Privacy and cookies

AC Squared srl
Registered office: Via Beato Angelico, 23/1 - 20133 Milano (MI)
VAT no. 14465550961
Email: panattonin@panattonin.com

You can write to this address with any question about this policy or to exercise your rights.

1. Browsing and website security

Like any website, the servers hosting panattonin.com automatically record some technical data with every request: IP address, date and time, page requested, browser and device type, and the outcome of the request. We need it to run the site, find errors and protect it from abuse.

Legal basis: our legitimate interest in the operation and security of the site (Art. 6(1)(f) GDPR).

2. Table bookings

The booking form asks for your first and last name, email, mobile number, date, time, number of guests, how you heard about us and, optionally, notes and a discount code. We use this data to:

• check availability, confirm your table and send you confirmation emails and the link to change or cancel your booking;
• keep a history of your bookings in our management system (for example to recognise you when you come back or to handle no-shows), for the period stated below;
• save your contact in our CRM, provided by Brevo, the same service we use to send emails.

Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR). Your consent is not required. Without this data we cannot record the booking.

The “I have read the privacy policy” box is not a request for consent: it only confirms that this page was shown to you before submitting.

If we confirm your table on WhatsApp, that conversation takes place on Meta’s platform and is governed by WhatsApp’s privacy terms.

3. Catering and event requests

Through the catering form you send us your name, email, optionally your phone number, and the event details. We use them only to reply and prepare a quote. Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).

4. Promotional communications (newsletter)

Only if you tick the box to receive news, special offers and themed evenings is your contact added to the list we use to send promotional emails via Brevo. You can unsubscribe at any time using the link at the bottom of every email or by writing to us. Legal basis: consent (Art. 6(1)(a) GDPR), optional and separate from the booking.

5. Statistics (only with your consent)

If you accept the “Statistics” category on the cookie banner, we enable:

• Google Analytics 4 (Google Ireland Limited): tells us, in aggregate form, which pages are visited, where traffic comes from and on which devices;
• Microsoft Clarity (Microsoft Corporation), on the digital menu only: records taps, scrolling and reading time to produce heatmaps and visit replays, so we can see which dishes and sections are read. Any text you type is masked and not recorded. Recordings are not linked to your name.

Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

6. Marketing (only with your consent)

If you accept the “Marketing” category on the cookie banner:

• we enable the Meta Pixel (Meta Platforms Ireland Limited), which records the pages visited so that relevant ads can be shown on Facebook and Instagram to people who have already visited the site (retargeting) and to measure their effectiveness;
• we remember which campaign or channel brought you to the site (for example an ad or a newsletter), to understand which ones actually lead to bookings;
• when you submit a booking and when we confirm it, we also report it to Meta from our server (Conversions API) together with the Pixel identifiers. Only if you have also consented to promotional communications do we send your email, phone, first and last name in encrypted form (SHA-256 hash), which Meta uses only to match the event to one of its accounts. Without either consent we send nothing.

Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

7. Anonymous measurement without cookies

Regardless of the banner, we anonymously count some actions in the digital menu (for example which dish or category is opened and in which language) and site visits through Vercel Web Analytics. These measurements use no cookies, store nothing on your device, do not record your IP address and cannot recognise you on a later visit. Legal basis: our legitimate interest in improving the menu and the site (Art. 6(1)(f) GDPR).

8. Embedded third-party content

Some pages show a Google Maps map and Google reviews through an Elfsight widget. To display them your browser connects to these providers’ servers, which therefore receive your IP address and technical browser information and process them under their own policies. We receive no data from these services.

Data is processed by the controller’s authorised staff and by the providers that help us run the site, appointed as processors (Art. 28 GDPR) or acting as independent controllers for their own services:

• Vercel Inc.: website hosting;
• Turso: cloud database for bookings and the menu;
• Brevo (Sendinblue SAS): CRM, service emails and newsletter;
• Google Ireland Limited: Google Analytics, Google Maps;
• Microsoft Corporation: Microsoft Clarity;
• Meta Platforms Ireland Limited: Meta Pixel and Conversions API;
• Elfsight LLC: reviews widget.

Data is never sold or disclosed to the public.

Some of the providers listed (Vercel, Google, Microsoft, Meta, Elfsight) may process data in the United States. Transfers rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, for providers that are certified under it, or on the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR).

• Technical browsing data: for the limited period set by the hosting provider, unless needed to investigate abuse.
• Bookings and customer history: up to 24 months from your last booking or visit. After that, your name, email and phone number are deleted, including from the Brevo CRM, and only anonymous booking data (dates and number of guests) is kept for statistics. You can ask us to delete it at any time.
• Catering requests: for as long as needed to reply and, if the event goes ahead, for the duration of the relationship and the related legal obligations.
• Newsletter: until you unsubscribe or withdraw consent. In that case your contact is kept beyond the 24 months stated above.
• Google Analytics: according to the service’s retention settings, up to 14 months.
• Microsoft Clarity: visit recordings up to 30 days, aggregate heatmaps up to 13 months.
• Cookies: for the duration shown in the tables below.

We may keep data longer only where required by law or by an authority. When the period ends, data is deleted or anonymised.

At any time you can ask us to:

• confirm whether we process your data and give you a copy (Art. 15);
• correct or complete it (Art. 16);
• erase it (Art. 17);
• restrict its processing (Art. 18);
• provide it in a machine-readable format (Art. 20);
• object to processing based on our legitimate interest (Art. 21);
• withdraw consent already given, without affecting processing carried out before the withdrawal (Art. 7).

Just write to panattonin@panattonin.com. We will reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or the authority of your country of residence.

Cookies are small text files that a website saves in your browser and reads again on later visits. Some are needed for the site to work; the others are only enabled if you choose so.

The banner you see on your first visit offers three equally prominent choices (“Accept all”, “Reject all”, “Customize”) and lets you choose separately between “Statistics” and “Marketing”. Closing the banner with the X is the same as rejecting all. No statistics or marketing cookie is set before you choose.

You can change your mind at any time: the “Manage cookies” link at the bottom of every page clears your choice and shows the banner again.

Technical cookies: always active

They do not require consent because the site needs them to work.

Statistics: only with your consent

Marketing: only with your consent

Managing cookies in your browser

You can also delete or block cookies in your browser settings:

• Chrome: Settings → Privacy and security → Third-party cookies;
• Safari (iPhone): Settings → Safari → Advanced → Website Data; on Mac: Safari → Settings → Privacy;
• Firefox: Settings → Privacy & Security → Cookies and Site Data;
• Edge: Settings → Cookies and site permissions.

If you block all cookies, some features of the site, such as remembering your banner choice, may not work.

We update this page when the services used by the site change. The date of the last update is shown at the top. This is a translation of the Italian version, which prevails in case of discrepancy.