Privacy notice — DRAFT under review

DRAFT FOR LEGAL REVIEW — version bozza-2026-10-14. This text is not final and has no legal effect yet. The Italian version prevails.

1. Who we are and how to contact us

The controller of the data processed through the website and the customer account is [RAGIONE SOCIALE / COMPANY NAME], registered office [INDIRIZZO SEDE LEGALE / ADDRESS], VAT no. [P.IVA], certified e-mail (PEC) [PEC], privacy e-mail [EMAIL PRIVACY] ("we"). Data Protection Officer (DPO): [DPO — NAME AND CONTACT, or "not appointed"]. When you book a table or buy a ticket for an experience, the restaurant hosting you also processes your data to manage your visit. [ROLE OF THE RESTAURANT: INDEPENDENT CONTROLLER / JOINT CONTROLLER / WE AS PROCESSOR ON ITS BEHALF — TO BE DEFINED WITH COUNSEL]. You can also contact the restaurant about the data it holds.

2. What data we process

- Account: e-mail, name, password (stored only as a hash), phone if you give it, preferred language, e-mail verification date, account status. - Sign-in with Google or Apple: your account identifier at the provider and the e-mail it shares with us. We never receive your Google or Apple password. - Bookings: restaurant, date, time, party size, name, e-mail and phone of the person booking, occasion (e.g. birthday or anniversary), special requests and any allergies or intolerances you choose to tell us, booking status and cancellations. - Deposits and payments: amount, outcome and payment references. You enter card details directly in Stripe's forms: we neither see nor store them. - Experience tickets: experience, date, number of tickets, ticket holder, transfers to another person, refunds requested and granted. - Reviews: overall rating, ratings for food, service and ambience, text, date, the restaurant's reply. - Favourites and group votes: the venues you save; in group polls, the name you enter and your vote. - Preferences: notification preferences (offers by e-mail, booking reminders, suggestions to go back to a venue) and cookie choices, with the date of the choice. - Legal acceptances: which version of the Terms and Privacy notice you accepted and when. - Notifications: device token for app push notifications, technical log of e-mails and SMS sent. - Technical data: IP address, browser type, security and error logs; for ads, the random codes described in the Cookie policy.

3. Why we process it and on what legal basis

- Creating and managing your account, signing you in: performance of a contract (Art. 6(1)(b) GDPR). - Forwarding your booking to the restaurant and managing it, sending confirmations and changes: performance of a contract (Art. 6(1)(b)). - Passing allergies and intolerances you declare to the restaurant: your explicit consent (Art. 9(2)(a)) [TO BE CONFIRMED WITH COUNSEL]. - Collecting deposits and ticket payments, handling refunds: performance of a contract (Art. 6(1)(b)). - Publishing the reviews you write: performance of a contract (Art. 6(1)(b)) [OR LEGITIMATE INTEREST — TO BE CONFIRMED]. - Booking reminders: performance of a contract; you can switch them off in your profile. - Offers by e-mail and suggestions to go back to a venue: consent (Art. 6(1)(a)), revocable in your profile. - Personalised ads and campaign measurement with a device code: consent (Art. 6(1)(a)), through the cookie banner. - Non-personalised ads, frequency limits without identifiers, invalid-click prevention: legitimate interest (Art. 6(1)(f)). - Security, abuse and fraud prevention: legitimate interest (Art. 6(1)(f)). - Keeping accounting and tax records, proof of document acceptance: legal obligation (Art. 6(1)(c)) and legitimate interest in defending our rights.

4. Who we share data with

- The restaurant you book or whose experience you buy: it receives what it needs to host you (name, contacts, party size, occasion, requests and allergies you declared) and, if you have visited before, your customer profile with it. - Providers working on our behalf (processors): - hosting and database: [HOSTING PROVIDER — e.g. OVHcloud], data centres in [EU COUNTRY/REGION — TO BE CONFIRMED]; - file and image storage: S3-compatible storage [PROVIDER/SELF-HOSTED — TO BE CONFIRMED]; - payments: Stripe Payments Europe Ltd. (Ireland) [VERIFY CONTRACTING ENTITY]; - transactional e-mail: [E-MAIL PROVIDER — SMTP / Amazon SES — TO BE CONFIRMED]; - SMS: Twilio Inc. [IF ENABLED]; - push notifications: Google Firebase Cloud Messaging (also for Apple devices via APNs); - address geocoding: [GEOCODING SERVICE — default OpenStreetMap Nominatim]; - error monitoring: [SENTRY — IF ENABLED]. - Google or Apple, only if you choose to sign in with them. - Authorities, when the law requires it. We do not sell your data. Advertisers never receive data that identifies you: only aggregate campaign data.

5. Transfers outside the European Union

Some providers (e.g. Stripe, Twilio, Google, Apple) may process data in the United States or other non-EU countries. Such transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. [LIST AND SAFEGUARDS TO BE VERIFIED FOR EACH PROVIDER].

6. How long we keep data

- Account: while it is active. If you ask for erasure, the account is closed at once: e-mail and name are redacted, the password made unusable and Google or Apple sign-ins unlinked. - Data held by restaurants: an erasure request is filed with each linked restaurant and handled under that restaurant's rules. - Bookings, tickets and payments: [PERIOD — e.g. 10 years for accounting records under Art. 2220 of the Italian Civil Code]; accounting data may be kept in anonymised or pseudonymised form after erasure. - Reviews: while published; [WHAT HAPPENS TO REVIEWS AFTER ACCOUNT ERASURE — TO BE DEFINED]. - Legal acceptances: [PERIOD], as proof; they are an append-only record. - Log of SMS sent: 90 days. Platform e-mail log: 180 days. - Personal data tied to ad events (e.g. click IP addresses): 90 days, then aggregate data only. - Audit logs: 365 days. - Your data export files: available for 7 days. - Cookies: see the Cookie policy.

7. Your rights

You may at any time ask for access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. You may withdraw consent whenever you like, without affecting processing already carried out. From your account you can already: - download a copy of your data (export); - close your account and ask for erasure; - change notification preferences and cookie choices. For anything else write to [EMAIL PRIVACY]. We reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or the authority of your EU country.

8. Mandatory and optional data

E-mail and name are needed to create an account and book; without them we cannot provide the service. Phone, occasion, requests and allergies are optional: if you leave them out the restaurant cannot take them into account.

9. Minors

The service is for people aged at least [MINIMUM AGE — e.g. 14 or 18]. [TO BE DEFINED: the site does not check age today].

10. Automated decisions

We make no decisions based solely on automated processing that produce legal effects on you. The order of results and of sponsored listings (always labelled) follows general criteria, not a profile of you, unless you consent to personalised ads.

11. Changes to this notice

We may update this notice. Each version has a number and a date; if it changes materially we will ask you again at your next sign-in.