Privacy Policy

1. Data controller

The data controller is Il Mustacchio Gelateria & Caffetteria, VAT number 04440830232, registered at via Galvani 31, 37138 Verona (VR).

2. What data we collect

If you use the contact form we collect your name, your email address and the content of the message you send us. We ask for nothing else, and we recommend you do not include special category information (such as health data) in your message.

As with any website, our hosting provider automatically records technical data such as your IP address, the date and time of the request and your browser type. These logs exist to keep the site secure and working.

3. Why we process it and on what legal basis

We process contact form data for the sole purpose of reading your enquiry and replying to it. The legal basis is our legitimate interest in responding to people who contact us and, where the enquiry concerns a service, taking steps at your request prior to entering into a contract (Art. 6.1.f and 6.1.b GDPR).

Technical logs are processed on the basis of our legitimate interest in keeping the site secure and available (Art. 6.1.f GDPR).

We do not use your data for marketing and will not send you promotional messages without your consent.

4. Cookies and tracking

This site uses no cookies, installs no analytics or profiling tools and does not track visitors. Nothing is stored on your device. That is why you will not see a consent banner: there is nothing to consent to.

If we introduce analytics in future, we will update this policy and ask for your consent before enabling anything.

5. Who we share data with

We do not sell or trade your data. We rely on a small number of providers who process it on our behalf as data processors:

Vercel Inc. — website hosting and technical logs; Resend (Plus Five Five, Inc.) — delivery of messages sent through the contact form; Indian Type Foundry (Fontshare) — font delivery, which receives your IP address when the typeface loads.

Data may also be disclosed to the competent authorities where the law requires it.

6. Transfers outside the European Union

Some of the providers listed above are based in the United States. Those transfers rely on the Standard Contractual Clauses approved by the European Commission, or on another mechanism permitted under Chapter V of the GDPR.

7. How long we keep it

We keep messages received through the contact form for as long as it takes to deal with your enquiry and, after that, for a maximum of 24 months, unless we need to keep them longer to meet a legal obligation or to establish or defend a legal claim.

Server logs are retained for the period set by our hosting provider.

8. Your rights

At any time you can ask for access to your data, its correction or erasure, restriction of processing, data portability, and you can object to processing based on legitimate interest.

To exercise these rights you can use the contact form on this site, or write to the registered address given in section 1. We will reply within one month.

If you believe your data is being handled unlawfully, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority in your country of residence.

9. Changes to this policy

We may update this policy to reflect changes in the services we use or in the law. The date at the top of this page always shows the most recent revision.