Privacy Policy

Last updated: May 2026

This Privacy Policy explains how personal data is collected and processed when you visit pastaloversflorence.it (the "Website") and when you book a cooking class. Processing is carried out in compliance with Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree no. 196/2003 (the "Privacy Code"), as amended.

1. Data Controller

SIMA CONSTANTIN
VAT no. (P.IVA): 07551960482
Via Cavour 26/28R – Florence, Italy
Email: info@pastaloversflorence.it

2. What data we collect

Booking and contact data: first and last name, email address, telephone number, number of participants, and any dietary requirements, allergies or notes you choose to provide.
Payment data: payments are processed directly by our payment providers (PayPal and XPay/Nexi). We do not collect or store your full card number; we only receive confirmation of the transaction and basic order details.
Browsing data: data automatically transmitted by your device when using the Website (e.g. IP address, browser type, pages visited, date/time of access), processed for security and statistical purposes.
Cookie data: see our separate Cookie Policy.

3. Purposes and legal basis

Purpose	Legal basis
Managing your booking and providing the cooking class	Performance of a contract (Art. 6(1)(b) GDPR)
Processing payments	Performance of a contract (Art. 6(1)(b) GDPR)
Replying to your enquiries	Legitimate interest / pre-contractual measures (Art. 6(1)(b)/(f) GDPR)
Accounting, tax and legal obligations	Legal obligation (Art. 6(1)(c) GDPR)
Newsletter / marketing (if applicable)	Your consent (Art. 6(1)(a) GDPR)
Website security and analytics	Legitimate interest / consent for non-essential cookies (Art. 6(1)(f)/(a) GDPR)

Providing booking and payment data is necessary to complete a reservation; failure to provide it means we cannot confirm your booking.

4. Recipients of the data

Your data may be shared with trusted third parties acting as data processors or independent controllers, including:

PayPal (Europe) S.à r.l. et Cie, S.C.A. – payment processing;
Nexi Payments S.p.A. (XPay) – card payment processing;
[HOSTING PROVIDER] – website hosting;
[EMAIL/NEWSLETTER PROVIDER, if any] – email communications;
accountants, tax advisors and, where required, public authorities.

Data is not disseminated to the general public and is never sold.

5. International data transfers

Some providers may process data outside the European Economic Area. In such cases, transfers are protected by adequacy decisions or appropriate safeguards (e.g. Standard Contractual Clauses) pursuant to Articles 44–49 GDPR.

6. Retention period

Booking and contract data: for the duration of the service and up to 10 years for accounting/tax purposes.
Enquiries that do not lead to a booking: up to 24 months.
Marketing data: until you withdraw consent or object.

7. Your rights

Under Articles 15–22 GDPR you have the right to access, rectify, erase, restrict and port your data, to object to processing, and to withdraw consent at any time without affecting prior lawful processing. To exercise these rights, contact info@pastaloversflorence.it.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali – www.gpdp.it).

8. Changes to this Policy

We may update this Privacy Policy from time to time. The current version is always available on this page with its publication date.