This Privacy Policy explains how [company name] collects, uses and protects the personal data of visitors to this website and guests of its restaurants, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Portuguese Law No. 58/2019 of 8 August.

1. Who we are

The controller of personal data is [company name], company registration No. [NIPC], with registered office at [address], which operates the Casanova, Casanostra and Pizza a Pezzi restaurants.

For any question about personal data, please contact [privacy email].

2. What data we collect

Only the data needed for the purposes set out in this policy is collected:

identification and contact details (name, email and phone number), provided when booking a table, using the contact form or subscribing to the newsletter;
booking details (restaurant, date, time, party size and notes, including dietary requirements when provided by the guest);
browsing data (IP address, device and browser type, pages visited), collected through cookies as described in section 6.

3. How we use the data

Personal data is processed for the following purposes, on the legal bases indicated:

managing bookings and answering enquiries, as steps taken at the request of the data subject before entering into a contract;
sending the newsletter and promotional communications, based on consent, which may be withdrawn at any time;
complying with legal obligations, namely tax obligations and the handling of complaints;
running, securing and improving the website, based on legitimate interest and, where applicable, consent to cookies.

4. How long we keep the data

Data is kept only for as long as needed for the purpose for which it was collected: booking data, for [period] after the booking date; newsletter subscription data, until consent is withdrawn; data subject to legal obligations, for the periods required by law.

After these periods, the data is deleted or anonymised.

5. Who we share the data with

Personal data is not sold or passed on to third parties for marketing purposes. It may be shared with service providers acting on behalf of [company name] as processors, contractually bound to comply with the GDPR, namely [booking platform], [email marketing service] and [website hosting].

Orders placed through Uber Eats are handled by that platform under its own privacy policy.

Whenever data is transferred outside the European Economic Area, the appropriate safeguards provided for in the GDPR are applied.

6. Cookies

This website uses cookies that are strictly necessary for it to work and, with consent, analytics and preference cookies. Consent is requested on the first visit and can be changed at any time in [Cookie settings].

[Cookie table: name, provider, purpose and duration.]

Cookies can also be blocked or deleted in the browser settings, which may affect some features of the website.

7. Data subject rights

Under the GDPR, data subjects have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

These rights can be exercised by writing to [privacy email]. Data subjects also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD), at www.cnpd.pt.

8. Security

Appropriate technical and organisational measures are in place to protect personal data against unauthorised destruction, loss, alteration, disclosure or access, including encrypted communication (HTTPS) and access to data restricted to those who need it.

9. Changes to this policy

This policy may be updated to reflect changes in the law or in the services provided. The version in force is always the one published on this page, with the date of the last update.

10. Contact

[Company name]
[Address]
[Privacy email] · [Phone]