Privacy Policy on the Processing of Personal Data

Effective as of 09/02/2026 – updated 12/10/2026 (online booking, website forms, cookies).

INTRODUCTION

This Privacy Policy is drafted in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and with the Italian Privacy Code (Legislative Decree No. 196 of 30 June 2003).
This document has also been prepared in accordance with the guidelines issued by the Italian Data Protection Authority, in particular the Guidelines on combating spam dated 4 July 2013.

Data Controller

Trianon Borgo Pio
Piazza delle Vaschette 13
VAT No.: IT05704971000
Email: info@carosellorooftop.it

The Data Controller has not appointed a Data Protection Officer (DPO).
Therefore, any request for information may be sent directly to the Data Controller using the contact details provided above.

Website

This Privacy Policy applies to the website of the Data Controller (hereinafter, the “Website”).

GENERAL INFORMATION

This document describes how the Data Controller processes the personal data provided by users through the Website.

Below is a description of the main processing activities, the relevant legal basis, whether the provision of data is mandatory or optional, and the consequences of any refusal to provide personal data.

Where the user enters personal data relating to third parties on the Website, the user guarantees that they have obtained the consent of the data subjects and undertakes to indemnify and hold harmless the Data Controller from any liability.

Responding to Requests

Personal data (first name, surname, email, phone number, preferred date, number of guests and message) are processed to respond to information requests and event quote requests submitted by users through the Website forms or by email. On submission, users receive an automatic confirmation email.

Provision of data: optional
Legal basis: legitimate interest of the Data Controller
Consequences of failure to provide data: inability to respond to requests

General Marketing

Subject to the user’s consent, the Data Controller may send promotional communications, advertising material and/or newsletters relating to its own products or services or those of third parties.

Legal basis: consent
Provision of data: optional
Consequences of refusal: inability to receive promotional communications
Communication channel: email address provided by the user

Profiling

Subject to the user’s consent, personal data may be processed for profiling purposes, in order to analyse user preferences and consumption habits and to send personalised communications.

Legal basis: consent
Provision of data: optional
Consequences of refusal: no profiling and no personalised communications

Disclosure of Data

The Data Controller does not transfer or sell users’ personal data to third parties.

Geolocation

The Website does not use its own geolocation tools. Only with consent to statistics cookies, Google Analytics may derive an approximate location (city or region) from the IP address, in aggregated form.

Curriculum Vitae

It is not possible to submit curriculum vitae through the Website.
Therefore, personal data are not processed for this purpose.

Online Table Booking

Users can book a table (aperitif and Sunday brunch) through the Scidoo booking system (scidoo.com), which opens in a window on the Website. To manage the booking, first name, surname, email, phone number, date, time, number of guests and any notes are processed.

The data are collected and stored on the Scidoo platform, a provider that processes them on behalf of the Data Controller, and are used only to manage the booking, the waiting list and related communications (confirmation, changes, cancellation).

Provision of data: required to book
Legal basis: performance of pre-contractual and contractual measures requested by the user (Art. 6(1)(b) GDPR)
Consequences of not providing data: online booking is not possible; users can still book by phone

If users disclose food allergies or intolerances, these data are processed only to serve dishes safely, with the explicit consent given by providing them (Art. 9(2)(a) GDPR), and are not used for any other purpose.

Photographs and Videos

The Data Controller does not request the publication of photographs or videos depicting users.

Web Scraping

Any use of automated processes (including scraping, crawling, or spidering) to access, acquire, or monitor the Website without written authorisation is strictly prohibited.
Any violation may result in suspension of access and legal action to protect the Data Controller’s interests.

Communication of Personal Data

In the course of its activities, the Data Controller may communicate personal data to:

Public Authorities, where required by law
Legal, tax, and administrative professionals and consultants
Authorised employees and collaborators
IT service providers, hosting and maintenance providers
CRM platforms used for sending communications
The provider of the table booking platform (Scidoo)
Google Ireland Ltd. (Google Analytics, Google Ads, Google Maps) and Meta Platforms Ireland Ltd., only for the cookies and tools the user has consented to: see the Cookie Policy
Banks and payment service providers
Couriers and shipping companies for product delivery

This list may be updated based on operational requirements.

Art. 3 – Data Retention

Personal data are retained only for as long as necessary to fulfil the purposes for which they were collected, in particular:

Contractual purposes: 10 years
Marketing purposes: 24 months
Information and quote requests: for as long as needed to handle them and in any case no longer than 24 months
Bookings: for as long as needed to manage the booking and to meet legal obligations
Profiling purposes: 12 months
Accounting records: 10 years (Article 2220 of the Italian Civil Code)

Art. 4 – Transfer of Personal Data

Personal data may be transferred:

To the United States, on the basis of the European Commission’s adequacy decision
To the United Kingdom, recognised as providing an adequate level of protection as of 28 June 2021

Any transfers to non-EU countries not recognised as adequate will be specified in this section.

Art. 5 – Data Subject Rights

Users have the right to:

access their personal data
request rectification or erasure
request restriction of processing or object to processing
request data portability
withdraw consent at any time
lodge a complaint with the competent Supervisory Authority

Requests may be sent to info@carosellorooftop.it.

Art. 6 – Amendments

The Data Controller reserves the right to amend this Privacy Policy at any time.
Any changes will be published on the Website and, where relevant, communicated by email.

Privacy policy