Privacy policy

Data controller

Murat snc, Via San Francesco d'Assisi, 68, 66054 Vasto (CH) – P.IVA 02812370696. For any question about your data: phone +39 338 41 00 995.

What we collect, why and on what legal basis

• Table bookings: name, phone number, date, time, number of guests, any event you chose and your notes (for example allergies or a high chair). We need them to handle your request. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). If you mention an allergy or intolerance in your notes, we only use it to serve you safely, based on the explicit consent you give by writing it (Art. 9(2)(a)).
• Takeaway orders: name, phone, dishes, pick-up time, notes and any coupon. Needed to prepare your order for collection at the restaurant (Art. 6(1)(b)). Home deliveries go through Glovo: if you order there, Glovo processes your data under its own privacy policy.
• Promotion coupons: name and phone, to give you a personal code and make sure each number gets only one (Art. 6(1)(b)).
• Group and private event requests: name, phone, date, number of guests, type of event, indicative budget and notes, to prepare a proposal (Art. 6(1)(b)).
• Gift cards: amount, balance, expiry date and, if provided by the buyer in the restaurant, the recipient’s name, the giver’s name and a message. Needed to issue the card and manage its balance (Art. 6(1)(b)).
• Customer record: requests coming from the same phone number are kept together in one record, with their history and short notes from our staff. If a booking is missed without notice, the number may be flagged as “No-show”: next time, the website will ask you to call us instead of opening WhatsApp. Legal basis: our legitimate interest in organising service and limiting missed bookings (Art. 6(1)(f)). There is no automated decision-making: the flag is set by a member of staff and you can ask us to review it.
• Promotional messages: only if you tick the box will we use your number to send you Murat events and offers on WhatsApp. Legal basis: consent (Art. 6(1)(a)), optional and revocable at any time by writing “STOP” or asking our staff; withdrawal does not affect messages already sent.
• Website security: to block automated submissions and abuse, we store with each request an encrypted, non-reversible fingerprint of your IP address; the website’s security system also logs the IP addresses of suspicious attempts. Legal basis: legitimate interest in security (Art. 6(1)(f)).
• Statistics: we count page views and clicks on “Book”, “WhatsApp” and “Call” in aggregate form, without cookies, without storing IP addresses and without being able to identify you. Google Analytics and Google Ads are only enabled if you consent in the cookie banner: see the cookie policy.

The details requested in our forms are necessary to answer your request; without them we cannot handle it. Consent to promotions is always optional.

WhatsApp

When you send a booking, order or request, the website opens WhatsApp with the message ready: you are the one who sends it. From then on the conversation also goes through WhatsApp, a service of WhatsApp Ireland Limited (Meta group), which processes data under its own privacy policy and may transfer it to the United States under the EU-U.S. Data Privacy Framework. If you prefer not to use WhatsApp, you can always call us on +39 338 41 00 995.

Who can see your data

• The controller and authorised restaurant staff, through a private password-protected panel.
• Providers who help us run the website, appointed as data processors: the hosting provider for the website and database, the email service used to notify us of new requests, and whoever handles the website’s technical maintenance.
• Google Ireland Limited, only if you consent to statistics or marketing (Google Analytics, Google Ads) or choose to load the map.

We do not sell or pass on your data to third parties for their own purposes. Transfers outside the European Union (Meta, Google) rely on the EU-U.S. Data Privacy Framework or on the European Commission’s standard contractual clauses.

How long we keep it

• Bookings, group requests, takeaway orders and coupons: 24 months from the date of service or request, then they are deleted automatically.
• Gift cards: up to 24 months after expiry, after the balance is used up or after cancellation.
• Customer record (including notes and any “No-show” flag): deleted when no linked requests, orders or coupons remain, unless you have consented to promotions.
• Consent to promotions: until you withdraw it.
• Data the law requires us to keep longer (for example tax documents): for the period required by law.

Your rights

You can ask us at any time to access, correct or delete your data, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest, including the “No-show” flag. You can withdraw your consent to promotions whenever you like. To exercise your rights, contact us on +39 338 41 00 995: we reply within one month.

If you believe your data is processed in breach of the GDPR, you can lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority of the country where you live.

Children

This website is not intended for children under 14, who should not send us requests without a parent.

Changes

We may update this policy if the website’s services change: the date of the last update is shown below.

Last updated: 22 October 2026