Privacy and Cookie Policy

Last updated: 31 October 2026

This notice explains how we process the personal data of visitors to the website www.ilbeericcioshop.com (the “Site”) and of anyone who contacts the restaurant using the details shown on the Site, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Privacy Code”), as amended by Legislative Decree 101/2018.

1. Data controller

Il Beericcio di Mancini Daniele
VAT no. 03353410545
Registered office: Via Monte di Pale 14 B, 06034 Foligno (PG), Italy
Restaurant: Via Roma 23, 06038 Spello (PG), Italy
Phone: +39 0742 263 233 – +39 338 978 4455

The Controller has not appointed a Data Protection Officer (DPO), as it is not required to do so.

2. What data we process

a) Browsing data

As with any website, the servers hosting the Site automatically record some technical data in their standard system logs: IP address, date and time of the request, page requested, response code, browser type and operating system, and the referring page, if any. This data is not used to identify visitors, but it is needed to run the Site, keep it secure and detect any misuse.

The Site does not use statistics or analytics tools (e.g. Google Analytics), advertising pixels (e.g. Facebook Pixel), profiling cookies, or embedded maps or videos. The Site has no contact forms and comments are disabled.

b) Data you give us (bookings and enquiries)

If you contact us by phone or via WhatsApp (the “call” and “WhatsApp” buttons on the Site), we process the data you choose to give us: name, phone number, date, time and party size of the booking, and the content of your messages. If you choose to tell us about any food allergies or intolerances, this information may reveal health data: we will use it only to prepare your order safely.

c) Online orders

The online ordering button takes you to the external platform GloriaFood. The data entered for your order (e.g. name, phone number, delivery address, order details) is collected through that platform and passed to the Controller so that the order can be prepared and delivered. Processing carried out directly by the platform (account, cookies, service security) is governed by GloriaFood’s privacy policy, available on the platform’s website.

d) Staff-only area

The “Gestione menù” (menu management) page is an area reserved exclusively for the restaurant’s authorised staff and is used to update the menu. For staff we process: username, email address (also used for password recovery), password stored only in encrypted form (irreversible hash), IP address and time of login attempts (to block repeated attempts and protect the account) and a technical session cookie. Likewise, the Site’s administrators log in to the WordPress dashboard with their own accounts.

3. Why we process data and on what legal basis

• Running and protecting the Site (browsing data, logs, backups): the Controller’s legitimate interest in providing a secure and efficient website (Art. 6(1)(f) GDPR).
• Handling bookings, orders and enquiries: performance of a contract or of pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Taking account of allergies or intolerances that you tell us about: your explicit consent, given by telling us about them (Art. 9(2)(a) GDPR). You can withdraw it at any time.
• Complying with legal obligations (e.g. tax and accounting obligations relating to orders): legal obligation (Art. 6(1)(c) GDPR).
• Managing staff and administrator accounts and login security: working relationship with staff (Art. 6(1)(b) GDPR) and legitimate interest in the security of our systems (Art. 6(1)(f) GDPR).
• Displaying the Site in its intended typefaces (Google Fonts, see section 5): legitimate interest in presenting the Site correctly (Art. 6(1)(f) GDPR).

We do not make decisions based solely on automated processing and we do not carry out profiling.

4. How we process data and how long we keep it

Data is processed electronically and, where necessary, on paper, by authorised persons and with appropriate security measures (encrypted HTTPS connection, password-protected access, limits on login attempts).

• Browsing logs: for as long as strictly necessary for technical and security purposes, in line with the hosting provider’s retention periods, unless needed to investigate offences or unlawful acts.
• Bookings and messages: for as long as needed to handle the booking or enquiry; information on allergies and intolerances is used only for that service and is not stored.
• Order data: for as long as needed to fulfil the order; tax and accounting records are kept for 10 years as required by law (Art. 2220 of the Italian Civil Code).
• Staff and administrator accounts: for as long as the account is active; login attempt data (IP address) is kept only for the short time the protection mechanism technically needs.
• Backup copies: the Site makes regular backups of its content and database (UpdraftPlus plugin), stored on the Site’s server; older copies are replaced by newer ones on a rotating basis.

5. Who we may share data with

Data is never published or sold. It may be accessed by:

• Hosting provider (Aruba S.p.A., with servers in the European Union), which hosts the Site and its logs and backups, acting as data processor.
• Google Fonts (Google Ireland Ltd / Google LLC): some pages of the Site load typefaces from Google’s servers (fonts.googleapis.com and fonts.gstatic.com). To deliver the fonts, your browser connects directly to Google, which therefore receives your IP address and technical information about your browser. Google Fonts does not set cookies. Google processes this data as an independent controller under its own privacy policy (policies.google.com/privacy).
• WhatsApp (WhatsApp Ireland Ltd, Meta group): if you choose to message us on WhatsApp, the service processes your data as an independent controller under its own privacy policy.
• GloriaFood: if you use the online ordering button, the platform processes the data you enter under its own privacy policy.
• Facebook and Instagram (Meta Platforms Ireland Ltd): the Site contains only simple links to our social media pages, with no embedded plugins or buttons. No data is sent to Meta until you click a link; from then on, Meta’s privacy policy applies.
• Consultants and professionals (e.g. our accountant), to meet legal obligations, and public authorities where required by law.

6. Transfers of data outside the European Union

The Controller does not directly transfer data outside the EU. However, Google (for Google Fonts) and Meta (for WhatsApp, Facebook and Instagram) may also process data in the United States. Google LLC and Meta Platforms, Inc. are certified under theEU-U.S. Data Privacy Framework, which the European Commission recognised as adequate in its decision of 10 July 2023 (Art. 45 GDPR); in other cases these providers use the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).

7. Your rights

You can exercise your rights under Articles 15–22 GDPR at any time:

• access to your data and a copy of it (Art. 15);
• rectification of inaccurate or incomplete data (Art. 16);
• erasure (“right to be forgotten”) where applicable (Art. 17);
• restriction of processing (Art. 18);
• portability of the data you have given us (Art. 20);
• objection to processing based on legitimate interest (Art. 21);
• withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7).

To exercise your rights, contact the Controller using the details above (by phone, or by post to the registered office). We will reply without undue delay and in any case within one month of your request.

If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it) or to take legal action before the courts.

Giving us your data is optional, but without the necessary data we will not be able to handle your booking, order or enquiry.

8. Cookies and similar technologies

Cookies are small text files that websites save in your browser. The Site uses technical cookies only and equivalent technical tools needed for it to work. It does not use profiling, statistics or third-party cookies.

Under Article 122 of the Italian Privacy Code and the Garante’s “Guidelines on cookies and other tracking tools” of 10 June 2021, technical cookies do not require the user’s consent: this is why the Site does not show a cookie banner.

Ordinary visitors to the public pages (menu, home page) receive no cookies from the Site. The cookies listed below are set only in the login areas reserved for staff and administrators; the only technical tool also used on public pages is the session storage item wpEmojiSettingsSupports, which contains no personal data.

Google Fonts. As explained in section 5, some pages load fonts from Google’s servers. Google Fonts does not store cookies in your browser, but connecting to Google’s servers means your IP address is sent to Google.

External links. Links to GloriaFood, WhatsApp, Facebook and Instagram are simple links: the destination sites can set their own cookies only once you have opened them, in line with their own privacy policies.

You can manage or delete cookies at any time in your browser settings. Blocking technical cookies may prevent access to the reserved areas, but does not stop you browsing the public pages.

9. Changes to this notice

This notice may be updated, for example following changes to the Site or to the law. The current version is always published on this page, with the date of the last update shown at the top.

← Back to the site