Privacy & Terms of Service

Notice pursuant to EU Regulation 2016/679 (GDPR) and CCPA

1. Introduction and AI chat

Al Gatto Nero offers a reservation system via AI-powered chat. The information you provide is processed automatically by the AI system to handle your booking request. No operator reads conversations in real time; data is processed by the system and, subsequently, by the restaurant administrator solely for operational management of reservations. In accordance with Art. 50 of Regulation (EU) 2024/1689 (AI Act), the user is expressly informed that they are interacting with an artificial intelligence system and not with a natural person. This information is also displayed directly in the booking interface. For internal request management, administrative staff may also use an AI-based assistant to quickly check reservation status; this assistant does not have access to any data other than that already collected for the purposes described in this notice.

2. Data collected and purposes

The following personal data is collected during the booking process:

Data collected from partner agencies and hotels

Travel agencies and accommodation facilities wishing to make reservations on behalf of their guests must register as users of the Agency Portal. In this case, in addition to the above, the following is collected: company name, VAT number, address, landline and mobile phone, name of the contact person, email, and the details of a valid credit or debit card, stored on an ongoing basis for the entire duration of the business relationship as a guarantee for the reservations made (unlike direct customers, for whom the card is collected individually for each reservation). Registration can also take place via Google or Microsoft authentication: in this case, name and email are also acquired via these services, according to their respective privacy notices (Google: policies.google.com/privacy — Microsoft: privacy.microsoft.com).

3. Legal basis for processing

• •Performance of contract (Art. 6.1.b GDPR) — for all data needed to manage the reservation (name, email, date, time, guests, menu type, children, pets).
• •Legitimate interest (Art. 6.1.f GDPR) — for anonymous statistical data (country of origin).
• •Explicit consent (Art. 9.2.a GDPR) — for health data relating to food allergies and intolerances.
• •Performance of contract (Art. 6.1.b GDPR) — for collecting and storing credit card data for the booking deposit and any no-show penalty charge, as described in the Terms of Service.
• •Performance of contract (Art. 6.1.b GDPR) — for the company and payment data of registered partner agencies and hotels, for the purposes of managing the business relationship and reservations made on behalf of their guests.

4. Storage methods and period

Data is processed electronically through the al Gatto Nero srl platform, acting as data processor under Art. 28 GDPR. The booking process includes: (1) a provisional 10-minute table hold, after which the reservation automatically expires if not confirmed; (2) manual approval by the administrator; (3) automatic sending of transactional emails (summary and confirmation/rejection). Reservation data is retained for the time necessary for the stated purposes and, subsequently, for applicable fiscal and legal obligations.

5. Data sharing

Data is accessible exclusively to authorized restaurant staff for the purposes described above. al Gatto Nero srl acts as data processor under Art. 28 GDPR. Credit card data is processed by Stripe Payments Europe, Ltd., which acts as an independent data controller for the provision of payment services (booking deposit and no-show penalty charge) and does not have access to other reservation data; for more information see Stripe's privacy policy at stripe.com/privacy. WhatsApp communications (confirmations, cancellations, urgent notifications) are managed via Twilio Inc., which acts as data processor under Art. 28 GDPR for sending such messages; for more information see Twilio's privacy policy at twilio.com/legal/privacy. Email communications are managed via Resend, which acts as data processor under Art. 28 GDPR for sending such communications. Data may be disclosed to competent authorities as required by law.

6. International transfers

Data may be processed on servers located outside the European Economic Area. In such cases, the transfer is guaranteed by the adoption of Standard Contractual Clauses approved by the European Commission, or other appropriate safeguards under the GDPR.

7. Cookies

The site uses only technical cookies necessary for operation (session cookies and language preference). No profiling cookies, third-party cookies, or behavioural tracking systems are used.

8. Data subject rights (Arts. 15–22 GDPR)

You have the right to:

• •Access — obtain confirmation of processing and a copy of your data (Art. 15)
• •Rectification — correct inaccurate data (Art. 16)
• •Erasure — obtain deletion of your data (Art. 17)
• •Restriction — limit processing in certain cases (Art. 18)
• •Portability — receive data in structured format (Art. 20)
• •Objection — object to processing based on legitimate interest (Art. 21)
• •Withdrawal of consent — withdraw consent to processing of health data at any time

To exercise your rights, write to info@gattonero.com. Response guaranteed within 30 days. You also have the right to lodge a complaint with your national data protection authority.

9. California Users (CCPA)

California residents have the right to: (1) know what personal data is collected; (2) request deletion of their data; (3) not be discriminated against for exercising their rights. Al Gatto Nero does not sell personal data to third parties.

10. Changes to the Privacy Policy

The data controller reserves the right to update this notice. Substantial changes will be communicated on the website. We recommend checking this page periodically.