1. Data controller

The data controller is Chef in Tuscany di Graziella Malgeri. For privacy-related requests, data access requests, review removal requests or clarifications regarding this notice, the contact channel used for the website is info@chefintuscany.com.

2. Categories of personal data

When a visitor browses the website, the hosting environment and website security measures may process technical data such as IP address, request metadata, session identifiers and basic server logs. When a visitor uses the contact form, Chef in Tuscany may process the name, email address, phone number, requested experience type, preferred date, guest count and message text provided by the visitor. When a visitor uses the review form, Chef in Tuscany may process the name, the star rating, the review text, the date and time of submission, the consent record connected to the form and limited anti-abuse or security data strictly connected to the submission.

3. Purposes of the processing

Personal data is processed to answer contact requests, organize follow-up communication, evaluate service availability, receive and manage guest reviews, publish selected review content on the website, protect the website against spam, automated abuse or attacks, maintain the technical security of the site and comply with legal obligations or the protection of rights.

4. Legal basis

For contact requests, the main legal basis is the implementation of pre-contractual measures requested by the user and the handling of direct correspondence initiated by the visitor. For review submissions and for the publication of the review together with the name voluntarily entered in the review form, the legal basis is the consent given by the user through the dedicated review form. Technical and security logging, anti-spam controls and defensive measures are based on the legitimate interest in preventing abuse, protecting the website and ensuring service continuity. Additional retention or disclosure may also take place where required by applicable law.

5. Recipients of the data

Data may be processed by the hosting provider, technical maintenance providers, database or infrastructure suppliers and email delivery infrastructure used to send website inquiries to Chef in Tuscany. These parties process data only to the extent necessary to provide technical or communication services connected to the site.

6. Retention period

Contact requests are kept for the time reasonably necessary to manage the correspondence and any follow-up related to the requested experience, and in any case no longer than 24 months unless longer retention is required by law or necessary to establish, exercise or defend legal claims. Review submissions are kept for the time reasonably necessary to manage publication, moderation, correction or removal requests and, if published, for as long as the review remains relevant to the website unless deletion is requested or longer retention is necessary for legal protection. Consent records and security-related logs may be kept for limited periods reasonably necessary to demonstrate compliance, prevent abuse or investigate incidents.

7. International transfers

The website is intended to minimize unnecessary transfers. If a technical supplier involved in hosting or email delivery processes data outside the European Economic Area, the transfer must take place only under a valid legal mechanism provided by the GDPR.

8. Rights of the data subject

Visitors may request access to their personal data, rectification, erasure, restriction of processing, objection where applicable and data portability within the limits provided by law. Where the processing is based on consent, visitors may withdraw consent at any time without affecting the lawfulness of the processing carried out before the withdrawal. Visitors also have the right to lodge a complaint with the Italian data protection authority if they believe the processing does not comply with applicable rules.

9. Whether providing data is mandatory

Providing data through the website forms is voluntary. However, the fields identified as necessary in the contact form or review form are required in order to process the request or receive the review. Without the required information, Chef in Tuscany may be unable to provide the requested service through the website.

10. Publication of reviews

If a user submits a review through the website, the name, star rating and review text may be published on the website. Users are asked not to include unnecessary personal data, sensitive information or personal data relating to third parties inside the review text. Requests to update or remove a review may be sent to info@chefintuscany.com.

11. How to exercise your rights

Requests relating to privacy, personal data, corrections or deletion may be sent to info@chefintuscany.com.