Legal Notice & Privacy.

1. General Information

1.1 The protection of your personal data is of particular concern to us. We therefore process your data exclusively on the basis of the EU General Data Protection Regulation No. 679/2016 (hereinafter "GDPR").

1.2 In this privacy information we inform you about the most important aspects of data processing in connection with our website (hereinafter the "services" or "products").

1.3 All terms in this privacy notice have the meaning defined in the legal sources named in point 1.1.

2. Processed Personal Data

2.1 When we process your enquiry via our online contact and enquiry forms and ensure the technical operation of the website, we process the following personal data:

• Name
• Email address
• Telephone number (if provided in the form)
• IP address
• Content of your message in the contact form
• Technical data such as the URL via which you reach our website, your IP address, browser type, language selection and operating system (server log files of the web host)

2.2 Without the data listed above, we cannot provide the service (answering your enquiry or making the website available).

3. Purposes of Data Processing

3.1 We process the aforementioned data for the following purposes:

• to process and answer your enquiries, table reservations or messages sent via the contact form
• to ensure the functionality and IT security of the website and to prevent misuse of our contact form
• to comply with legal obligations

4. Lawfulness of Processing

4.1 [Consent]. When you submit one of our contact or enquiry forms and click the corresponding declaration of consent, you give your express consent to the processing of your personal data for the purpose of handling and answering your specific enquiry.

4.2 [Not applicable / Omitted, as no registrations or newsletter subscriptions take place]

4.3 [Performance of a contract]. When you make a binding table reservation or enquire about a catering service, we process your personal data in order to conclude and perform the pre-contractual or contractual service agreement entered into with you.

4.4 [Legal obligation]. We process your personal data in order to comply with the following legal obligations imposed on us: [retention requirements relating to tax and commercial documents as well as regulatory requirements for the hospitality industry].

4.5 [Not applicable / Omitted – no vital interests affected]

4.6 [Not applicable / Omitted – no tasks in the public interest]

4.7 [Legitimate interest]. The processing for the purpose of the technical provision and safeguarding of the website is necessary to protect the legitimate interests of our company. Our legitimate interest in storing technical log data and IP addresses lies in ensuring IT security, protecting the website against fraud or cyber attacks and improving the functionality of our web presence.

5. Transfer of Your Data to Third Parties

5.1 In certain circumstances we transfer your personal data to third parties, so-called processors, as follows:

Web hosting and form processing: To our web hosting provider and technical service provider, which operates the website and provides the server infrastructure (including receipt of the form data).

Video delivery: The background videos embedded on the homepage and the menu are delivered via the Cloudflare Stream service (Cloudflare, Inc.). When the videos are played, your IP address is transmitted to Cloudflare for technical reasons. This is necessary to deliver the video files; without this transmission the videos could not be displayed.

5.2 When you visit our website, you may reach other websites (e.g. via links to our profiles on Facebook, Instagram or TripAdvisor), on which data may be collected outside our control. In this case, the privacy policy of that other website operator applies.

6. Cookies and Essential Storage

6.1 This website uses only technically necessary cookies and comparable storage technologies that are required for the secure operation and basic functions of the site (e.g. protecting the contact form against misuse). For these technically necessary cookies, no prior consent is required under Art. 122 of the Italian Privacy Code.

6.2 6.2 We use no cookies for analysis, tracking, advertising or profiling purposes. No data is transmitted to advertising networks and no cross-website tracking takes place.

6.3 6.3 For directions we embed a Google Maps map. This map is not loaded automatically. You initially see only a placeholder with a notice that data is transmitted to Google when the map is loaded. Only when you actively click "Show map" is the map loaded and data (including your IP address) transmitted to Google. The legal basis for this is your consent (Art. 6(1)(a) GDPR). Without your click, no transmission to Google takes place. We have no influence over data processing by Google; Google's privacy policy applies.

6.4 6.4 The fonts used on this website are hosted locally on our own server and loaded from there. There is no connection to Google servers (Google Fonts) or other font providers. Your IP address is therefore not transmitted to third parties when the fonts are loaded.

6a. Reach Measurement

We collect anonymised access statistics for our website (number of visitors, pages viewed, origin of visits, device used and country). This analysis is carried out without cookies and without storing anything on your device. The assignment is made via a daily-changing, non-traceable identifier, so that no individual persons can be identified and no user profiles are created across multiple websites. It is not possible to trace this back to you personally.

The legal basis is our legitimate interest in statistically analysing website usage in order to improve our offering (Art. 6(1)(f) GDPR). Since no information is stored on or read from your device and no personal profiles are created, no prior consent is required under Art. 122 of the Italian Privacy Code. You may object to this processing at any time pursuant to Art. 21 GDPR; please use the contact details given above.

7. Duration of Processing of Your Personal Data

7.1 We process your personal data for the following periods:

• Data from the contact form: For the duration of processing your enquiry. If no contract is concluded (e.g. a reservation is declined), this data is deleted immediately, unless statutory retention obligations apply.
• Server log files and IP addresses: For security reasons these are stored by the web host for a short, technically customary period (usually 7 to 14 days) and then automatically deleted or anonymised.

8. Minors

8.1 We do not offer our services to minors under 14 years of age. If you have supervisory responsibility for a person who is not yet 14 years old and notice that the minor has transmitted data to us without our consent, we ask you to contact us immediately at cristla.restaurant@gmail.com, so that we can take the legally required measures in the interest of the minor.

9. Your Rights

9.1 You have an absolute right to control your data at any time. In principle you have the rights to information, rectification, erasure, restriction, data portability, withdrawal and objection.

9.2 A withdrawal of your consent does not affect the lawfulness of the processing carried out up to that point. Even after a withdrawal, data may continue to be processed if another legal basis exists. Objections to marketing measures are possible at any time.

10. EU Dispute Resolution

The European Commission provides a platform for online dispute resolution (ODR). This platform serves as a point of contact for the out-of-court settlement of disputes arising from online purchase contracts or online service contracts involving a consumer. You can access the ODR platform at: https://ec.europa.eu/consumers/odr/

We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.