Privacy Policy
Last updated: October 2026
This page tells you, plainly, what happens to your data when you visit the site, book a table or write to us. The short version: we collect little, we protect it well, and we sell it to no one. The rest — who we are, what we collect, for how long, and with what rights — is below, at your own pace. This is, in every respect, our notice under Articles 13 and 14 of Regulation (EU) 2016/679, the GDPR: NOS Ristorante is the restaurant division of Palazzo Scotto S.r.l., and this website is its channel for information and bookings. It also says when we use the data from this site together with the data from the site of Palazzo Scotto, which belongs to the same company.
Who answers for your data
The data controller — the one who decides how and why your data is used (Art. 4(7) GDPR) — is the family company behind NOS and the rooms of Palazzo Scotto:
- Controller
- Palazzo Scotto S.r.l.
- Registered office
- Corso Trieste e Trento 30, 70011 Alberobello (BA), Italy
- The restaurant
- NOS Ristorante, a local unit of the company: Corso Trieste e Trento 32, 70011 Alberobello (BA)
- VAT / Tax code
- 07751560728
- REA
- BA-579682
- Share capital
- EUR 100,000.00 fully paid up
- Certified email (PEC)
- palazzoscotto@pec.it
- Privacy contact
- nosristorante@palazzoscotto.com
We have no Data Protection Officer (DPO): for a business like ours, Article 37 GDPR does not require one. Your point of reference for anything concerning your data is Valerio Scotto, the director — you can reach him at nosristorante@palazzoscotto.com.
Two brands, one company
Palazzo Scotto S.r.l. (VAT no. 07751560728) is a single company with two brands: NOS Ristorante, the restaurant on this site, and Palazzo Scotto, the rooms (www.palazzoscotto.com). The controller is the same for both, with the same VAT number: between the two brands the data does not pass to another company. “F.lli Scotto S.r.l.”, which you may find in older documents, is the former name of the same company. The controller uses the data from the two sites together for two purposes only, described below, and in no other way.
The first purpose: measuring the group
Measuring the group means knowing how many people know the restaurant, the rooms or both. For visits we do this only with your consent to statistics, also with a Google Analytics property shared by the two sites once it is active, which is not linked to any advertising account. Once it is active, if you accept statistics on both sites and move from one to the other through one of our links, Google Analytics will link the two visits with the same random code. Never your name. For these statistics Google will act on our behalf, with data sharing with Google switched off. Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 122 of the Italian Privacy Code). Duration: 14 months. The link will start only with consent given after this update. If you withdraw your consent on either site, through “Cookie preferences”, collection on that site stops at once.
The second purpose: a monthly internal report
It is a report read only by the management, which compares the guests of the rooms and the customers of the restaurant in numbers only: for example, how many room guests dined at NOS. The comparison starts from the room bookings. To count, we compare the bookings of the two businesses within our own systems: for the rooms we use the fingerprints (SHA-256 hashes) of email and phone number, never the data in clear; the restaurant’s contact details are read only in memory, for the time of the calculation, and immediately turned into the same fingerprint. We save no list of people or of matches: the report keeps only the numbers, with no names, contact details or profiles, and the working files are deleted once the calculation is done. We do not use it for advertising. Legal basis: our legitimate interest in organising the service and the hospitality of the two businesses (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR) by writing to nosristorante@palazzoscotto.com or to info@palazzoscotto.com, or by certified email (PEC) to palazzoscotto@pec.it. If you object, we add you to an objection list that contains only fingerprints encrypted with a secret key (HMAC), never your contact details, and we exclude you from the comparison before it starts.
No cross-advertising
We do not use one brand’s advertising identifiers on the other brand’s site: on this site there is no advertising tool of Palazzo Scotto, and on the Palazzo Scotto site none of NOS. We do not show ads for one business using data collected by the other.
What we collect, and why
Only what we need to reply to you and to keep the site running. Here it is, item by item, with the legal basis the GDPR asks us to state (Art. 6(1); for cookies, Art. 5(3) of the ePrivacy Directive):
| Data | Legal basis | What it's for |
|---|---|---|
| First and last name | Pre-contractual measures — Art. 6(1)(b) | Knowing who you are when you ask for a table, an event or information |
| Email address | Pre-contractual measures — Art. 6(1)(b) | Replying to you and keeping you posted on your request |
| Phone number (optional) | Pre-contractual measures — Art. 6(1)(b) | Reaching you quickly if something needs confirming or changing |
| Message, indicative date, occasion | Pre-contractual measures — Art. 6(1)(b) | Understanding your request and getting ready to welcome you |
| IP address, user agent, referrer | Legitimate interest — Art. 6(1)(f) | Keeping the site safe: anti-bot check (Cloudflare Turnstile) on forms, anti-abuse rate limit with a hashed IP, technical service logs |
| Technical and session cookies | Technical necessity — Art. 5(3) Dir. 2002/58/EC | Making the essentials work: language, session, security |
| Analytics and marketing cookies | Consent — Art. 6(1)(a) | Aggregate statistics and campaign measurement — only if activated, and only with your yes |
| Email or phone number of people who book rooms or tables, as fingerprints (SHA-256 hashes) | Legitimate interest — Art. 6(1)(f) | The monthly internal report, in numbers only: how many room guests dined at NOS — never lists, never advertising |
| Email address (newsletter subscription) | Consent — Art. 6(1)(a) | Writing to you with news from NOS — only if you subscribe, and only for as long as you wish |
One exception deserves its own chapter: the optional allergies-and-intolerances field on the private booking page for small groups, which we process solely with your explicit consent (Art. 9(2)(a) GDPR) — more on that just below. Beyond it, this site does not collect special categories of data (Art. 9 GDPR) or data relating to criminal convictions and offences (Art. 10 GDPR). We kindly ask you not to enter sensitive data in the free-text fields of the forms.
When you write to us through a form
When you send a request from the site — for small groups or for NOS Open Air — the data you type (name, email, phone if you leave it, message) takes two paths, both ours. First: it reaches the NOS team by email through Resend, our transactional email provider, so we can reply to you. Second: it is stored encrypted in a Supabase database — AES-256-GCM encryption, unreadable without the key. The legal basis is your request itself (pre-contractual measures, Art. 6(1)(b)) and, for storage, our legitimate interest in following it up (Art. 6(1)(f)). Before sending, we ask you to tick an informed-consent box — never pre-ticked — and form data never turns into marketing without a further yes from you.
Allergies and intolerances: a delicate chapter
The private booking page for small groups — the one we send you after replying to your request — has an optional field for the allergies and intolerances of the group's guests; the public "Small Groups" form does not ask for them. If you fill it in, that information may say something about health: under the GDPR it is "special category" data (Art. 9(1)) and enjoys enhanced protection. We process it solely on the basis of your explicit consent (Art. 9(2)(a)): filling in the field and ticking the dedicated box is the act by which you give it. It serves one purpose only: letting the kitchen prepare a safe menu for your group and following up on your request. Never marketing, never anything else. The allergen categories you select, and any free text, reach the team by email so the kitchen can get organised, and rest encrypted in the database (AES-256-GCM), visible only to those handling your request; we delete them within 30 days of the service date. Providing them is entirely optional: you can leave the field blank and tell us later, by phone or email, without your request suffering for it. And you can withdraw your consent whenever you wish (Art. 7(3) GDPR) by writing to nosristorante@palazzoscotto.com: withdrawal does not affect the lawfulness of what was done before.
The newsletter
At the bottom of the site you can leave us your email to receive news from NOS. It is a processing activity of its own, distinct from the enquiry forms: the legal basis is your consent (Art. 6(1)(a) GDPR), which you give freely by subscribing, and the purpose is one — writing to you. The email is stored encrypted (AES-256-GCM) and is not passed to third parties for their own marketing. You can withdraw your consent at any time (Art. 7(3)), through the unsubscribe link in every message or by writing to nosristorante@palazzoscotto.com: we keep it while you stay subscribed and delete it when you leave. Withdrawal does not affect what was sent before.
When you book a table
Bookings and some site features run through Plateform, the booking platform we rely on, which processes the necessary data under its own privacy notice, as a processor or independent controller. Its widget may appear on a site page inside an iframe and set its own technical cookies — the ones it needs to work. Some pages also offer a booking form built into the site: what you type is sent securely to Plateform to create the reservation, with Cloudflare Turnstile's anti-bot protection keeping automated submissions and abuse at bay.
If you share an invitation
When you create an invitation to share after booking, we save the first names you write, the choices made (occasion, phrase, photo and language) and a reference to the booking, stored in encrypted form. Anyone who has the link sees the card with the first names, the date, the time and the number of guests: please share it only with your guests. The invitation stops working if the booking is cancelled, and we delete it automatically 30 days after the dinner. The legal basis is your request (art. 6(1)(b) GDPR).
When you book through an AI assistant
Some AI assistants (ChatGPT or Claude, for example) can send us a card-guaranteed table request on your behalf. This channel is a trial: it may not be active, and when it is not, the assistant points you to the booking form on our site. This is what happens to your data when it is active.
What we receive
First name, last name, email, phone number, language, date, time and number of guests, and any short notes. We also receive the name of the assistant that sent the request and, for anti-abuse limits only, your IP address in hashed form. We never receive card details.
From whom
From the AI assistant you chose to use, which passes them to us at your request. We do not receive your conversation with the assistant: only the fields of the request.
Why, and on what legal basis
To create the booking request in Plateform and send you the secure link for the card guarantee: these are pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). This basis holds only if you made the request yourself, for yourself. The anti-abuse limits and the hashed IP rely on our legitimate interest in protecting the service (Art. 6(1)(f)).
Consent stated by the assistant
Before sending the request, the assistant must state that you have read this notice, accepted the card guarantee and confirmed your details. This is a statement made by the assistant, not a box you ticked on our site: we record it as such, and we never treat it as consent to marketing.
Who else sees something
The provider of the assistant you chose (for example OpenAI, Anthropic, Perplexity, Google or Microsoft) receives our reply: request code, date, time, number of guests, first name and initial of the last name. From then on it processes that reply as an independent controller under its own privacy notice, possibly outside the European Economic Area. We cannot know in advance which provider you will use: that is your choice. Plateform receives the booking as for any other channel and sends you the card link by WhatsApp or email.
Health data
This channel does not collect information about allergies, intolerances or health: notes containing it are rejected. Please tell us by phone or through the form on our site.
How long we keep it
We keep an encrypted copy of the request to manage it and to apply the anti-abuse limits, as for bookings made on the site: 24 months from your last visit, and the count starts again each time you come back. After that we make the request anonymous: we delete first name, last name, email, phone number, notes and the fingerprint of the phone number, and only statistical data remain (date, time, number of guests, language, assistant used, outcome). Data held on Plateform also follow the provider's own periods.
If you did not make the request
If you receive a message with a card link you did not ask for, someone used your number or your email. You do not need to do anything: without a card the request expires on its own. We accept at most one request a day per phone number and, during the trial, our staff sees every request that comes from an assistant. Write to us and we will delete your data straight away.
Your rights
They are the same as those described below, in the section on rights. For this channel, write to nosristorante@palazzoscotto.com, quoting the request code if you have it.
Who lends us a hand
We do not sell and we do not pass on your data to anyone. It is known to the authorised staff of the company — for the restaurant and, within the limits described in “Two brands, one company”, for the rooms of Palazzo Scotto, which are a brand of the same company and not an external recipient — and to the providers listed below. A few technical providers process data on our behalf, each appointed as a processor where required (Arts. 13(1)(e) and 28 GDPR). The "Status" column tells it as it is: some tools work all the time, others — analytics and marketing — stay idle until you say yes through the banner (for measuring ads on a booking, the optional box in the booking form counts too). Meta is the exception: for the collection of data through its pixel it is a joint controller with us, as its row explains.
| Provider | What it does for us | Location | Transfer safeguard | Status |
|---|---|---|---|---|
| Plateform | The booking engine: receives, handles and confirms bookings | EU | Processing within the EEA | Active |
| Supabase | The database: keeps form data, encrypted | EU | Processing within the EEA | Active |
| Resend | Transactional email: delivers form enquiries to the team | USA | SCC (EU Dec. 2021/914) + EU-US DPF where certified | Active |
| Cloudflare | Network and security (CDN, tunnel), Turnstile anti-bot on forms, and a server-side conversion-measurement Worker (with hashed identifiers) | USA / global network | SCC (EU Dec. 2021/914) | Active for network, security and anti-bot; the conversion Worker runs only when marketing is active and with consent |
| Google LLC | Places API for live hours and reviews; Google Analytics 4 (also for the property shared with Palazzo Scotto, once it is active, always on our behalf); copies of the statistics in BigQuery, in data centres in the European Union; Google Ads and Tag Manager | USA | SCC (EU Dec. 2021/914) + EU-US DPF | Places API active; Analytics and Ads active upon consent |
| Meta Platforms Ireland Ltd / Meta Platforms Inc. | Meta Pixel and Conversions API for campaign measurement. For the collection and transmission of data through the pixel, Meta is a joint controller with us (Art. 26 GDPR; Court of Justice of the EU, Case C-40/17, Fashion ID), under its own joint controller agreement (“Controller Addendum”); for what it does with that data afterwards it is an independent controller, under its own privacy policy. To exercise your rights you can contact us. | Ireland (EU) / USA | SCC (EU Dec. 2021/914) + EU-US DPF | Active upon consent |
| OpenAI (ChatGPT Ads) | Measurement of campaigns on ChatGPT. For each booking that comes from a ChatGPT ad, and only with your consent (banner or the box in the form), our server sends OpenAI the ad click code, a booking identifier in the form of a salted hash and the page of the site: no email, no phone, no name. To exercise your rights you can contact us. | USA | OpenAI Data Processing Addendum (DPA) + SCC (EU Dec. 2021/914) | Active upon consent |
| TripAdvisor LLC | The official Tripadvisor award badges (Travellers' Choice 2026) on the main pages: Tripadvisor's scripts load only with marketing consent; without it you see a static image served from our own site | USA | SCC (EU Dec. 2021/914) + EU-US DPF where participating | Active with marketing consent |
| Mr PRENO / Titanka S.p.A. | The room-request form on the "Beyond the Table" page: stay requests for Palazzo Scotto are received and handled through Mr PRENO (a Titanka product) | EU | Processing within the EEA | Active (only for room requests sent from that form) |
| Bedzzle | Palazzo Scotto's booking engine: the "Book now" box on the "Beyond the Table" page uses its official search widget to show you room prices and availability | EU | Processing within the EEA | Active (it loads only when you use that search form) |
One more word on the "Ask availability" form on the "Beyond the Table" page: it is the one you use to ask for a room at Palazzo Scotto. When you send it, the data you enter (dates, number of guests, your contact details) is collected and processed through Mr PRENO, the booking system provided by Titanka and used by Palazzo Scotto, for the sole purpose of getting back to you about availability. The consent and the specific notice for that form live inside the form itself, under the Mr PRENO / Titanka privacy notice. Right next to it sits the "Book now" box: it uses the official widget of Bedzzle, Palazzo Scotto's booking engine, which does not load until you start using it. The dates and number of guests you enter go to Bedzzle to show you prices and availability; any booking then continues on Bedzzle's systems, under its own notice.
How long we keep it
Nothing stays forever. Every piece of data has its expiry date, as the storage-limitation principle requires (Art. 5(1)(e) GDPR):
| Category | How long we keep it |
|---|---|
| Requests from the site forms (small groups / Open Air) | 24 months from submission, unless a different legal obligation applies |
| Group allergies and intolerances (private booking page) | Deleted within 30 days of the service date |
| Technical and security logs | 12 months, longer only for abuse or security investigations |
| Bookings (from the site, from Plateform and through AI assistants) | 24 months from your last visit, then made anonymous and kept only as statistics |
| Google Analytics statistics (including those of the property shared with Palazzo Scotto, once it is active) | 14 months |
| Copies of the statistics in our archive (BigQuery) | Detailed data: 60 days (at most 90 for the tables of August and September 2026). There is no long-term copy today: if we activate one, it will contain only the data of people who accepted statistics, for 14 months and without a user identifier; for people who did not, we will keep daily counts only. |
| Monthly internal group report | Numbers only; the fingerprints (SHA-256 hashes) of email and phone number are used only for the time of the calculation, no list is saved and the working files are deleted once the calculation is done |
| Booking data handled by Plateform | Data held on Plateform also follow the provider's own retention periods |
| Accounting and tax data | 10 years (Art. 2220 Italian Civil Code; D.P.R. 600/1973 and 633/1972) |
| Your cookie choice | Up to 12 months, then we ask you again |
| Newsletter email | While you stay subscribed; deleted upon unsubscription |
| Marketing | As long as your consent is valid; you can withdraw it at any time |
| Shared invitations ("Share the invitation") | Deleted automatically 30 days after the dinner date |
Once that time has passed, the data is deleted or irreversibly anonymised.
If data travels outside Europe
Some providers — Resend, Google LLC, Meta Platforms Inc., OpenAI and Cloudflare in particular — may process data on servers in the United States or elsewhere outside the European Economic Area. When that happens, it does not happen lightly (Arts. 44 et seq. GDPR): with each of them we rely on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914 of 4 June 2021), together with supplementary technical (encryption), organisational (restricted access) and contractual measures, in line with EDPB Recommendations 01/2020; and where the provider is certified under the EU-US Data Privacy Framework, the Commission's adequacy decision of 10 July 2023 applies as well. Transfers tied to analytics or marketing, moreover, happen only if you have said yes through the cookie banner or, for measuring ads on your booking only, if you have ticked the optional box in the booking form. The copies of the statistics in BigQuery stay in data centres in the European Union.
How we protect it
With technical and organisational measures appropriate to the risk, as Article 32 GDPR asks — and with a little extra care of our own. The identifying form data and any allergy-and-intolerance information are encrypted at rest with AES-256-GCM: without the key, kept separate from the data and under restricted access, they stay unreadable. Everything travelling between your browser and our servers goes over HTTPS/TLS. The keys that can read the database never touch the browser and stay server-side, following the least-privilege principle; we keep access logs and procedures for handling any incidents. And when marketing is active and you have given consent, the email and phone used to measure conversions leave only in hashed form (SHA-256): the platforms receive a fingerprint, never the data in the clear. The same goes for the IP in the forms' anti-abuse limit.
Internal tools and Google data (app "Palazzo Scotto S.r.l.")
Besides this website, Palazzo Scotto S.r.l. uses an internal application registered with Google under the name "Palazzo Scotto S.r.l.". It is not a public service: it is used only by the company's authorised staff (Valerio Scotto, managing director) to read and manage the company's own Google accounts — Google Ads, Google Analytics, Search Console, the Google Business Profile and internal spreadsheets. No customer, guest or website visitor signs in to this app with their own Google account.
Which Google data it uses, and with which permissions
The app requests only these permissions (OAuth scopes) from Google, granted by the company account that uses it:
- https://www.googleapis.com/auth/adwords — Google Ads: campaign, ad, keyword, spend, performance and conversion data of the company's own advertising accounts; uploading the company's own conversions.
- https://www.googleapis.com/auth/analytics.readonly — Google Analytics: read-only access to aggregated traffic and conversion statistics of the company's properties.
- https://www.googleapis.com/auth/webmasters.readonly — Search Console: read-only access to search data (queries, impressions, clicks, indexing) of the company's websites.
- https://www.googleapis.com/auth/business.manage — Google Business Profile: reading and managing the company's listings (information, reviews and replies to them).
- https://www.googleapis.com/auth/spreadsheets.readonly — Google Sheets: read-only access to the company's internal spreadsheets.
What it is used for
One thing only: running the company better. Internal reporting and measurement of NOS Ristorante and Palazzo Scotto campaigns, monitoring advertising spend, analysing search visibility, managing the company's Google listings, and uploading to Google Ads the conversions generated by our own websites. When a conversion relates to a booking, the guest's contact details (email, phone) are sent only in hashed form (SHA-256), and only when marketing is active and the guest has given consent, as described in "How we protect it".
What we never do
Data received from Google APIs is not sold, not transferred or shared with third parties, not used for personalised advertising or to profile individuals, and not used to train artificial intelligence or machine learning models. No one reads it except the company's authorised staff, for the purposes above.
Where it is kept, and for how long
Access credentials (OAuth tokens) are kept on the company's systems in restricted environment variables, accessible only to authorised staff, and never reach the browser or code repositories. Extracted data and reports stay on the company's systems and on the providers listed on this page, within the European Union where possible; they are kept for as long as internal analysis requires and then deleted. If the authorisation is revoked, the related tokens stop working and are deleted from our systems.
How to revoke access
Access can be revoked at any time from the Google Account permissions page (link below), under "Palazzo Scotto S.r.l.". For any question about this processing, or to request deletion of data, write to nosristorante@palazzoscotto.com.
https://myaccount.google.com/permissions
The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Your rights — all of them
The GDPR (Arts. 15–22) grants you a set of rights over your data. They are yours, and you can exercise them against us at any time:
- Know what data we hold about you and receive a copy (access, Art. 15);
- Have inaccuracies corrected and gaps completed (rectification, Art. 16);
- Ask us to delete it, in the cases provided for — the "right to be forgotten" (erasure, Art. 17);
- Ask us to pause its use, in the cases provided for (restriction, Art. 18);
- Receive it in a structured, machine-readable format and take it elsewhere (portability, Art. 20);
- Object to processing based on our legitimate interest (objection, Art. 21);
- Take back a consent already given, whenever you wish and without touching what came before (withdrawal, Art. 7);
- Not be subject to decisions based solely on automated processing (Art. 22).
To exercise them, just write to us: nosristorante@palazzoscotto.com, by certified email (PEC) to palazzoscotto@pec.it, or by post to the registered office (Corso Trieste e Trento 30, 70011 Alberobello). To protect your data, we may first ask you to confirm your identity. We reply without undue delay, and in any case within one month; for particularly complex or numerous requests the period may stretch by two months, but we will tell you within the first. It is all free of charge, except for manifestly unfounded or excessive requests. For cookies and the newsletter you can do it yourself, faster: the banner and the unsubscribe link are there for exactly that.
If something doesn't sit right
Talk to us first, if you like — nosristorante@palazzoscotto.com — and we will look for an amicable solution. Your right to turn to the supervisory authority remains intact either way: for Italy it is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — tel. (+39) 06.696771, email protocollo@gpdp.it, PEC protocollo@pec.gpdp.it, www.garanteprivacy.it.
And cookies?
The site uses technical cookies to work, always. The analytics and marketing tools are in place, but they write nothing until you say yes through the banner; the same will apply to the statistics shared with Palazzo Scotto, once they are active. Every detail, name by name, is in the Cookie Policy.
If this page changes
It can happen: laws get updated, tools change. When it does, we update this page and the date you see at the top. Worth a glance back, every now and then.