Last updated:
Data controller
The data controller is FGM GROUP S.R.L., Italian VAT and tax number 02371920519, registered office at Via Piero Calamandrei 137, 52100 Arezzo (AR), Italy. Il Cantuccio restaurant is at Via Madonna del Prato 76, 52100 Arezzo (AR), Italy. Privacy requests: fgm.group.srl@pec.it; general restaurant enquiries: risto.ilcantuccio@gmail.com.
Data we process
When you browse the site, the systems serving it may receive technical information needed for Internet communications: IP address, date and time, requested URL, browser and device details, and security or error logs.
If you email us voluntarily, we process your email address, any contact details, the message and any information you choose to provide. If you call us, we process information needed to handle the conversation. This site has no contact forms, accounts or online reservations.
The site's fonts are loaded from Google Fonts. A request to Google can transmit technical data such as your IP address and browser details. Google Maps and Instagram links open external services only when you choose to follow them.
Purposes and legal bases
Technical data is processed to provide and secure the website, handle faults and prevent abuse, on the basis of the controller's legitimate interest in the security and operation of the service (Article 6(1)(f) GDPR).
Information you send is used to answer and manage your enquiry. Where it concerns pre-contractual steps or a contract, the basis is Article 6(1)(b); other enquiries are handled on the basis of our legitimate interest in responding (Article 6(1)(f)). Legal obligations, where applicable, are based on Article 6(1)(c). We do not use these data for profiling, personalised advertising or newsletters.
How long data is kept
Technical data and logs are kept for as long as needed for site delivery, security and troubleshooting, according to the hosting provider's settings. Messages are kept for as long as needed to handle the enquiry, and may be retained longer where the law requires it or to establish, exercise or defend rights relating to a relationship or dispute. They are then deleted or anonymised.
Recipients and international transfers
Authorised staff and the technical providers needed to operate the site and email service may access data within their roles. The site is hosted on Replit; fonts are requested from Google. Information may be disclosed to authorities where required by law. We do not sell visitor data.
International providers may process or access data from outside the European Economic Area. Where such transfers occur, instruments under Chapter V of the GDPR apply according to the providers' terms; you can request information about available safeguards from the controller. When you open external sites, their own privacy notices also apply.
Your rights
You may request access, rectification, erasure, restriction and, where applicable, portability, and object to processing based on legitimate interest, subject to Articles 15–22 GDPR. Contact us at the addresses above. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali). We do not make solely automated decisions with legal effects concerning site visitors.
Changes to this notice
This notice reflects the current website. If services, providers or processing practices change, we will update this page and, where necessary, obtain consent before enabling non-essential technologies.