Privacy and cookies
Last updated: 2026-09-30
This notice explains how Brys S.r.l., which runs Il Gozzo restaurant, processes the personal data of people who visit ilgozzosalerno.com, book a table, buy a gift voucher or get in touch with us. It is given under Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and Italian Legislative Decree 196/2003 (the “Privacy Code”), as amended by Legislative Decree 101/2018.
It covers this website only: third-party sites reached through our links have their own notices.
1. Data controller
Brys S.r.l. (Il Gozzo cucina e cantina)
Largo Conservatorio Vecchio, 5, 84121 Salerno (SA), Italia
P.IVA 05554820653 — Bruno Aversa
info@ilgozzosalerno.com · +39 089 9958208
2. Booking a table
Data: name and surname, email, phone, preferred language, date, time and number of guests, any notes you write and your choice about news from the restaurant (section 7). We also keep an irreversible fingerprint of your IP address, to limit automated submissions of the form, and the campaign parameters you arrived with, if they appear in the page address.
Purpose: to record your table, send you the confirmation and the reminder the day before, let you know if anything changes, and handle cancellations and changes.
Legal basis: performing the booking you ask for (Art. 6(1)(b) GDPR). For the IP fingerprint, our legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR).
Whether you must provide it: name, email, phone, date, time and number of guests are required; without them we cannot record the booking. Notes are optional.
Retention: 24 months from the date of the meal, after which the booking is deleted automatically. A copy reaches the restaurant by email and stays in our mailbox for the same period.
3. Coeliac disease, allergies and other health information
In the form you can tell us about diagnosed coeliac disease and, in the notes, about allergies or intolerances. This is health data (Art. 9 GDPR): we ask for it only so that the kitchen can prepare your meal safely.
Legal basis: your explicit consent (Art. 9(2)(a) GDPR), given by ticking the dedicated box or by writing the information in the notes yourself. You can withdraw it at any time; withdrawal does not affect processing already carried out.
Whether you must provide it: it is optional. If you tell us nothing the booking still stands, but the kitchen cannot take it into account.
Retention: the coeliac flag and the notes are deleted from the booking system the day after your meal. They remain only in the email copy of the booking received by the restaurant, kept for 24 months as explained in section 2.
4. Deposit for special dates
For the dates on which we ask for a deposit (listed in the Terms of service) we also record your acceptance of the conditions and the payment status. The payment link is sent to you on WhatsApp and payment is made on PayPal: we never see your card details.
Legal basis: performing the booking (Art. 6(1)(b) GDPR) and, for the accounting records of the payment, our tax obligations (Art. 6(1)(c) GDPR).
Retention: with the booking, 24 months; accounting records 10 years (Art. 2220 of the Italian Civil Code).
5. Gift vouchers
Data: name and email of the buyer; if the voucher is a gift, the recipient’s name, their email if given, and the greeting message; the voucher code, amount, and dates of purchase, expiry and use; the PayPal payment references. Card details never pass through our site: PayPal handles them.
Purpose: to issue and send the voucher, recognise it when it is used, reissue it if it is lost, handle any withdrawal and keep our accounts.
Legal basis: performing the purchase contract (Art. 6(1)(b) GDPR) and our tax and accounting obligations (Art. 6(1)(c) GDPR). The recipient’s details are given to us by the buyer: we use them only to deliver and recognise the voucher (legitimate interest, Art. 6(1)(f) GDPR).
Whether you must provide it: the buyer’s name and email are required to issue the voucher; the recipient’s details and the message are optional.
Retention: 10 years from purchase, because they document a sale (Art. 2220 of the Italian Civil Code). The technical log of voucher operations is deleted after 2 years.
6. When you write to us or call
If you contact us by email, on WhatsApp or by phone (to book, cancel, order takeaway or ask something) we process the details you give us in order to reply and act on your request (Art. 6(1)(b) GDPR or, for simple questions, our legitimate interest in answering, Art. 6(1)(f) GDPR).
WhatsApp is a service of WhatsApp Ireland Limited (Meta group), which also processes data under its own privacy policy. If you prefer not to use it, you can always email or call us.
Retention: as long as needed to handle your request, and no longer than 24 months.
7. News from the restaurant
If you choose, in the booking form, to receive our news, we may occasionally email you about events, special menus and openings.
Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 130 of the Privacy Code). It is optional: without it, your booking works exactly the same.
Withdrawal and retention: you can withdraw it at any time by replying to one of our emails or writing to info@ilgozzosalerno.com. In any case we do not use it for more than 24 months after the booking in which you gave it.
8. Browsing the site
Like any website, this one receives some technical data from your browser that is needed to show you the pages: IP address, date and time of the request, the page requested, browser type. Our hosting provider records it in system logs, to run the site and protect it from abuse (legitimate interest, Art. 6(1)(f) GDPR). We do not use it to identify you and it is deleted within 30 days.
Our fonts are hosted on our own domain: the site does not contact Google Fonts.
9. Cookies and other storage tools
The cookie rules (Art. 122 of the Privacy Code and the Italian Data Protection Authority’s guidelines of 10 June 2021) apply to any information a website stores on your device, including your browser’s local storage (localStorage).
This site sets no cookies of its own, stores nothing in your browser and uses no statistics or advertising tools. That is why we do not ask for any consent and you see no banner.
The Google map on the “Find us” page loads only if you press the button: until then your browser does not contact Google. If you load it, Google may set its own cookies under its privacy policy.
10. Who receives the data
Data is processed by authorised restaurant staff and by the providers that run the site, appointed as processors (Art. 28 GDPR):
- Vercel Inc. (United States): hosting of the site and forms
- Supabase Inc., with its database in the European Union: storage of bookings and vouchers
- Resend (United States): sending confirmation, reminder and voucher emails
- Cloudflare, Inc. (United States): forwarding of the domain’s email
- Google Ireland Limited: the restaurant’s mailbox
The following process data as independent controllers, each under its own privacy policy: PayPal (Europe) S.à r.l. et Cie, S.C.A. for payments and WhatsApp Ireland Limited for messages.
We disclose data to the authorities only when the law requires it. We never sell or hand over your data to anyone.
11. Transfers outside the European Union
Some providers are based in the United States or may process data from there. Such transfers rely on the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) for providers that have joined it and, otherwise, on the standard contractual clauses approved by the Commission (Art. 46 GDPR). You can ask us for a copy of the safeguards in place.
12. Children
This site is not aimed at children under 14 (Art. 2-quinquies of the Privacy Code). You must be of legal age to buy a gift voucher.
13. Security and automated decisions
The site is served over encrypted connections only. Access to booking and voucher data is restricted to authorised staff.
We do not take decisions based solely on automated processing, including profiling, that produce legal effects on you or similarly significantly affect you (Art. 22 GDPR).
14. Your rights
You can ask us at any time for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest (Arts. 15-21 GDPR). You can withdraw any consent you have given, without affecting the lawfulness of processing already carried out.
Just write to info@ilgozzosalerno.com or to the registered address in section 1. We reply within one month (Art. 12 GDPR).
We have not appointed a data protection officer (DPO): for a business like ours it is not mandatory (Art. 37 GDPR).
If you believe the processing breaks the law, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the country where you live or work (Art. 77 GDPR).
15. Changes to this notice
We may update this notice, for example when we switch on a new service. The date of the last update is at the top of the page; if a change concerns processing based on consent, we will ask you again.