Privacy Policy

Information on the processing of personal data
(art. 13 EU Regulation 2016/679 – “GDPR”)

1. Data controller

The Data Controller is Arte and Cuisine, with registered office at
Via Gavi 36, 15069 Serravalle Scrivia (AL), Italy.

Contacts:

For any questions or requests regarding privacy, you can write to us at these addresses.

2. Types of data processed

While browsing the website www.arteandcuisine.com we may process:

a) Browsing data
Technical data automatically transmitted when using the Internet, for example:

  • IP address
  • date and time of the visit
  • pages visited
  • type of browser and device used

This data is processed in aggregate form for technical and site security purposes.

b) Data provided voluntarily via the contact form
When you complete the “Contact Us / Request Your Custom Event” form, we may collect:

  • name and surname
  • e-mail address
  • telephone number
  • any information you include in the message (e.g. location of the event, date, special needs, number of guests, etc.).

c) Cookies and similar tools
The site uses technical cookies necessary for the functionality of the pages and for security (for example, through the cache and security plugins).
Any analytics or profiling cookies will be used only with your consent via a specific banner, if and when they are activated.

3. Purposes and legal bases of the processing

Your data is processed for the following purposes:

  1. Respond to requests for information and quotes
    • Data processed: data entered in the contact form and in emails.
    • Legal basis: execution of pre-contractual and contractual measures at your request (Article 6.1.b GDPR).
  2. Event organization and related formalities
    (only if the event/service is confirmed)
    • Data processed: identification and contact data required for event management, invoicing, and accounting.
    • Legal basis: fulfillment of legal (accounting, tax, etc.) and contractual obligations (Article 6.1.b and 6.1.c GDPR).
  3. Site security and abuse prevention
    • Data processed: browsing data, technical logs, information collected through security systems (e.g., firewall/antivirus plugins).
    • Legal basis: legitimate interest of the data controller in the security of its infrastructure (Article 6.1.f GDPR).
  4. Protection of rights in or out of court
    • Legal basis: legitimate interest of the data controller (Article 6.1.f GDPR).

Any promotional communications via email (e.g., newsletters) will only be sent with your explicit consent, if this service is activated in the future.

4. Modalità del trattamento

Processing is primarily done electronically, with appropriate security procedures and measures in place to protect data from unauthorized access, loss, or misuse.

The data is processed only by persons authorized and trained by the Data Controller or by external parties acting as data controllers (e.g., IT service providers, hosting providers, consultants).

5. Storage times

The data is stored for different periods depending on the purposes:

  • Contact requests and quotes: generally up to 12 months from the last communication, unless further retention is required for relationship management or legal protection.
  • Administrative/accounting data: up to the terms established by tax and civil law (generally 10 years).
  • Browsing data and technical logs: for the time strictly necessary to ensure the functioning and security of the site.

Once the retention periods have expired, the data will be deleted or made irreversibly anonymous.

6. Data recipients

Your personal data may be disclosed to:

  • IT service providers and website hosting providers;
  • entities that provide site security services (e.g. firewalls, anti-viruses);
  • accounting/tax consultants, only to the extent necessary to comply with the law;
  • competent authorities, where required by law or upon request.

These entities process the data as data controllers or independent data controllers, as applicable.

7. Transfer of data to non-EU countries

Some service providers (e.g., security tools, CDNs, or email services) may have servers located outside the European Union.
In such cases, data transfers are carried out in compliance with the GDPR, based on:

  • adequacy decisions of the European Commission, and/or
  • standard contractual clauses approved by the European Commission, or other appropriate guarantees.

8. Rights of the interested party

At any time you can exercise the following rights (articles 15–22 GDPR):

  • right to access your personal data;
  • right to rectification and updating;
  • right to erasure (“right to be forgotten”), in the cases provided for;
  • right to restriction of processing;
  • right to data portability (where applicable);
  • right to object to processing based on legitimate interest;
  • right to withdraw consent, if the processing is based on consent, without affecting the lawfulness of the processing carried out before the withdrawal.

To exercise your rights, you can contact the Data Controller at the contact details indicated in point 1.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) if you believe that the processing violates data protection legislation.

9. Updates to this policy

This policy may be subject to change to reflect regulatory changes or new services offered by the site.
The updated version is always available on this page, with the date of last update indicated.

Last updated: September 17, 2026;