Privacy notice
Version 2026-10-20c. Information provided under Article 13 of Regulation (EU) 2016/679 (GDPR) to people who use tavoloalvolo.com. The Italian version is the reference text.
1. Data controller
Data controller: Adige Consulting LLC (Tavolo al Volo), a Utah limited liability company, United States. Contact: [email protected]. Reference person: Grant Smith, Managing Partner.
No data protection officer (DPO) has been appointed.
2. What data we process
- Waitlist (diners): email (required); area of Milan and favorite restaurants (optional); if you choose WhatsApp alerts, your phone number and that choice; site language; date and time of signup and consents, the version of this notice in force and your statement that you are at least 18.
- Restaurant requests: restaurant name, contact person's name and email (required); phone, area and message (optional); language, date and time of the request.
- Emails you send to [email protected]: your address and the content of the message.
- Technical data: to deliver and protect the site, our provider Cloudflare processes connection data such as IP address, date and time and pages requested. We do not use it to profile you.
We do not ask for health data or other special categories of data (Art. 9 GDPR): please do not enter them in the free text fields.
3. Why we process it and on what legal basis
- Email alerts about the launch and, once the service is live, about open tables at the places you follow. Legal basis: your consent (Art. 6(1)(a) GDPR).
- WhatsApp alerts, only if you choose them and only once they are available. Legal basis: your specific, separate consent (Art. 6(1)(a) GDPR).
- Restaurant requests: answering and discussing starting the service together. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
- Answering your emails. Legal basis: pre-contractual steps if the request is about the service (Art. 6(1)(b)); otherwise our legitimate interest in replying to people who write to us (Art. 6(1)(f)).
- Running and securing the site and preventing abuse of the form. Legal basis: our legitimate interest in keeping the site safe and working (Art. 6(1)(f)).
- Proof of consent: we keep the date, time and notice version so we can demonstrate consent, as Art. 7(1) GDPR requires (Art. 6(1)(c)).
We do not sell your data and we do not use it for third party advertising.
4. Do you have to provide the data?
No, there is no legal or contractual obligation. To join the waitlist we do need your email and your consent: without them we cannot sign you up. The WhatsApp number is needed only if you choose WhatsApp alerts. For restaurant requests we need the restaurant name, contact person and email, otherwise we cannot reply. All other fields are optional.
5. Who receives the data
- Cloudflare, Inc., which hosts the site and stores the data sent through the forms, as a processor under Art. 28 GDPR, under its Data Processing Addendum. Cloudflare privacy policy.
- The provider of the mailbox used for [email protected], for emails you send us.
- To send alerts we will use an email delivery provider acting as a processor. We will name it in this notice before the first alert is sent.
- WhatsApp (Meta): only once WhatsApp alerts launch and only for people who chose them. We will update this notice before then.
- Public authorities, only where the law requires it.
Before the service launches we do not share waitlist data with restaurants. If in future a restaurant were to receive some of your data (for example when you confirm a table), we will tell you first by updating this notice.
6. Transfers outside the European Union
Cloudflare, Inc. is based in the United States and runs data centers in many countries. Transfers to Cloudflare, Inc. rely on the European Commission adequacy decision for the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), in which Cloudflare, Inc. participates (entry on the official Data Privacy Framework site). Cloudflare's Data Processing Addendum provides for the European Commission's standard contractual clauses if that participation lapses. You can ask us about these safeguards at [email protected].
7. How long we keep the data
- Waitlist: while you are active on the list. Every 12 months we will email you to ask you to confirm that you want to keep receiving updates; if you do not confirm within 30 days, we delete your data. In any case we never keep it longer than 24 months after your last activity (signup, update of your details, confirmation or reply to an alert). You can always withdraw consent or ask for deletion sooner.
- Proof of consent: for the same period as the data it refers to.
- Restaurant requests and emails: 24 months after the last contact. If an agreement follows, we keep what is needed for its duration and for the periods required by law.
- Technical data: for the periods set out by Cloudflare in its privacy policy.
8. Your rights
At any time you can ask to access your data (Art. 15 GDPR), correct it (Art. 16), erase it (Art. 17), restrict its processing (Art. 18), receive it in a structured, machine readable format (portability, Art. 20), and you can object to processing based on legitimate interest (Art. 21). If we correct or erase data, we tell anyone who received it (Art. 19).
You can withdraw your consent at any time, as easily as you gave it: every email and every alert will include an unsubscribe link, or you can write to [email protected]. Withdrawal does not make earlier processing unlawful.
To exercise your rights write to [email protected]. We reply without undue delay and in any case within one month (Art. 12(3) GDPR).
You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it, how to file a complaint), or with the supervisory authority of the EU country where you live or work (Art. 77 GDPR).
9. Automated decisions
We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). When a table opens up, the alert goes out at the same time to everyone on that restaurant's list and the table goes to whoever confirms first.
10. Minimum age
The waitlist is only for people aged 18 or over. If we find out that someone younger has signed up, we delete their data.
11. Cookies and tracking
This site sets no cookies, does not use browser localStorage or any other tracking tool and loads no third party resources (no external fonts, analytics or social buttons). That is why there is no cookie banner, in line with the Garante's cookie guidelines of 10 June 2021. If we ever use cookies other than technical ones, we will ask for your consent first.
12. Security
The site is served over an encrypted connection (HTTPS) and access to the collected data is restricted to the controller and the people it authorizes.
13. Changes
We may update this notice, for example when alerts or WhatsApp launch. The version in force is always on this page, with its date. If changes affect processing based on consent, we will ask for new consent where needed.