Privacy notice

About this notice

Here we explain how we process your personal data when you use this website of Cocoon, book a table or place an order, in accordance with Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003).

Data controller

NEW DI FIORONI ALFONSO E SILENZI SAURO S.N.C., Via Ungheria 8/10, 63821 Porto Sant'Elpidio (FM), VAT no. 01525970446.

Email: ristorantecocoon97@gmail.com · Phone: 0734 993072

Data Protection Officer (DPO)

The controller has not appointed a data protection officer, because it is not mandatory for its business (Art. 37 GDPR). For any question about your data, write to the controller.

What data we process

Browsing data. To show you the pages, the server receives your IP address and the technical data that every browser sends. We do not keep logs of the pages you visit: the IP address is stored only by the systems that block repeated requests and abuse, and they delete it within 3 days.

Data you give us:

• When you book: first name, last name, phone number, email, date, time, number of guests and any notes you write.
• When you order takeaway: name, phone number, email, the dishes, the time and any notes.
• When you write in the website chat: the messages you write.
• When you ask to receive news by email: your email address.
• When you ask to see or delete your data: what you write in the request.

Allergies and intolerances: if you write them in the notes, we use them only to serve you safely. They are health data: do not write them if you do not want us to process them.

Cookies: this website uses only technical cookies, which are not used to profile you. You can find the list in the cookie policy.

Why we process it, on what legal basis and for how long

Who processes data on behalf of the controller

Your data is processed by the controller and its staff, who are authorised and trained. To run the service, the controller relies on the following providers, appointed as data processors (Art. 28 GDPR):

• OVHcloud — provides the server that hosts the restaurant's website and management system. Country: United Kingdom.
• Hetzner Online — keeps, encrypted, the nightly copy of the data outside the main server. Country: Germany.
• WowspaceWeb — provides the RistoWow management system and the technical maintenance of the website and the server. Country: Italy.
• Google (Gmail) — sends confirmation and notification emails from the restaurant's mailbox. Country: United States.
• Alibaba Cloud (Alibaba (Netherlands) B.V., Qwen models) — writes the replies of the website chat, and for this reason receives the messages written in it. Country: Germany; as long as the service uses the “Global” mode, replies may also be computed outside the European Union, including China.

Receipts and invoices go through the restaurant's fiscal cash register (registratore telematico) and, if there is one, the cloud service of its provider, both chosen by the restaurant. Invoice data reaches the Italian Revenue Agency (Agenzia delle Entrate) through the Exchange System (Sistema di Interscambio), as required by law.

Your data is not sold or given to anyone for commercial purposes. It may be disclosed to the authorities only when the law requires it.

Transfers outside the European Union

Some providers process data outside the European Union: OVHcloud (United Kingdom); Google (Gmail) (United States); Alibaba Cloud, when replies are computed outside the European Union, including in China. For the United Kingdom, the European Commission has recognised an adequate level of protection (adequacy decision, Art. 45 GDPR, valid until 27 December 2031). For the United States, transfers take place with the safeguards of Articles 44 et seq. of the GDPR: the provider's participation in the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission. For other countries, transfers take place under the standard contractual clauses approved by the European Commission (Decision 2021/914, Art. 46(2)(c) GDPR), which form part of the provider's contract.

Data security

The website and the management system can be reached only over an encrypted connection (HTTPS). Access to the management system is personal, with a username and PIN, and each person sees only what their work requires. The database cannot be reached from the internet. Backups are made every hour and every night, and the one that leaves the server is encrypted.

Your rights

At any time you can ask the controller:

• to see your data and obtain a copy of it (Art. 15 GDPR);
• to correct it (Art. 16 GDPR);
• to erase it (Art. 17 GDPR);
• to restrict its processing (Art. 18 GDPR);
• to have anyone who received it told about a correction or an erasure (Art. 19 GDPR);
• to receive it in a machine-readable format, so that you can take it elsewhere (Art. 20 GDPR);
• to object to processing based on legitimate interest, and always to promotional communications (Art. 21 GDPR);
• to withdraw the consent you have given, without affecting what was done before.

We do not make decisions about you by solely automated means and we do not profile you (Art. 22 GDPR).

How to proceed: write to ristorantecocoon97@gmail.com, or use the form to see or delete your data. We reply within one month. For the news emails, the “unsubscribe” link at the bottom of each one is enough.

Complaint to the supervisory authority

If you think your data is being processed incorrectly, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (Art. 77 GDPR): garanteprivacy.it.

Children

The website is not aimed at children under 14: an adult is needed to book or order.

Do you have to give us your data?

To book or order we need the data marked as mandatory: without it, we cannot take your request. Everything else is optional, and subscribing to the news is never mandatory.

Changes to this notice

If anything changes, we update this page and its date. Version of 24 October 2026.