Privacy Policy
Last updated: September 2026
1. Data Controller
Base Margherita S.N.C di Urgesi Antonello & C. Tax ID / VAT no.: 02632820748 – REA: BR-160268 Registered office: Via Molino del Duca 12, 72013 Ceglie Messapica (BR) Phone: 0831 1981585 Certified email (PEC): basemargherita@pec.it To ask about how data is processed or to exercise your rights, write to the certified email (PEC) above, call us or send a letter to the registered office.
2. What data this site processes
This site is an informational showcase with an online menu. It has no contact forms, online booking, e-commerce, visitor accounts, comments or newsletter, and it does not integrate social networks or statistics or advertising tools. The controller does not actively collect visitors' personal data. Only the following is processed: • Browsing data: technical information automatically recorded by the hosting infrastructure when you visit the site (IP address, date and time of the request, requested page, browser and device type). • Communications you choose to send us outside the site: if you call us, message us on WhatsApp or by PEC (via the links on the site) or book a table, we process the data you give us (e.g. name, contact details, party size, date and time, message content) only to reply and handle your request or booking. • Restricted area for menu management: accessible only to the controller and authorised staff; it is not intended for visitors and contains no customer data. To protect access, a technical session cookie is used and, only for failed login attempts, a non-reversible fingerprint (hash) of the IP address, kept for a maximum of 24 hours.
3. Purposes and legal bases
• Operation and security of the site (browsing data, protection of the restricted area): the controller's legitimate interest in keeping the service available and secure (Art. 6(1)(f) GDPR). • Replying to requests and handling bookings received by phone, WhatsApp or PEC: performance of pre-contractual steps taken at the data subject's request (Art. 6(1)(b) GDPR). • Compliance with any legal obligations (Art. 6(1)(c) GDPR). Data is not used for profiling, marketing or automated decision-making.
4. Cookies
The site does not use profiling, analytics or third-party cookies and therefore shows no consent banner. The site sets no cookies for visitors; only the restricted management area uses a technical session cookie. The full list is in the Cookie Policy.
Read the Cookie Policy →5. Fonts and images
The site's fonts and images are hosted on the same server as the site: when you visit it, your browser does not contact third-party servers (such as Google) to load them.
6. Hosting, database and recipients of data
To provide the site the controller relies on two suppliers, appointed as data processors under Art. 28 GDPR: • Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA) for hosting. Vercel records technical log data (IP address, date and time, requested page, browser) to ensure the security and correct operation of the infrastructure, for the periods provided by the service. • Neon (neon.com) for the database holding the menu content and the technical security data of the restricted area described in section 2. The database contains no visitor or customer data. Data is neither disclosed nor sold to anyone else. Only the controller and the staff he authorises may access it, solely for the stated purposes. Vercel privacy notice: https://vercel.com/legal/privacy-notice Neon privacy: https://neon.com/privacy-guide
7. Transfers outside the European Union
Vercel and Neon are US-based companies, so data may also be processed in the USA. Transfers rely on the safeguards of Chapter V GDPR: the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, to which both companies adhere, and the European Commission's standard contractual clauses provided for in their data processing agreements.
8. How long we keep data
• Browsing data (hosting logs): for the period provided by the hosting service and in any case no longer than needed for the security and operation of the site. • Failed login attempts to the restricted area: 24 hours at most, then automatically deleted. • Login session to the restricted area: 7 days at most, or until logout. • Requests and bookings received by phone, WhatsApp or PEC: for as long as needed to handle the request or booking, unless the law requires otherwise.
9. Whether providing data is compulsory
Browsing the site does not require you to provide any data: browsing data is recorded automatically. Giving us your details to ask for information or to book is optional, but without them we cannot handle your request.
10. External links
The site contains links to external services (Google Maps, Google for reviews, Facebook, Instagram, WhatsApp). By clicking them you leave the site and your data is processed under the notices of those services, over which the controller has no control.
11. Security measures
The controller applies appropriate technical and organisational measures: encrypted connection (HTTPS), password-protected access to the restricted area limited to authorised staff, limits on login attempts, security identifiers kept in non-reversible form and automatic deletion of data that is no longer needed.
12. Your rights
You may ask the controller for access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest (Arts. 15–22 GDPR). To do so use the contact details in section 1: we will reply without undue delay and in any case within one month of your request. You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
13. Changes to this notice
The controller may update this notice, for example if the site's features or suppliers change. Changes are published on this page with the update date.
