Bloom Apulian Restaurant — Ostuni
iten
Back to home
Legal information

Privacy Policy

Last updated: 14 October 2026

This notice explains how the personal data of users visiting this website are processed, pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code) as amended by Legislative Decree 101/2018. It applies to this website only and not to other websites reachable through links. In case of discrepancies, the Italian version prevails.

1. Data controller

The data controller is: Bloom Apulian Restaurant – Corso Vittorio Emanuele 25/27, 72017 Ostuni (BR), Italy – VAT no. 02406190740 – Phone: +39 329 307 3461.

The controller has not appointed a Data Protection Officer (DPO), as it is not required to do so under Article 37 GDPR.

2. Data processed

Browsing data. The systems and software that run this website collect, during normal operation, some data whose transmission is implicit in the use of Internet protocols: for example IP address, browser type and operating system, date and time of the request, pages visited and server response code. These data are used only to ensure the website works correctly and securely and are not used to identify users.

Data provided voluntarily. When users contact us by phone or WhatsApp (for example to ask for information or book a table), we process the data they share: name, phone number, date and number of guests for the booking and any other information included in the message. Please do not share special categories of data (e.g. health data) unless strictly necessary, such as food allergies or intolerances to be reported for the booking.

This website has no contact forms, requires no registration and does not use profiling cookies or analytics tools.

3. Purposes and legal basis

  • Allowing browsing and ensuring website security – legal basis: legitimate interest of the controller (Art. 6.1.f GDPR).
  • Answering requests for information and handling bookings received by phone or WhatsApp – legal basis: pre-contractual and contractual measures requested by the data subject (Art. 6.1.b GDPR).
  • Handling allergies or intolerances reported by the data subject – legal basis: explicit consent of the data subject (Art. 9.2.a GDPR), given by the communication itself.
  • Complying with legal obligations, such as tax and accounting – legal basis: legal obligation (Art. 6.1.c GDPR).
  • Displaying the Google Maps map, only after the user's consent – legal basis: consent (Art. 6.1.a GDPR).

4. Processing methods and retention

Data are processed with electronic and manual tools, with appropriate security measures to prevent loss, unlawful use or unauthorised access.

Browsing data are kept by the hosting provider for the time strictly necessary for technical and security purposes. Data relating to requests and bookings are kept for the time needed to handle the request and in any case no longer than 12 months, unless the law requires longer retention (for example 10 years for tax records).

5. Recipients

Data may be processed by parties providing services to the controller, appointed where necessary as data processors under Article 28 GDPR, including the website hosting provider and tax and accounting consultants. Data are not disclosed or sold to third parties for marketing purposes.

Some services reachable from the website are run by third parties acting as independent controllers, under their own privacy notices:

6. Transfers outside the EU

Some providers (e.g. Google and Meta) may transfer data to countries outside the European Economic Area, in particular the United States. In such cases transfers rely on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or on Standard Contractual Clauses (Art. 46 GDPR).

7. Your rights

At any time you may exercise the rights under Articles 15–22 GDPR:

  • access to your personal data;
  • rectification of inaccurate or incomplete data;
  • erasure (right to be forgotten);
  • restriction of processing;
  • data portability;
  • objection to processing based on legitimate interest;
  • withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

8. How to exercise your rights and complaints

Requests can be sent to the controller by calling +39 329 307 3461 or by post to Corso Vittorio Emanuele 25/27, 72017 Ostuni (BR), Italy. We will reply within 30 days.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), Piazza Venezia 11, 00187 Rome, Italy.

9. Provision of data

Providing data for requests and bookings is optional, but without it we cannot handle the request. Browsing data are necessary for the website to work.

10. Minors

This website is not aimed at children under 14 and the controller does not knowingly collect their personal data.

11. Changes to this notice

The controller may update this notice at any time, including to reflect changes in the law. Please check this page periodically; the date of the latest update is shown at the top.