Last updated: 10 October 2026. This is a translation for convenience: in case of discrepancies, the Italian version prevails.
This notice explains how we process the personal data of people who visit greenpepperiseo.it, send us a booking request or contact us, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 ("Privacy Code").
1. Data controller
Lemon s.a.s. di Christian Prandelli e C.
Lungo Lago Marconi 14, 25049 Iseo (BS), Italy
VAT no. 02635980986 · REA BS-465870
Email: greenpepperiseo@gmail.com · Phone: +39 335 676 1088
We have not appointed a Data Protection Officer (DPO), as this is not required for our business.
2. What data we process, why and for how long
a) Booking requests
- Data: full name, email, phone number, date and time, number of guests, indoor/outdoor preference, any notes.
- Purpose: handling your request, confirming or changing the booking and contacting you about it.
- Legal basis: steps taken at your request prior to entering into a contract, and performance of the contract (Art. 6(1)(b) GDPR). This is why we do not ask for your consent.
- Retention: up to 30 days after the booking date; the data is then deleted.
b) Private party and event requests
- Data: full name, email, phone number, approximate date and number of guests, your message.
- Purpose: replying to your request and sending you a proposal for your event.
- Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR); if the event goes ahead, compliance with legal obligations such as tax rules (Art. 6(1)(c) GDPR).
- Retention: 12 months from the last contact if the event is not confirmed; if the event takes place, data contained in accounting and tax records is kept for 10 years (Art. 2220 of the Italian Civil Code).
c) Direct contacts (email, phone, messages)
- Data: whatever you choose to share with us.
- Purpose and legal basis: replying to you (Art. 6(1)(b) GDPR, or our legitimate interest in replying, Art. 6(1)(f)).
- Retention: as long as needed to handle your request, and no longer than 12 months.
d) Website security and abuse prevention
- Data: your IP address turned into an irreversible cryptographic fingerprint, used to limit repeated form submissions; technical browsing data recorded in server logs (IP address, date and time, requested page, browser).
- Purpose: protecting the website and its forms from spam, abuse and cyber attacks.
- Legal basis: our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR).
- Retention: the IP fingerprint for at most 24 hours; server logs for the period set by our hosting provider, unless needed to investigate offences.
Health data
Please do not enter health information, such as allergies or intolerances, in our forms: tell our staff directly. Allergens are listed in the menu. If you enter such information anyway, we will only use it to handle your request and delete it within the periods above.
3. Do you have to provide your data?
Fields marked as required are needed to handle your request: without them we cannot receive it through the form. You can always book by phone on +39 335 676 1088.
4. How we process data
Data is processed electronically by authorised Green Pepper staff, with appropriate security measures (encrypted HTTPS connection, restricted access). We do not carry out profiling or automated decision-making. We do not sell or share your data and do not use it to send you advertising.
5. Who we share data with
- Keliweb S.r.l. (Italy), which provides website hosting and the server that sends the form emails, acting as data processor (Art. 28 GDPR).
- Google (Google Ireland Ltd / Google LLC), provider of the greenpepperiseo@gmail.com mailbox we use to receive and manage requests.
- Public authorities, only where required by law.
6. Transfers outside the European Union
Google may also process data in the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, which the European Commission found adequate in its decision of 10 July 2023; Standard Contractual Clauses approved by the Commission apply to cases not covered.
7. Third-party content
- Google map: it only loads if you click "Show the map". Google then receives technical data (such as your IP address) and may use cookies, as an independent controller. The legal basis is your consent, given by clicking (Art. 6(1)(a) GDPR and Art. 122 of the Privacy Code). See the cookie policy for details.
- Instagram: the website only contains a link to our profile; no Instagram content is loaded. If you click the link, Meta's privacy policy applies.
- Fonts: typefaces are hosted on our own server; no external services are contacted.
- Spotify: the website only contains a link to our playlist; no Spotify content is loaded. If you click the link, Spotify's privacy policy applies.
8. Your rights
You may ask us at any time for access to your data, rectification, erasure, restriction of processing and data portability, and you may object to processing based on legitimate interest (Arts. 15-22 GDPR). Where you have given consent, you may withdraw it at any time without affecting processing carried out before. Write to greenpepperiseo@gmail.com: we will reply within one month.
You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it), or with the supervisory authority of your country of residence.
9. Changes
We may update this notice. The date of the latest update is shown at the top. Our cookie policy is available on this page.