Your data, plainly

The data controller is LA BRACERIA S.R.L. (La braceriA), Via Lauretana 957, 52044 Camucia di Cortona (AR), VAT 02495820512. For any question about this policy or your data: [email protected].

The booking form asks for your name, phone number, party size, date, time and optional notes. We use this data only to manage the booking and call you back to confirm (legal basis: pre-contractual measures at your request, art. 6.1.b GDPR). Requests are stored on the systems listed under “Where the data lives” and are visible only to restaurant staff; they are deleted automatically 30 days after the booking date. You can ask for deletion earlier, at any time.

The events form asks for your name, a contact, and the details of your event (guests, date, place, message). We use them only to prepare a proposal and get back to you (art. 6.1.b GDPR). The request is deleted automatically 180 days after it is sent; you can ask for deletion earlier.

The gifts form asks what you want to give (a tasting menu or an amount), your name, the recipient’s name, an optional dedication and your email, which we use to reply with the confirmation. We process this data only to prepare the voucher and get back to you (art. 6.1.b GDPR): the request is stored on the systems listed under “Where the data lives” and is visible only to restaurant staff. If the gift does not go ahead, the request is deleted automatically after 90 days; if the voucher is issued, names, dedication and email are kept until 12 months after it expires and then removed, while the amount stays in our accounts. If you confirm, payment is by bank transfer: the transfer details remain in our accounts for tax obligations. Staff receive an internal notification without your personal data. You can ask for deletion of the request at any time.

The site is hosted on Cloudflare (Cloudflare Pages and the D1 database), acting as a processor under its Data Processing Addendum; the infrastructure is distributed and data may also be processed outside the European Union with the safeguards provided by that agreement. Like any web service, Cloudflare produces technical request logs (including IP addresses) for security and operation.

This site uses no profiling cookies, pixels, analytics or other tracking tools — that’s why there is no consent banner. Fonts and flags are served from our own domain: to render, the page contacts no advertising or measurement servers.

Pages with a form (booking, event request, gift, shop, panel login) load Cloudflare’s Turnstile anti-spam check — the same provider that hosts the site and is already our processor. Its only job is to tell a person from an automated program before the form is sent: it does not profile you, sets no advertising cookies and does not follow you across sites. To do so, Cloudflare processes your IP address and some technical browser signals; the legal basis is our legitimate interest in protecting the service from automated submissions. The check is visible at the bottom of every form, above the button.

The exception is the Google Maps map in the “See you at La braceriA” section, which writes its own cookies: that is why it stays off until you press “Show the map”. Until then, Google receives nothing; if you load it, Google (Google Ireland Ltd) may also process data outside the European Union, under the Data Privacy Framework safeguards. Your choice is remembered on your device and you can undo it at any time with “Hide the map”. Directions (“Open navigation”) are a plain link: they open only if you press them.

In rare cases, for a country flag not available on our servers, the browser may load the image from flagcdn.com.

Links to Instagram, Google Maps and WhatsApp (for information and bookings) lead to third-party services: their policies apply when you open them. Apart from the map you load yourself, no content from those services is embedded in our pages.

You can request access to your data, rectification, erasure, restriction of processing, portability and object at any time (arts. 15–21 GDPR) by contacting [email protected]. If you believe processing violates the law, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (gpdp.it).

If the site changes (new features, new providers), this page will be updated first. Version in force since 7 September 2026. The Italian text prevails in case of discrepancy.