Home delivery
In-store pickup
Order ahead and skip the line!
Limoncello Taormina
0 Order now
0
Order now
Follow us
Privacy

Privacy Policy

Information about the processing of personal data.

Last updated 25 September 2026
Version 2.0
Effective from 24 September 2026

PRIVACY POLICY

Notice provided pursuant to Regulation (EU) 2016/679 ("GDPR") and the applicable national legislation on the protection of personal data.

1. DATA CONTROLLER

The Controller of the personal data collected through the website and used for the commercial management of users, orders and services is:

Original Food Srl
Registered office: Via Pirandello 2, 98039 Taormina (ME)
VAT number: 03870230830
Tax code and Company Register number: 03870230830
REA: ME - 266092
PEC: original-food@pec.it
Email: originalfood2026@gmail.com

2. TECHNICAL PLATFORM PROVIDER

For development, hosting or technical management, maintenance, security, support, backup and continuity of the platform, the Controller may engage:

Benedetto Asta Web Company
VAT number: IT02951290812
Via Balduino 15/a, 91011 Alcamo (TP)
PEC: benedettoasta2020@pec.it

Benedetto Asta Web Company operates, for the processing carried out on behalf of the Controller and where the relevant conditions are met, as a Data Processor pursuant to Art. 28 GDPR on the basis of the relevant agreements.

3. CATEGORIES OF DATA PROCESSED

The platform may process:

  • first and last name;
  • email address;
  • telephone number;
  • account credentials and data;
  • address and information necessary for delivery;
  • coordinates or location voluntarily used to identify the delivery place;
  • data relating to orders and purchased products;
  • delivery or pickup method;
  • coupons, promotions and information associated with the order;
  • notes and information voluntarily entered by the user;
  • information relating to payment status, without the site needing to store the payment instrument data in full;
  • technical identifiers relating to the transaction and its outcome;
  • IP address;
  • user agent and technical device information;
  • date, time and logs of relevant operations;
  • information necessary for security, abuse prevention and access management;
  • cookies and other identifiers as indicated in the Cookie Policy.

The platform does not require, as a general rule, special categories of personal data pursuant to Art. 9 GDPR. The user is invited not to enter excessive or unnecessary information in the free-text notes. If information relating, for example, to allergies, intolerances or dietary needs connected to health is voluntarily provided, such data will be processed exclusively to the extent necessary to manage the specific request and in accordance with applicable legislation.

4. PAYMENT-RELATED DATA

For orders paid online, the platform processes the information strictly necessary to initiate, verify and record the outcome of the transaction, such as transaction identifiers, amount, payment status and related technical information.

The complete data of the payment instrument may be processed directly by the parties authorised to manage the relevant transaction according to their respective methods and security measures.

The platform may receive from the payment service providers technical information on the outcome of the transaction necessary to confirm, reconcile, cancel or refund the order.

5. PURPOSES AND LEGAL BASES

a) Registration and account management

Purpose: creation of the account, authentication, profile management and access to order history.
Legal basis: performance of the contract or pre-contractual measures.

b) Order management

Purpose: receipt, preparation, management, delivery or pickup of orders.
Legal basis: performance of the contract and pre-contractual measures requested by the data subject.

c) Payment management

Purpose: initiation and verification of payment operations, reconciliation of orders, management of cancellations and refunds.
Legal basis: performance of the contract and fulfilment of any related legal obligations.

d) Home delivery and localisation

Purpose: identification of the delivery place, verification of the area served, calculation of the conditions applicable to delivery and correct performance of the service.
Legal basis: performance of the contract or pre-contractual measures requested by the data subject.

The precise device location is used only when the user voluntarily chooses to use the relevant feature and within the limits necessary for managing the delivery.

e) Communications and support

Purpose: responding to requests, communications relating to orders and customer support.
Legal basis: performance of pre-contractual measures, of the contract or legitimate interest in managing the requests received.

If the user chooses to use messaging services or other external applications to communicate about the order, the interaction with such services takes place on the user's initiative and may involve the processing of data by the relevant provider according to its own conditions.

f) Administrative, tax and legal obligations

Purpose: accounting, tax, administrative obligations and obligations provided for by applicable legislation.
Legal basis: fulfilment of legal obligations.

g) Security and abuse prevention

Purpose: logging, access control, prevention of fraudulent orders, blocking of accounts or IP addresses used for abuse, protection of the infrastructure, automated verification against bots and unlawful use and protection of the Controller's rights.
Legal basis: legitimate interest in the security of systems, in fraud prevention and in the protection of its rights.

h) Technical management of the platform

Purpose: maintenance, backup, debugging, technical monitoring, updates, operational continuity and error management.
Legal basis: legitimate interest in the correct operation and security of the service.

i) Optional tracking tools

Any tools that are not strictly necessary will be used in accordance with applicable legislation and, where necessary, on the basis of the user's consent. For more information, please refer to the Cookie Policy.

6. NATURE OF PROVISION

The provision of data necessary for registration, ordering, payment and delivery is optional, but failure to provide the indispensable data prevents the provision of the relevant service.

The use of the precise device location is optional and constitutes an additional method to facilitate the identification of the delivery place. The user may, where provided by the platform, enter the data necessary for delivery manually.

The provision of data relating to tracking tools that are not necessary is optional.

7. METHODS OF PROCESSING

Data is processed using electronic tools and, where necessary, with organisational methods suitable for ensuring its security, integrity and confidentiality.

Technical and organisational measures are adopted to reduce the risk of loss, unauthorised access, modification, disclosure or unlawful use of the data.

Access to the data is limited to authorised parties and to providers that need it for the performance of their respective tasks or services.

8. RECIPIENTS OF THE DATA

Data may be communicated, within the limits of their respective functions, to:

  • personnel and collaborators authorised by Original Food Srl;
  • platform provider and technical manager;
  • hosting and IT infrastructure providers;
  • providers of services necessary for payment management;
  • providers of services for maps, geolocation and address verification;
  • providers of services for security, prevention of spam, bots and abuse;
  • providers of communication and email services;
  • any providers of messaging services used on the user's initiative;
  • professionals and administrative, tax or legal consultants;
  • public authorities when required by law;
  • further data processors formally appointed where necessary.

The recipients may operate, depending on the case, as Data Processors, autonomous Controllers or authorised parties according to the applicable legislation and the nature of the service provided.

9. TRANSFERS TO THIRD COUNTRIES

If certain providers involve the processing of data outside the European Economic Area, the transfer will be carried out in the presence of the conditions and guarantees provided by Arts. 44 et seq. of the GDPR.

Where applicable, legal instruments such as adequacy decisions, standard contractual clauses or other guarantees recognised by current legislation may be used.

10. RETENTION

Data is retained for the period necessary to pursue the purposes for which it was collected and for the further periods required by law or necessary for the protection of the Controller's rights.

In particular:

  • account data is retained for the duration of the relationship and subsequently for the periods necessary for the applicable obligations and protection needs;
  • order-related data is retained for the management of the service and for any periods imposed by administrative, tax or accounting obligations;
  • payment and refund data is retained within the limits necessary for the management of the transaction and applicable obligations;
  • delivery and location data is retained within the limits necessary for the management of the order and, where it flows into the order history, according to the relevant retention periods;
  • technical and security logs are retained for the period proportionate to the needs of security, abuse prevention and technical traceability;
  • consent-based data is processed until consent is withdrawn, without prejudice to any further legitimately permitted retention.

When it is not possible to indicate a precise term in advance, the duration is determined by applying criteria such as the purposes of the processing, legal obligations, security needs and protection of rights.

11. DATA SUBJECT RIGHTS

The data subject may exercise, where applicable, the rights provided by Arts. 15-22 GDPR, including:

  • access to personal data;
  • rectification;
  • erasure;
  • restriction of processing;
  • objection;
  • data portability;
  • withdrawal of consent, without affecting the lawfulness of the processing carried out before withdrawal;
  • complaint to the Italian Data Protection Authority (Garante per la protezione dei dati personali).

12. EXERCISE OF RIGHTS

Requests relating to personal data must be addressed to the Controller:

Original Food Srl
PEC: original-food@pec.it
Email: originalfood2026@gmail.com

The Controller may request the information reasonably necessary to verify the identity of the requester before following up on the request, within the limits provided by legislation.

For exclusively technical issues relating to the operation of the platform, Original Food Srl may rely on its technical provider.

13. AUTOMATED PROCESSES

The platform may use automations necessary for operational management and security, such as availability verification, calculation of the total, verification of the delivery zone, checking of the payment status, abuse prevention or other technical checks.

Unless a future specific notice is provided, no decisions are adopted entirely automatically within the meaning of Art. 22 GDPR that produce legal or similarly significant effects on the data subject.

14. COOKIES AND SIMILAR TECHNOLOGIES

For detailed information on the use of cookies, technical tools, tracking tools and management of the relevant preferences, please refer to the Cookie Policy published on the site.

15. UPDATES

This notice may be amended as a result of regulatory, organisational, technical changes or changes in the services used by the platform.

The updated version with its effective date is made available on the site.

Updated version: 25 September 2026.