Privacy Notice
Privacy Notice
Last updated: August 2026
Data controller
The data controller is Shiva S.r.l., with registered office at Viale Gian Galeazzo 7, 20136 Milan, Italy, tax/VAT number 11643040154. You can contact us at info@ristoranteshiva.it or by telephone on +39 02 89404746.
Data Protection Officer (DPO)
The Data Protection Officer is Laura Mazzeri. You can contact her through info@ristoranteshiva.it.
Restaurant bookings
We use your full name, email address, telephone number, date, time, number of guests and any optional notes to manage and confirm your booking. The legal basis is taking steps at your request before entering into a contract and performing the booked service (Art. 6(1)(b) GDPR).
Takeaway orders
We use your full name, email address, telephone number, selected dishes, collection date and time, and any optional notes to receive, prepare and hand over your order. The legal basis is taking steps at your request before entering into a contract and performing the contract (Art. 6(1)(b) GDPR).
Transactional emails
We use contact details and the booking or order summary to send confirmations, service updates and cancellation links. The legal basis is performing the contract or taking steps at your request before entering into it (Art. 6(1)(b) GDPR).
Legal obligations
When we must create and retain fiscal or accounting documents, the processing is necessary to comply with a legal obligation (Art. 6(1)(c) GDPR).
Security, abuse prevention and rate limiting
To protect the forms from automated submissions and abuse, we use HMAC to generate a pseudonymous technical identifier for rate limiting. The original IP address is not retained. This processing is based on our legitimate interest in protecting the website and service (Art. 6(1)(f) GDPR).
Cookies and tracking technologies
The site uses necessary technologies to remember language, privacy choices and whether the promotion bar was dismissed. Google Analytics and Microsoft Clarity load only after consent to experience analytics. Google Ads is loaded and used for advertising measurement only after you consent separately to advertising measurement; Google Maps only after consent to external content. You can reject or change each optional technology at any time through the “Privacy settings” link in the footer.
Optional experience analytics with Google Analytics
Only if you consent to experience analytics, we use Google Analytics 4 to measure visits, page views, traffic sources and technical information about devices and browsers. We do not send Google your name, email address, telephone number, notes, search parameters or information entered in forms; restricted areas and pages that may contain booking or order references are excluded. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through “Privacy settings” in the footer. Google Analytics is not used for automated decisions that produce legal or similarly significant effects.
Optional experience analytics with Microsoft Clarity
Only if you consent to experience analytics, Microsoft Clarity processes page-interaction information such as clicks, scrolling and rendering, together with device and browser information, to produce statistics, heatmaps and session recordings. Sensitive form content is masked, and Clarity is excluded from customer-data pages and restricted areas. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through “Privacy settings” in the footer. Clarity is not used for automated decisions that produce legal or similarly significant effects.
Optional Google Ads measurement
Only if you consent, we use Google Ads to measure booking requests attributed to campaigns and advertising cookies may be set. The legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time without affecting earlier processing. We do not send Google your name, email address, telephone number, notes or other information entered in the forms.
Google Maps
The embedded map on the Find Us page is external content provided by Google and remains blocked until you expressly allow external content. The link that opens Google Maps remains available without allowing the embed; following it takes you away from this site and Google's terms apply.
Required and optional information
Your full name, email address, telephone number, date and time, number of guests for a booking, and selected dishes for takeaway are required to manage the request. If you do not provide them, we cannot complete it online. Notes are optional and are only for special occasions, seating preferences or collection instructions.
Notes and health information
Do not enter allergy, intolerance or health information in the notes. Please call us on 02 89404746 for these requests so we can discuss them directly. The online forms are not intended to collect health data.
Who we share data with
We do not sell data. We use Lovable and Supabase for hosting and technical management; we use Resend (Plus Five Five, Inc.) for transactional emails, which receives the name, email address, summary and delivery metadata for the message. Free-text takeaway notes are not sent to Resend. Booking notes may appear in operational emails sent to the restaurant. Only when you allow the relevant service may Google Ireland Limited and Google group companies receive technical data for Google Analytics, Google Ads or Google Maps; Microsoft Ireland Operations Limited and relevant Microsoft group companies may process interaction data for Clarity. Access is limited to authorised staff and necessary providers.
International transfers
Some providers or their group companies, including relevant Google and Microsoft companies, may process data outside the European Economic Area, particularly in the United States. Where required, transfers rely on an adequacy decision or applicable safeguards, including Standard Contractual Clauses. Google Ireland Limited and Microsoft Ireland Operations Limited apply the relevant safeguards to intra-group transfers; Resend's DPA includes those clauses.
How long we keep data
Booking operational and contact records are kept for 12 months after the reservation date; takeaway operational and contact records are kept for 12 months after the collection date. Optional free-text notes are removed 30 days after the booking or collection date. Transactional-email delivery metadata held by us or the provider is kept for no longer than 12 months. Pseudonymous rate-limit abuse fingerprints are kept for 24 hours. The browser consent receipt is kept for 180 days. Google Analytics retention controls are configured to 14 months for user-level and event-level data, without resetting the period on new activity. In Microsoft Clarity, session playback data is retained for 30 days; click data, heatmap data and sessions marked as favourites may be retained for up to 9 months. Fiscal or accounting documents, if generated, are retained separately for the legally required period, generally 10 years: this does not mean every website booking, order or note is kept for ten years.
Your rights
You may request access, rectification, erasure, restriction, object where applicable, and receive data in a structured format where the law provides. You may also withdraw consent at any time without affecting processing already carried out. To exercise your rights write to info@ristoranteshiva.it. You have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
Automated decisions
No customer is subject to decisions based solely on automated processing that produce legal or similarly significant effects.
Security
We adopt adequate technical and organisational measures to protect personal data from unauthorised access, alteration, disclosure or destruction. Data is stored on secure servers with access limited to authorised personnel only.
Changes to this notice
We reserve the right to update this notice in the event of legislative changes or changes to our services. Any changes will be published on this page with the update date.
Cookies and Browser Storage
Necessary entries are always active. Google Analytics and Microsoft Clarity cookies are used only after experience-analytics consent; Google Ads cookies only after separate advertising-measurement consent. You can change those choices from the footer or delete data in your browser settings.
| Item | Duration | Purpose |
|---|---|---|
| shiva-consent-v2 | 180 days | Stores the version, date and choices expressed in the privacy banner |
| shiva-promo-dismissed | Until you remove it | Remembers that the promotion bar was dismissed |
| _ga, _ga_* (Google Analytics) | Up to 2 years | Pseudonymously distinguishes browsers and visits to produce aggregate statistics after experience-analytics consent |
| _clck, _clsk (Microsoft Clarity) | Up to 1 year (_clck); 1 day (_clsk) | Pseudonymously links visits and pages for statistics, heatmaps and recordings after experience-analytics consent |
| _gcl_* (Google Ads) | Up to 90 days | Attributes a booking to an advertising interaction after consent |
| Admin-area session data | Until sign-out or expiry | Authenticates authorised staff in the restricted area only |
More information: Google Privacy Policy · Google business data responsibility · Microsoft Privacy Statement · Clarity data retention · Resend Privacy Policy · Resend DPA and SCCs
Privacy Contact
Shiva S.r.l. — Viale Gian Galeazzo 7, 20136 Milan, Italy
Tax/VAT number: 11643040154
Email: info@ristoranteshiva.it
Phone: 02 89404746
Data Protection Officer: Laura Mazzeri (through the email address above)