Skip to content
ITEN
Request a quote

Privacy Policy

This notice explains how Apulian Catering processes the personal data of people who visit https://apuliancatering.it/ or use it to request a quote. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 ("Privacy Code"), and it covers this website only, not external sites reached through links. We process data lawfully, fairly and transparently, and only to the extent necessary (Art. 5 GDPR).

1. Data controller

Apulian Catering di Carbone Mariagrazia
Via Boemondo Normanno 48, 72019 San Vito dei Normanni (BR), Italy
VAT no. IT02747900740
Email: info@apuliancatering.it · Phone: +39 339 527 5389

The controller decides why and how personal data is processed. For any question about your data, including the rights described in section 6, write to info@apuliancatering.it.

2. What data we collect and why

We only process the data needed to run the website and answer your requests. For visit statistics we use Google Analytics, which is enabled only if you give your consent in the cookie banner. No advertising or profiling tools are active: if any are added in the future, we will update this notice and enable them only with your consent.

  • Website browsing and technical cookies
  • Storage of your preferences (language, cookie consent, accessibility)
  • Quote request form
  • Online quote configurator
  • Internal notifications of requests (email, Telegram, WhatsApp)
  • Anti-spam protection of the forms
  • Contact by email, phone and WhatsApp
  • Automatic translation of the configurator (at your request)
  • Map of our headquarters with Google Maps
  • Visit statistics with Google Analytics (with your consent)
  • Publication of Google reviews
  • WordPress platform and hosting

3. How, where and for how long

Methods. Data is processed electronically, with technical and organisational security measures designed to prevent loss, misuse and unauthorised access. Only the controller and authorised staff can access it.

Legal basis. Each processing activity relies on a specific legal basis, stated in section 4: pre-contractual steps taken at your request (Art. 6.1.b GDPR), legal obligations (Art. 6.1.c), the controller's legitimate interest (Art. 6.1.f) or your consent (Art. 6.1.a), which you can withdraw at any time without affecting processing already carried out.

Place. Data is processed at the controller's premises and on the servers of the website's hosting provider, located in the European Union (Germany). Any transfer outside the EU is described in section 5.

Retention. We keep data only as long as needed for the purposes stated for each service in section 4, unless the law requires longer (for example tax rules, if a request becomes a contract). After that, data is deleted or anonymised.

4. Services in detail

Website browsing and technical cookies · necessary

Without your consent, the site uses only technical cookies that it needs to work, such as the one that remembers your language. Like any website, the server also logs some technical data about visits. The full list is in the Cookie Policy.

  • Data processed: technical cookies, IP address, browser and pages visited in the server logs
  • Legal basis: the controller's legitimate interest in providing a secure, working website (Art. 6.1.f GDPR)
  • Retention: cookies up to 1 year (see the Cookie Policy); server logs as long as the hosting provider keeps them, normally no more than 30 days

Storage of your preferences · necessary

We remember the choices you make on the site on your own device, so you do not have to repeat them: your language, your cookie choices and your accessibility settings (text size, contrast and similar).

  • Data processed: chosen preferences, date of the consent choice, anonymous consent identifier
  • Legal basis: a service you request (Art. 6.1.b GDPR) and the obligation to be able to prove consent (Art. 7.1 GDPR)
  • Retention: on your device until you clear your browser data; the cookie choice for no more than 6 months, after which we ask again

Quote request form · necessary

When you fill in the "Request a quote" form, we collect the data you enter to prepare a proposal and contact you. The request is stored in the site's private area and emailed to the controller; you receive a confirmation email with a summary at the address you entered.

  • Data processed: type of event, date, number of guests, venue, name, email, phone, message; IP address for anti-spam checks only
  • Legal basis: pre-contractual steps at your request (Art. 6.1.b GDPR)
  • Retention: as long as needed to handle the request and no more than 24 months after the last contact; if the request becomes a contract, for the periods required by law

Online quote configurator · necessary

The /preventivo/ page lets you build your event (proposals, quantities, number of guests) and send the request. Your selections before sending stay in your browser only; the form data stays in the open tab and is deleted when you close it. Once sent, the request is stored in the site's private area and you receive a summary by email. You can also send us the summary on WhatsApp with the dedicated button: in that case the message is sent from your own WhatsApp.

  • Data processed: first name, last name, email, phone, event date and time slot, venue, chosen proposals and estimated total; IP address for anti-spam checks only
  • Legal basis: pre-contractual steps at your request (Art. 6.1.b GDPR)
  • Retention: 24 months from the request, then automatic deletion; if the request becomes a contract, for the periods required by law
  • Recipients: the controller and authorised members of staff

Internal notifications of requests · necessary

To reply quickly, when a request arrives the staff receives an alert with its summary: by email, on Telegram and on WhatsApp through the CallMeBot service. These alerts are for internal organisation only and are never used to send you messages.

  • Data processed: the quote request data (name, contact details, date, venue, chosen proposals)
  • Legal basis: pre-contractual steps at your request (Art. 6.1.b GDPR) and the controller's legitimate interest in handling requests promptly (Art. 6.1.f GDPR)
  • Retention: in the staff's messaging apps, as long as needed to handle the request
  • Providers: the site's email provider; Telegram (Telegram Messenger, https://telegram.org/privacy); CallMeBot (https://www.callmebot.com) and WhatsApp (Meta Platforms Ireland Ltd., https://www.whatsapp.com/legal/privacy-policy-eea)

Anti-spam protection of the forms · necessary

The forms are protected by checks run directly on our server, with no external service: a hidden field that bots fill in and people do not, a minimum completion time and a limit on submissions per IP address.

  • Data processed: IP address and technical data of the submission (completion time, check results)
  • Legal basis: legitimate interest in site security and preventing abuse (Art. 6.1.f GDPR)
  • Retention: the per-IP submission counter for no more than 1 hour
  • Providers: none, the check runs on the site's server

Contact by email, phone and WhatsApp · necessary

If you write to us or call us, we use the data you give us only to reply. The WhatsApp buttons on the site open the WhatsApp app: from that point WhatsApp's privacy policy also applies.

  • Data processed: email address, phone number, name and content of the messages or call
  • Legal basis: pre-contractual steps at your request (Art. 6.1.b GDPR)
  • Retention: as long as needed to handle the request and no more than 24 months after the last contact
  • Providers: the site's email provider; WhatsApp (Meta Platforms Ireland Ltd., https://www.whatsapp.com/legal/privacy-policy-eea)

Automatic translation of the configurator · at your request

The configurator has a language selector (GTranslate). Translation starts only if you choose a language other than Italian: in that case the page text is sent to Google's translation service, which also receives your IP address. The chosen language is stored in your browser.

  • Data processed: IP address, page text to be translated, chosen language
  • Legal basis: a service you request (Art. 6.1.b GDPR)
  • Retention: the chosen language in your browser until you clear your browsing data; for data processed by Google, see its privacy policy
  • Providers: GTranslate (https://gtranslate.io/privacy-policy) and Google (Google Ireland Ltd., https://policies.google.com/privacy)

Map of our headquarters with Google Maps · legitimate interest

The Contact page embeds a Google Maps map showing where our headquarters is. When you open the page, your browser connects to Google, which receives your IP address and may use its own cookies.

  • Data processed: IP address, technical browser data, any Google cookies
  • Legal basis: the controller's legitimate interest in showing how to reach us (Art. 6.1.f GDPR); for Google's cookies, the choices you make in the cookie banner
  • Retention: for data processed by Google, see its privacy policy
  • Providers: Google (Google Ireland Ltd., https://policies.google.com/privacy)

Visit statistics with Google Analytics · with your consent

We use Google Analytics 4, connected to the site through Google's Site Kit plugin, to learn in aggregate form how many people visit the site, which pages they read and which devices they use: this helps us improve our content and services. Analytics sets the _ga and _ga_* cookies only if you press "Accept" or enable statistics in the banner. If you do not consent, Google Consent Mode makes the site send Google only technical signals without cookies or identifiers, which Google uses for statistical estimates. Users logged in to the site's private area are not tracked. We do not use Analytics for advertising or to profile visitors, and Google Analytics 4 does not log or store IP addresses.

  • Data processed: _ga and _ga_* cookies, pages visited, visit duration, device and browser type, approximate location (city or region) derived from the IP address, traffic source, interactions with the site
  • Legal basis: consent (Art. 6.1.a GDPR), which you can withdraw at any time from the cookie preferences panel
  • Retention: cookies up to 2 years; statistics data according to the Analytics property setting, up to 14 months
  • Providers: Google (Google Ireland Ltd., https://policies.google.com/privacy; how Google uses data: https://policies.google.com/technologies/partner-sites)

Google reviews · legitimate interest

On the Home and About us pages we publish some of the reviews that customers left on Apulian Catering's Google profile. Our server downloads them through the Google Business Profile API: browsing the site does not send any data to Google. If you wrote a review and do not want it shown on the site, write to us and we will remove it.

  • Data processed: the author's public name, text, rating and date of the review, as published on Google
  • Legal basis: the controller's legitimate interest in showing customer feedback (Art. 6.1.f GDPR)
  • Retention: as long as the review is published on Google; the data is refreshed daily
  • Providers: Google (Google Ireland Ltd., https://policies.google.com/privacy)

WordPress platform and hosting · necessary

The site is built with WordPress, open-source software installed on our hosting, and does not send browsing data to WordPress.org. The hosting provider hosts the site, database and mailboxes on servers in the European Union and acts as data processor.

  • Data processed: all the data described in this notice, stored on the server; technical logs
  • Legal basis: the controller's legitimate interest in running the site securely (Art. 6.1.f GDPR)
  • Retention: according to the periods stated for each service
  • Providers: the website's hosting provider (servers of Hetzner Online GmbH, Germany)

5. Transfers outside the European Union

Some providers may also process data outside the EU:

  • Google, if you accept Google Analytics statistics, use the configurator's automatic translation or visit the Contact page with the map: Google takes part in the EU-U.S. Data Privacy Framework and applies the European Commission's standard contractual clauses.
  • Telegram and CallMeBot, only for internal staff notifications: they may process data outside the EU under their own privacy policies.

Otherwise, data stays in the European Union.

6. Your rights

At any time you can ask the controller to:

  • access your data and receive a copy (Art. 15 GDPR);
  • correct or complete it (Art. 16);
  • erase it, where the law allows (Art. 17);
  • restrict its processing (Art. 18);
  • receive it in a structured, machine-readable format to pass it to another controller (Art. 20);
  • object to processing based on legitimate interest (Art. 21);
  • withdraw any consent given, without affecting processing already carried out (Art. 7.3).

Write to info@apuliancatering.it: we will reply within 30 days, extendable by a further 60 days for particularly complex requests, with an explanation.

7. Complaints

If you believe that the processing of your data breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, https://www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.

8. Cookies

The site uses technical cookies and, only with your consent, Google Analytics statistics cookies, described in the Cookie Policy. You can review your cookie preferences at any time from the site's cookie preferences panel.

9. Changes to this notice

We may update this notice, for example when we add a service to the site. The version in force is always the one published on this page, with the date of the last update.

Last updated: 4 November 2026