Privacy notice

Who processes your data

The data controller — the person who decides what happens to your data and answers for it — is:

• TRENO NICCOLÒ MARIA LORENZO
• VAT no. 01342030861
• Registered office: Via Federico De Roberto 36, 94015 Piazza Armerina (EN), Italy
• Email: 3nolounge@gmail.com
• Phone: +39 377 379 0834

Two different addresses, and that is not a mistake

The registered office above is the business address, and it is not where you eat. The restaurant, 3No, is at Via Luigi Pirandello 47, inside the Zafran Boutique Hotel, 97018 Donnalucata (RG), Italy.

For anything to do with your data — requests, complaints, exercising your rights — use the first address. To book a table or come and find us, the second.

What data we collect

The site has no login area and asks you to register for nothing. As soon as you arrive the cookie banner appears and asks you to make a choice: that choice says nothing about who you are and is not personal data — it is written to a cookie in your browser, and the details are in the cookie policy.

The only place where you enter data of your own is the form used to request a table. These are the fields, and there are no hidden ones:

• Name — required
• Number of people — required
• Phone — required
• Date — required
• Time — required
• Notes — optional, free text

The Notes field and data concerning health

The Notes field is free text, and the grey hint inside it invites you to tell us about allergies or intolerances. A food allergy is information about your health, which the GDPR protects more strictly than the rest (Article 9).

We process it only because you chose to tell us, and only so that we can serve you safely at the table: the legal basis is your explicit consent (Article 9(2)(a)), which you give by ticking the box before sending. That box is never pre-ticked, and without your tick the message does not go anywhere.

Writing it down remains your choice. You can leave the field empty and tell us in person when you arrive, or over the phone: it makes no difference in the kitchen, and in that case nothing is written down anywhere.

Why we process it, and on what legal basis

Purpose: to act on your request for a table — check whether there is room, confirm it, get back to you if something changes. Nothing else: we send you no advertising and sign you up to nothing.

Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b)). For any health information in the notes, the basis is instead your explicit consent, as explained above.

Nobody obliges you to use the form — you can always call. But if you do use it, without a name, number of people, phone, date and time we cannot hold the table.

Where the data you type ends up

This site has no application server and no database. Form data does not reach us through it, and there is no archive inside this site for it to land in.

When you press “Send on WhatsApp”, the form assembles what you have written into a ready-made message and opens WhatsApp on your device. You are the one who sends it, from your own account. If you change your mind and do not send it, nothing reaches us.

There is one point worth spelling out, because it is rarely mentioned and it matters here. The data travels inside the web address the form opens (wa.me), written into the address itself. Depending on your device, that address is either handled directly by the WhatsApp app or goes through Meta’s servers first: in the second case Meta sees that data the moment the link opens — that is, before you press send.

The message arrives at the restaurant’s WhatsApp number, +39 377 379 0834, which is the same as the phone number. Along with the text we also see your number and your WhatsApp profile name: the app shows them to us because the message comes from you, even if you did not type them into the form.

If you would rather nothing passed through this site at all, use the “Call” button next to the form: it places a phone call and nothing else.

The data the server records by itself

As with any website, when you open a page the server delivering it records the request: IP address, date and time, page requested, browser type. This is technical data; it exists so that pages can be delivered and so that faults or attacks can be noticed, and we do not use it to work out who you are.

The site is hosted by Vercel Inc. (United States), which acts as a processor on our behalf and keeps those logs under its own terms. The legal basis is our legitimate interests in keeping the site running and secure (Article 6(1)(f)).

We do not cross-reference this data with the form data, and there is no way for us to get from an IP address to a booking.

Who we share your data with

Nobody beyond those needed to seat you. We do not sell, trade or disclose your data to third parties for commercial purposes, and nobody pays us for it.

The only parties involved are these:

• The people at the restaurant who handle bookings.
• Meta Platforms Ireland Ltd., which provides WhatsApp: the message travels through its infrastructure and is also processed under its own rules.
• Vercel Inc., which hosts the site: it processes the technical browsing data described above, not the form data.

• WhatsApp privacy policy
• Vercel privacy policy

How long we keep it

Messages stay in the restaurant’s WhatsApp chat for one month from the day they arrive, and are then deleted.

We keep no other copies: bookings are not copied into diaries, registers or booking software. What exists is in the chat; delete that, and it is all gone.

Transfers outside the European Union

The restaurant does not transfer your data outside the European Union.

The two providers above do, as both have a United States parent company. Meta and Vercel state that they transfer data on the basis of the standard contractual clauses approved by the European Commission (Article 46(2)(c)) and, for transfers to the United States, of the EU-US Data Privacy Framework. The safeguards they apply are described in their own notices, linked in the “Who we share your data with” section.

Automated decision-making and profiling

We do none. No decision concerning you is taken by an automated system, we build no profiles and we have no tools to do so: as the cookie policy explains, this site carries no analytics of any kind.

Your rights

You may exercise the rights set out in Articles 15 to 22 of the GDPR at any time:

• Access — find out what data of yours we hold and obtain a copy.
• Rectification — have it corrected if it is wrong or incomplete.
• Erasure — ask for it to be deleted.
• Restriction — ask that it only be stored and not used.
• Objection — object to the processing.
• Portability — receive it in a machine-readable format.
• Withdrawal of consent — where processing is based on consent, withdraw it whenever you like, without affecting the lawfulness of processing carried out beforehand.

How to exercise them, and who to turn to

Write to 3nolounge@gmail.com or call +39 377 379 0834. We reply within one month.

If you believe the processing of your data infringes the GDPR you may lodge a complaint with the Garante per la protezione dei dati personali, the Italian supervisory authority, or seek a judicial remedy.

• Garante per la protezione dei dati personali (Italian supervisory authority)

Cookies

The site uses two of its own cookies and none for profiling. The only thing it loads from an outside server is the Google map in the Contact section, and only once you have consented. Names, purposes and durations are in the cookie policy, linked at the bottom of every page.

Changes to this notice

If the way we handle data changes, we will update this page along with the last-updated date at the top. Changes take effect when they are published.