Privacy policy

Who handles your data

The controller is Corte dei Toldi di Daprà Andrea & C. snc, with registered office at via dei Falidoni 32, 38027 Terzolas (TN), Italy, VAT number and tax code01986010229. For any question about your data you can write to info@cortedeitoldi.it. We have not appointed a data protection officer: for a business like ours it is not required.

What data and why

• Requests for a table, a suite or a gift voucher. Name, email, phone number, the date and time or the arrival and departure dates, the number of people, the suite you prefer and whatever you write in the notes. For a gift voucher, also the recipient’s name and the dedication, which you give us on their behalf, and how you would like to receive it. The fields marked as required are needed to reply to you: without them the request is not sent. We use this data only to reply to you and to handle the request; we email you a summary with the structured details only, without the notes and without the dedication. Legal basis: pre-contractual measures taken at your request. A request is not a booking: if it becomes one, your data becomes part of the management of your table or stay and follows the house’s legal obligations, such as reporting overnight guests to the police (Questura); the privacy notice you receive at the Corte explains this. The form sends your request to a function of the site that runs on Netlify’s servers in Frankfurt (Germany); from there two emails are sent through Resend: one to the Corte’s mailbox (Aruba, Italy) and the summary to you. To stop abuse, Netlify counts for a few minutes the requests coming from the same IP address (at most six every three minutes), and the site discards requests filled in by automated programs. The same applies to the choice of dishes you send us in advance from the «Your choices» page: notes on dietary needs are used only for your table and deleted after your visit. So that only one list arrives per table, the site keeps until the following night two codes derived from the table’s phone number and name, not the number or the name themselves. So that we can show you read this policy, the site keeps a record of the request: date and time, type of request, language, version of the policy and a code derived from your email address, not the address itself. Legal basis: our legitimate interest.
• Messages on WhatsApp. If you write to us on WhatsApp, your number, your profile name and what you write reach the person who looks after the chat for the Corte dei Toldi. We use them only to reply to you and to handle your request. Legal basis: pre-contractual measures taken at your request. The button on the site opens WhatsApp with a ready-made greeting that contains no data about you, and only when you tap it: the site’s chat collects nothing, it answers with the information on the pages. WhatsApp is a service of WhatsApp Ireland Limited, which handles the messages as an independent controller, under its own privacy policy.
• Newsletter. If you sign up: your email address, your language, the date and time of your request and of your confirmation, and the wording of the consent you gave. We use them only to send you the newsletter. Legal basis: your consent, which you can withdraw at any time with the link at the bottom of every email; withdrawal does not affect what was done before. We save nothing before you confirm: if you do not confirm within 72 hours, the link expires and no trace of your address remains with us. The list of subscribers and the proof of consent are kept in the Corte’s mailbox (Aruba, Italy).The emails are sent through Resend (see “Who sees your data and where”). We do not record who opens the emails or which links are clicked.
• Gift vouchers. The recipient’s name and the dedication, if you give them, together with the details of the person requesting the voucher; then the voucher’s code, value and expiry date. They are used to issue the voucher, deliver it and recognise it when it is used. Legal basis: the contract with the person requesting the voucher; for retention, accounting and tax obligations. If you receive a voucher made out to you, your name and the dedication were given to us by the person who requested it: we use them only for the voucher, and everything on this page applies to you too. The public page for checking a voucher shows neither names nor dedications.
• Browsing and security. To show you the pages and protect the site, Netlify, which hosts it, records the technical details of each request (IP address, date and time, page requested, browser type) and keeps them for a short time, under its own privacy policy. The site’s functions write only technical messages, without personal data, to their logs, which are kept for seven days. To stop abuse of the forms, the site counts each day the requests and sign-ups that come from the same IP address: it does not keep the address, only a code derived from it, which changes every day and is deleted the following night. Legal basis: our legitimate interest in running the site and defending it from abuse. We use no statistics or profiling tools, not even cookieless ones.

In the notes field, or in a WhatsApp message, you can tell us about dietary needs, such as an allergy or an intolerance: this is health data; we use it only to prepare your table and delete it after your visit. There is no dedicated field and you do not have to mention it.

How long we keep it

• Requests that go no further, including those received on WhatsApp: we delete them within 12 months.
• The record that you read this policy when you sent a request: 12 months.
• Requests that become bookings, and gift vouchers: for the duration of the relationship and then for as long as accounting and tax obligations require, usually ten years.
• Dietary needs written in the notes: we delete them after your visit.
• Newsletter: your address stays as long as you are subscribed. After you unsubscribe we keep only the proof of subscription and withdrawal, for ten years, so that we can demonstrate them if needed: this is our legitimate interest. The same applies to the copies in the mailbox.
• Technical browsing data: a short time at Netlify; seven days for the function logs; the code derived from the IP address for the forms, until the following night.

Who sees your data and where

Only the people who work at the Corte dei Toldi and the providers who help us run the site, each for their own part:

• Netlify, Inc. (San Francisco, United States) hosts the site and runs its functions. The functions run in Frankfurt; the pages travel through Netlify’s worldwide server network. It acts as a processor, under the European Commission’s standard contractual clauses.
• Plus Five Five, Inc., which provides the Resend service (San Francisco, United States), sends the site’s emails (request summaries and newsletter confirmations) and keeps their texts and sending logs in the United States. It acts as a processor, under the standard contractual clauses and with certification under the EU-US Data Privacy Framework.
• Aruba S.p.A. (Italy) hosts the Corte’s mailbox, where the requests and the copies of the newsletter register arrive.
• NosLab S.a.s., which built the site, acts as a processor for technical support.
• WhatsApp Ireland Limited is an independent controller for the messages you send us on WhatsApp.

We do not sell your data or pass it on to anyone.

Transfers outside the European Union

Netlify and Resend are based in the United States: data passing through them is protected by the European Commission’s standard contractual clauses (Decision 2021/914) and, for Resend, also by its certification under the Data Privacy Framework. You can ask us for a copy of these safeguards by writing to info@cortedeitoldi.it.

Children

The site and the newsletter are not intended for anyone under 14. If a parent finds out that their child has written to us or signed up, please let us know: we will delete the data.

Your rights

You can ask at any time to see your data, correct it, delete it, restrict its use or receive a copy in a machine-readable format, and you can object to its processing. Where processing is based on your consent, as for the newsletter, you can withdraw it at any time: withdrawal does not affect what was done before. Write to info@cortedeitoldi.it: we reply within one month. If you believe your data is being handled improperly, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the supervisory authority of the country where you live. We make no automated decisions and do no profiling.

Changes to this policy

When something changes, we update this page and the date at the top.

Cookies

The site uses no cookies and calls no third-party services when you open it. The details, including the only thing that stays in your browser, are on the cookies page.