Privacy Policy

Data, purposes and legal bases

Connection and security data, including IP addresses, request times, requested pages and browser information, are processed to deliver the website, diagnose faults and prevent abuse, on the basis of the controller's legitimate interest in providing a functioning, secure service (Article 6(1)(f) GDPR). Technical preferences support functions requested by you. Optional analytics and external map features rely on your consent (Article 6(1)(a)); you may refuse or withdraw it without affecting the lawfulness of earlier processing.

If you contact us by email, telephone or WhatsApp, we process the contact details and information you choose to supply to answer your enquiry or take steps at your request before a booking (Article 6(1)(b)); legal obligations may require further processing (Article 6(1)(c)). Please do not send information that is unnecessary for your enquiry. The table-request form prepares a WhatsApp message on your device using the details you enter; it does not submit them to our server. The button opens WhatsApp, where you choose whether to send the message. A request is not a confirmed booking: you need our reply. Opening WhatsApp sends the details included in the link to that service, under its own privacy policy.

Recipients and retention

Access is limited to authorised staff and service providers involved in hosting, maintenance, security, communication and the optional services described below; information may also be supplied to competent authorities where required. Technical records are kept for the time needed to operate and secure the service, investigate incidents and meet legal obligations; relevant records may be retained longer for a specific dispute or investigation. Enquiries are retained for handling and any resulting relationship, subject to applicable legal obligations and defence of claims. For bookings, the retention described in “Bookings through Spiagge.it” below applies. Browser-storage durations are described in the cookie policy; these are separate from provider-side retention. For information on the retention applicable to your data, contact the controller.

Service providers and international transfers

The website and the menu are hosted and delivered by Cloudflare (Cloudflare, Inc.), which necessarily receives connection information such as IP address, requested resource, request time and browser information to deliver and protect the website. Technical-log retention depends on the Cloudflare service and its settings. To limit excessive requests, our application derives a fingerprint from the IP address using a SHA-256 hash: the rate-limit counters do not store the plain IP address. This does not prevent Cloudflare from receiving the connection data needed to provide its service. The menu, opening hours and notices are stored with Cloudflare together with the account name of the staff member who changed them. Menu translations are prepared with DeepL (DeepL SE, Germany), which receives only the menu texts.

Google services may process information outside the European Economic Area, including in the United States. Google's privacy policy and international transfer information describe its processing and the adequacy decisions, Data Privacy Framework and standard contractual clauses it relies on, as applicable. Cloudflare also operates an international network and may process data outside the European Economic Area, including in the United States, relying on the Data Privacy Framework and the standard contractual clauses described in its notice. You may contact the controller for information about the safeguards applicable to your data and how to obtain a copy. Consent to a website feature does not replace the safeguards required for international transfers.

Google Analytics, Google Ads and Tag Manager

The website uses Google Tag Manager (GTM-WJ4745TF) to load the Google tag. The tag destinations verified on 29 October 2026 are Google Analytics 4 (G-EJ0293JP92), for website and restaurant-menu statistics, and Google Ads (AW-11179563748), for the advertising features described below.

Analytics measures page views, interactions, traffic sources and browser/device information using pseudonymous identifiers. The Ads destination supports advertising measurement and, depending on account settings and consent, personalisation features. The container loads only after you accept Statistics. If you do not also accept Marketing, advertising signals (Google Ads) stay denied: Google Analytics measures visits without advertising cookies. Marketing alone or Maps permission alone does not load it. The tag receives separate consent signals for analytics_storage, ad_storage, ad_user_data and ad_personalization.

Analytics can use the first-party cookies _ga and _ga_EJ0293JP92 to distinguish visitors and retain session state. Google's documented default expiry is two years, subject to browser limits and account settings. Google Ads may use attribution identifiers such as _gcl_au (default lifetime 90 days), depending on the features actually enabled. Cookies on Google domains can vary with the service, browser and Google account sign-in status. See the Analytics documentation and Google advertising and measurement cookie information. Cookie lifetimes are separate from retention of collected data, which is governed by account settings and the service policies.

Maps, bookings and external links

Google Maps is an optional embedded service. The map loads only after you separately allow Maps; this does not grant Statistics or Marketing consent. Loading it sends Google your IP address and browser/request information. Google may read or set its own cookies, depending on your browser, Google sign-in status and its service settings. Google's cookie information explains these uses and durations.

Sunshade and sunbed booking buttons open Spiagge.it on an external page; the current main website does not automatically embed its booking widget. The booking notice on our privacy page remains available, together with Spiagge.it's own privacy policy. The receiving service manages its own cookies and privacy choices. WhatsApp, social media and Google review links are ordinary outgoing links; opening them subjects your visit to the receiving service's policies. Fonts, background video, photographs and displayed review excerpts on the main website are served locally, without loading the former review or font widgets.

The restaurant menu

The restaurant menu uses no session cookie. If you choose another language, your choice is remembered in local storage (ba_lang) and in a first-party technical cookie, ba_lang, valid for six months, so that our server can send you the menu already translated; both are removed when you switch back to Italian. Translations are prepared on our server with DeepL (DeepL SE, Germany): only the menu texts are sent to DeepL, never any visitor data, and your browser does not contact any translation service. So that a daily notice you have closed is not shown again during the same visit, the menu uses session storage (amedea-notice-dismissed), which ends when the tab is closed. The menu shows no cookie banner: Google measurement is loaded there only if Statistics have already been allowed on the main website, and advertising signals stay denied unless you also allowed Marketing. You can change your choice from “Cookie preferences” on the main website.

Your choices

You can accept all, reject optional services or select individual preferences in the banner. Use “Cookie preferences” in the footer at any time to change your choice or withdraw consent. Optional Maps and Google measurement are blocked on the main website until the corresponding permission is given. Necessary site operation does not require optional consent, and rejecting optional services does not prevent access to the site's ordinary content.

The first-party cookie ba_consent remembers your categories, choice time and policy version for six calendar months. It is a functional preference cookie, not an advertising identifier. A new choice may be requested after expiry, deletion or a relevant configuration change. Withdrawal stops subsequent optional loading and removes known accessible first-party measurement cookies; it cannot erase data already received by an external provider or cookies on that provider's domain. Browser settings can also delete or block cookies and site storage. Clearing site data removes the remembered choice.

Your rights and contact

You may request access, correction, erasure, restriction and portability where applicable, object to processing based on legitimate interests, and withdraw consent at any time. Write to ilmaestralesnc@gmail.com. You may complain to the Italian Data Protection Authority or another competent supervisory authority; UK visitors may contact the ICO where applicable. The cookie preference panel changes future website permissions; requests concerning data already held should be sent to the controller or the relevant provider.

Bookings through Spiagge.it

Sunshade and sunbed bookings take place on the external Spiagge.it website, reached through our booking buttons. The following section covers booking data processed by Il Maestrale S.n.c.; Spiagge.it’s privacy policy also applies to its platform.

CATEGORIES OF DATA PROCESSED

The personal data collected through the online booking form are as follows:

• personal identification data, such as name and surname;
• contact details, such as e-mail address and telephone number.

PURPOSES OF PROCESSING

The personal data provided through the online booking form are collected and processed for the following purposes:

1. to provide the requested service, namely to allow you to make a booking at our establishment and to send you service communications relating to the confirmation, modification, reminder and cancellation of the booking (“Provision of the Service”);
2. to request reviews and collect feedback on the booked services (“Customer satisfaction”);
3. to comply with obligations provided for by laws, regulations and EU legislation ("Compliance with legal obligations”);
4. to prevent or identify any abuse or fraudulent activity against our establishment and therefore allow us to defend ourselves, including in legal proceedings ("Defence");
5. to send you marketing communications by e-mail concerning products and services similar to those you have purchased (“Soft Spam”).

LEGAL BASIS AND NATURE OF THE PROCESSING

The legal basis for the purpose of Provision of the Service is the performance of pre-contractual or contractual measures requested by you. Providing personal data for this purpose is not mandatory, but failure to do so will make it impossible to provide the requested service.

The processing carried out for the purpose of Compliance with legal obligations is necessary in order to comply with any applicable legal obligations.

The legal basis for the purpose of Customer Satisfaction is the legitimate interest of our establishment in requesting and collecting opinions and feedback on the services booked.

Similarly, the legal basis for the purpose of Soft Spam is the legitimate interest of our establishment in sending you marketing communications by e-mail relating to products and services similar to those you have already purchased. You may stop receiving these communications, without any consequences for you, by using the link at the bottom of each of these e-mails.

The processing carried out for the purpose of Defence is also based on the legitimate interest of our establishment in identifying and preventing any fraudulent activities or abuse in the use of the booking form or the Website, and therefore in protecting itself, including in legal proceedings.

DISCLOSURE OF PERSONAL DATA

In order to provide its services, our establishment will share the personal data provided for the online booking with Spiagge S.r.l. (VAT/Tax Code 0453664040; with registered office at Via Marecchiese 48, 47923 Rimini, Italy), owner of the SaaS platform that allows users to make bookings through the Website.

Your personal data may also be shared with: i) third parties used by our establishment to provide services on its behalf; ii) persons authorised by our establishment to process personal data necessary to carry out activities strictly connected to the provision of the service, such as our employees; iii) public, judicial or police authorities.

METHODS OF DATA PROCESSING AND TRANSFER OF PERSONAL DATA

The processing of personal data is carried out, in compliance with applicable legislation, also with the support of IT tools.

The data controller has adopted technical solutions and security measures that ensure the security of personal data and prevent their alteration, loss, incorrect processing or unauthorised access.

DURATION OF PROCESSING AND RETENTION

The data provided will be processed and stored for the period strictly necessary to pursue the purposes stated above. This is without prejudice to retention for a longer period in relation to requests from public authorities or in connection with the exercise of the right of defence in the event of disputes.

Personal data processed for Soft Spam will be retained until you object to such processing through the link at the bottom of each Soft Spam e-mail.

RIGHTS OF THE DATA SUBJECT

Pursuant to Articles 15 et seq. of the GDPR, you may exercise the following rights:

• obtain confirmation from the data controller as to whether or not personal data concerning you are being processed, and obtain information about the origin, purposes, categories of data processed, recipients to whom the personal data have been or will be disclosed, including abroad, and the retention period;
• obtain, without undue delay, the rectification of inaccurate data or the completion of incomplete data;
• obtain, without undue delay, the erasure of data pursuant to Article 17 of the GDPR;
• obtain the restriction of processing where the accuracy of the data is contested or the processing is unlawful, pursuant to Article 18 of the GDPR;
• obtain data portability by receiving the data in a structured format;
• object to the processing pursuant to Article 21 of the GDPR.

You may exercise the above rights by writing to the following e-mail address ilmaestralesnc@gmail.com.

In any case, you always have the right to lodge a complaint with the Italian Data Protection Authority, pursuant to Article 77 of the GDPR, if you believe that the processing of your personal data is contrary to the legislation in force.