Privacy Notice Regarding the Processing of Personal Data
This page explains what information we collect when you visit our website, reserve a table, purchase a gift certificate, or submit a job application. It explains why we collect this information, how long we keep it, and what you can ask us at any time.
We've written it so that it's easy to understand. If anything isn't clear to you, please write to us: we'll be happy to answer your questions.
Who processes your data
The data controller is L.G.C. S.r.l., with its registered office at Via San Martino 17, 53037 San Gimignano (SI), VAT number 01451610529.
L.G.C. S.r.l. operates the LINFA and Cum Quibus restaurants, as well as this website.
To exercise your rights, or for any questions regarding your data, please write to amministrazione@lgcsrl.it. We will respond within thirty days.
What we collect, why, and on what basis
Reservations
When you reserve a table, we collect your name, phone number, email address, the date and time you selected, the number of people, and any notes you provide, such as allergies or food intolerances.
Reservations are processed through TheFork, which operates as an independent entity for its own platform. We receive your reservation details so that we can accommodate you.
Reason: To provide the service you have requested—namely, to reserve a table for you, notify you if necessary, and make arrangements if you have indicated a specific need. Legal basis: The performance of pre-contractual and contractual measures, Article 6(1)(b) of European Regulation 2016/679.
If you mention an allergy or intolerance in the notes, that information pertains to your health. We process it only because you voluntarily provide it to us so that we can accommodate you safely; we do not use it for any other purpose, and we do not retain it beyond the duration of the service.
Gift Cards Plus Purchases
When you purchase a gift card, we process your name, email address, the information needed to issue and send the gift card, and the order details.
The sale and payment are processed through the Bonkdo platform, which processes the data on our behalf as a data processor. Alternatively, payment can be made via Stripe. In either case, your card information is received directly by the payment service provider: we never see it, and we do not store it.
We do not ship physical items: the vouchers are digital.
Reason: to issue the voucher, process the order, and comply with tax and accounting obligations. Legal basis: performance of the contract, Article 6(1)(b), and compliance with legal obligations, Article 6(1)(c).
Job Applications
On the “Careers” page, we collect your first name, last name, contact information, and any information you choose to include in your message and in the other fields of the form.
We ask that you not include any information that is not necessary for evaluating your application: we do not need information about your health, your opinions, or your private life.
Why: To evaluate your application and to contact you if your profile matches an open position. Legal basis: The performance of precontractual measures at your request, Article 6, paragraph 1, subparagraph b).
Contact Requests
If you contact us for information, we will process the data you provide for as long as necessary to respond to you.
Legal basis: our legitimate interest in responding to those who contact us, Article 6, paragraph 1, subparagraph (f).
Site Navigation
During your visit, we collect technical data through cookies: which pages you view, where you came from, and whether our ads brought you here.
For essential cookies, the legal basis is Article 122 of the Privacy Code, which does not require consent. For statistical and marketing cookies, the legal basis is your consent, which we request via the banner on your first visit and which you may revoke at any time.
Full details, cookie by cookie, can be found in our Cookie Policy.
Who We Share Your Data With
Your data is processed by our authorized staff. Outside our organization, it may be processed by vendors who support our operations:
TheFork, for the collection and management of reservations, acting as the independent data controller for its own platform
Bonkdo, for sales and the processing of gift card payments, in its capacity as data controller
Stripe Payments Europe Limited, Dublin, Ireland, as an alternative payment method
Squarespace Ireland Limited, Dublin, Ireland, which hosts this site
Google Ireland Limited, Dublin, Ireland, for statistics and campaign tracking
Meta Platforms Ireland Limited, Dublin, Ireland, for measuring campaigns on Facebook and Instagram
Weglot SAS, Paris, France, for the translation of the pages
Cybot A/S, Copenhagen, Denmark, for the collection and retention of your consent to cookies
We also disclose data to professionals and authorities when required by law, for example, to our accounting advisor or the tax authority.
We don't sell your data. To anyone, ever.
If the data leaves Europe
Some of the providers listed above are part of groups headquartered in the United States. Specifically, Google Ireland Limited, Meta Platforms Ireland Limited, and Stripe Payments Europe Limited may transfer data to their respective U.S. parent companies.
The transfer is based on the adequacy decision adopted by the European Commission on July 10, 2023, regarding the EU-U.S. Data Privacy Framework, supplemented by the standard contractual clauses referred to in Article 46 of European Regulation 2016/679.
For Google and Meta, the data transfer is used solely for statistical purposes rather than for marketing, so it occurs only if you have given your consent to the relevant cookies.
How Long We Retain Your Data
We keep your data for as long as necessary—not a day longer.
Reservation details: twelve months from the date of service.
Notes on allergies and food intolerances: to be deleted at the end of the service.
Sales records for gift certificates: ten years, as required by the law on accounting records.
Job applications: twelve months from the date of submission, unless you ask us to delete them sooner.
Contact requests: twelve months from the date of response.
Record of cookie consent: twelve months.
Once these time limits have expired, the data is either deleted or irreversibly anonymized.
What We Don't Do
We think it's only fair to also tell you what doesn't happen to your data.
We do not make automated decisions about you. We do not profile you to create a marketing profile. We do not upload your email address or phone number to Facebook, Instagram, or Google to target you with ads. We do not share your data with third parties for their own purposes.
What we measure is whether an ad brought someone to the table—in aggregate form, not on an individual basis.
Your Rights
You can ask us at any time:
to access your data, to find out what information we have
to correct them if they are incorrect or incomplete
to delete them, when we no longer have a reason to keep them
to restrict the processing of your data while we investigate your dispute
to receive them in a readable format, or to have them transferred to another party
to object to processing based on our legitimate interest
to revoke the consent you have given us, without this rendering the data collected previously unlawful
Please write to amministrazione@lgcsrl.it. We’ll respond within thirty days. We won’t charge you anything for this.
If you believe that your personal data is being processed in violation of the law, you have the right to file a complaint with the Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome, garanteprivacy.it. You may also bring the matter before the courts.
If something changes
If we change the way we handle your data, we will update this page and include the new date at the bottom. If the change is significant, we will clearly notify you of it.
Last updated: August 6, 2026
If you have any questions, we're here to help: our doors are always open.