Last updated: 16.10.2026
This policy explains how we process the personal data of people who visit this website, book a table or write to us, under Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003.
1. Data controller
ITAL BANGLA FIRENZE SNC di Khondkar Aziz Ahmed e Mahmud Md Shohel
Registered office: Via Guelfa 70/R, 50129 Firenze (FI)
VAT and tax code: 07577150480 · REA: FI-713227
Email: ristorantelabohemefirenze@gmail.com · PEC (certified email): ital.bangla.snc@legalmail.it
2. What data we process and why
a) Reservations
Name, phone number, email (optional), date, time, number of guests and any requests. We use them to manage your booking and to confirm it by email, phone or WhatsApp. Legal basis: steps taken at your request before providing the service (Art. 6(1)(b) GDPR).
If you tell us about allergies or intolerances, we use this only to serve you safely, based on your explicit consent (Art. 9(2)(a) GDPR), which you give by sending it.
b) Guest list
To recognise returning guests we keep name, phone, email, booking dates and service notes. Legal basis: our legitimate interest in running the service well (Art. 6(1)(f) GDPR).
c) Offers and news by email
Only if you tick the box in the booking form. Legal basis: consent (Art. 6(1)(a) GDPR). Consent is optional and is not required to book. You can withdraw it at any time using the unsubscribe link in every email or by writing to us; withdrawal does not affect emails already sent.
d) Contact form
Name, email, phone (optional) and message, so we can reply. Legal basis: Art. 6(1)(b) GDPR when your message is about a booking or service; for general enquiries, our legitimate interest in replying (Art. 6(1)(f) GDPR).
e) Website statistics (Google Analytics 4)
Only if you accept analytics cookies in the banner. We collect aggregated data on how the site is used (pages visited, device, country) and never use it for advertising. Legal basis: consent (Art. 6(1)(a) GDPR). Details in the Cookie Policy.
f) Consent log
We keep your cookie choice (accept/reject), the date and a pseudonymised code, so we can prove consent. Legal basis: legal obligation (Arts. 6(1)(c) and 7(1) GDPR).
g) Technical data
The server records IP addresses and browsing data in technical logs, for security and to keep the site running. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
3. How long we keep data
- Reservations: deleted automatically 12 months after the booking date.
- Guest list without consent to offers: deleted 12 months after the last booking.
- Consent to offers: until you withdraw it, and in any case deleted after 24 months without bookings.
- Contact form messages: up to 12 months.
- Google Analytics data: 2 months.
- Consent log: 2 years.
- Server logs: for the technical period set by the hosting provider.
Where the law requires it, or to defend a legal claim, some data may be kept longer, only for that purpose.
4. Who can see the data
Only our authorised staff and the providers who help us deliver the service, appointed as data processors: the website hosting provider; Brevo (Sendinblue SAS, France) for sending emails; Google Ireland Limited for Google Analytics and our mailbox; WhatsApp Ireland Limited when we contact you on WhatsApp. For their own services, Google and WhatsApp may also act as independent controllers. We never sell or pass on your data to third parties for marketing.
5. Transfers outside the EU
Google and WhatsApp may also process data in the United States. In these cases the transfer is based on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or on standard contractual clauses. You can ask us for more information about these safeguards using the contact details in section 1.
6. Do you have to give us your data?
Name and phone are needed to book: without them we cannot confirm your table. Everything else is optional.
7. Your rights
At any time you can ask for access to your data, correction, deletion, restriction or portability, object to processing and withdraw any consent you gave (Arts. 15–22 GDPR), without affecting processing already carried out. Write to ristorantelabohemefirenze@gmail.com or to the PEC ital.bangla.snc@legalmail.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
8. Children
This website is not aimed at children under 14 and we do not knowingly collect their data.
9. Changes
We may update this policy. The date of the last update is shown at the top.