- delete it (Art. 17);
- restrict its use (Art. 18);
- give it to you in a machine-readable format, or send it to another controller (Art. 20);
- stop using it where we rely on our legitimate interest (Art. 21);
- withdraw a consent you gave us, without affecting what was done before (Art. 7(3)).
Write to ciao@tavolamagna.it: we reply within one month. You also have the right to complain to the Italian data protection authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma (Art. 77 GDPR).
8. Children
The website is not aimed at children under 14. Anyone under 14 may book or write to us only through a parent or guardian (Art. 2-quinquies of the Italian Privacy Code).
9. Cookies
We use the technical cookies the website needs to work and, only with your consent, statistics and marketing cookies. The full list is in the Cookie Policy.
10. Changes
If we change how we use data, we update this page and the date at the top.