Privacy Policy
Last updated: 13 October 2026
This page explains what personal data we collect when you visit the site or write to us, why we do it, and what you can ask of us. It is written in plain language, because it is here for you.
Who handles your data
The data controller is FILIA S.R.L. Società Agricola, the company that runs the restaurant Malcandrino.
Registered office: Piazza Mazzini 64, 73100 Lecce, Italy. VAT and tax code 05377640759, REA LE-362528. The restaurant is at Strada Provinciale Lecce–Monteroni 13, 73047 Monteroni di Lecce, Italy.
For anything concerning your data, write to info@malcandrino.it, or by certified email to filiasrlsocietaagricola@pec.it.
We have not appointed a Data Protection Officer: a business such as ours is not required to.
How your data reaches us
The forms on this site — the booking request, the tasting request and the events enquiry — send nothing to our servers. When you press the button, the site composes a ready-made message and opens WhatsApp: it is you who decides whether to send it.
Until you press send inside WhatsApp, what you have written stays on your device and we never see it.
So your data reaches us only when you actually write to us: on WhatsApp, by email to info@malcandrino.it, or by telephone.
What data we handle, and what for
What you send us: your name, the date and type of booking, tasting or event, the number of guests, and whatever you write in the notes. Plus the telephone number you write to us from on WhatsApp, or your email address if you write to us by email.
We use it for one thing only: to reply to you and arrange what you asked for. The legal basis is the performance of pre-contractual and contractual measures you requested (art. 6.1.b GDPR).
We do not send you marketing messages unless you ask us to, with separate and explicit consent. Booking a table does not sign you up to any list.
If in the notes you tell us about an allergy or an intolerance, you are giving us health data: we use it only to serve you safely, and we may do so because you provided it yourself for that purpose (art. 9.2.a GDPR). If you would rather not write it down, tell us in person when you arrive.
The conversation takes place inside a service run by WhatsApp Ireland Limited (Meta group), which handles the data as an independent controller under its own terms. We read and keep the chat exactly as you do.
If you would rather not use WhatsApp, write to info@malcandrino.it or call us: to us they are equivalent.
What the site collects on its own
The site is hosted on Vercel. Like any web server, its technical logs record the IP address, browser type, page requested and time. They serve to keep the site standing and secure — our legitimate interest (art. 6.1.f GDPR) — and we do not use them to profile you.
To know how many people visit the site and which pages they read, we use Vercel Web Analytics, the statistics tool of the same provider that hosts the site. It uses no cookies and writes nothing to your device.
It records the page visited, the site you came from, your country, and your type of device and browser. To count visits without recognising you, it uses a code derived from the request that resets every day: we only see overall numbers, never the individual person. We do this to understand how the site is used, our legitimate interest (art. 6.1.f GDPR).
There is no advertising pixel, from Meta or anyone else, and we do not use Google Analytics.
Cookies
This site installs no cookies and embeds no third-party content: no map inside the page, no external video, no widgets. The details are in the Cookie Policy.
Who we share your data with
Only the technical suppliers we need, and only for what is needed: Vercel Inc. for hosting the site, Aruba S.p.A. and Google Ireland Limited (Gmail) for email, WhatsApp Ireland Limited for messaging.
We do not sell your data and we do not pass it to third parties for their marketing.
Transfers outside the European Union
Some of these suppliers belong to groups based in the United States. Where a transfer takes place, it rests on the safeguards the GDPR requires: the standard contractual clauses approved by the European Commission, or the recipient's adherence to the EU–US Data Privacy Framework.
How long we keep it
Conversations and emails tied to a booking: as long as it takes to handle it and, afterwards, for the period in which they might serve to defend a right of ours — as a rule no longer than 24 months.
Accounting documents tied to an event: 10 years, as the law requires.
Server technical logs: a few days, according to the provider's settings.
Your rights
At any time you may ask us to give you access to your data, correct it, erase it, restrict its use, hand it to you in a machine-readable format, or object to processing based on our legitimate interest (arts. 15-22 GDPR). If you have given us consent, you may withdraw it whenever you like: what was done before remains lawful, and from that point we stop.
Just write to info@malcandrino.it. We reply within a month.
If you think something is wrong
You may turn to the Italian data protection authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it.
But write to us first: it is almost always settled in two messages.
Children
The site is not aimed at children under 14 and does not knowingly collect their data. A booking for a family is made by an adult.
If this page changes
We update the date at the top. Substantial changes are announced on the site.