This notice explains how personal data are processed when you visit the Osteria dalla Zabariona website, use the contact form or restricted area, or continue to the external booking service.
Data controller and contacts
The data controller is LA ZABARIONA S.A.S. DI ANDREA RONDINELLI E C., VAT no. 02672740392, Via Giuliano Argentario 19, 48121 Ravenna (RA), Italy. Privacy enquiries: mangiari@osteriadallazabariona.com · +39 327 897 6596.
Data we process
We may process technical browsing and security data (such as IP address, time, requested page, browser and device), information voluntarily provided by email or telephone and, for authorised staff only, a pseudonymous fingerprint derived from IP address and browser to limit failed sign-in attempts in the daily-specials editor.
Information entered in the Pienissimo booking form may include contact and booking details and, only when voluntarily supplied, allergy or dietary notes that could reveal health data.
Purposes and legal bases
- Site operation, security, abuse prevention and error diagnosis: legitimate interests (GDPR Art. 6(1)(f)).
- Enquiries and booking management: pre-contractual measures and performance of the requested service (Art. 6(1)(b)).
- Administrative, tax and legal duties: legal obligation (Art. 6(1)(c)).
- Allergy or health information: explicit consent or another applicable condition under GDPR Art. 9. Please provide only strictly necessary information.
- Marketing or profiling through Pienissimo: only after a separate, optional choice by the user.
Bookings through Pienissimo
The “Book” button opens an external form provided through Pienissimo. La Zabariona remains controller for booking data; the provider processes data under the applicable agreement and instructions. Before submitting, also read the notice linked to the Pienissimo form.
Contact form through Tally
The contact form embedded on the Visit page is provided by Tally. It collects your name, email address, enquiry type and message so we can reply. It is not a booking form; please do not include health information or other sensitive data. Tally states that form data are stored in Europe. We have enabled submission emails; according to Tally’s subprocessors list, these may involve SendGrid in the United States. See Tally’s GDPR information.
Recipients and transfers
Data may be handled by authorised staff and necessary hosting, security and booking providers, appointed as processors where required. If a provider involves a transfer outside the European Economic Area, GDPR safeguards such as adequacy decisions or standard contractual clauses are used. An up-to-date list of processors may be requested from the controller.
Retention
Data are kept only as long as needed for their purpose and legal duties. Enquiries are retained until resolved and where needed to protect legal rights. Booking data follow the periods stated by the service and applicable administrative requirements. The restricted-area cookie lasts 8 hours; pseudonymous failed-login fingerprints are deleted within 24 hours.
Cookies and essential technologies
The official website does not set its own analytics, advertising or profiling cookies. It uses technical technologies needed for operation and security. The embedded form on the Visit page loads Tally content; any provider cookies or technologies are described in its notices.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| __cf_bm | Cloudflare | Security and automated protection from malicious traffic. | About 30 minutes of inactivity |
| zab_proposte_session | Osteria dalla Zabariona | Technical authentication for the daily-specials staff area; set only after sign-in. | 8 hours |
Links to maps and social networks open external services only after a click.
Your rights
Where applicable, you may request access, correction, erasure, restriction, portability or object to processing, and withdraw consent without affecting prior processing. Contact the controller using the details above. You may also lodge a complaint with the Italian Data Protection Authority.
Updates
This notice is updated when services or legal requirements change. Last updated: 17 September 2026.
