Vai al contenuto principale
Umami Beer

Privacy notice

Pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) · Last updated 24 October 2026

This notice explains how we process the personal data of people who visit https://newumami.umamibeer.it and use its services: customer area, takeaway and delivery orders, table bookings, the “Contact us” form and reviews. It does not cover third-party websites reachable through links.

1. Data controller

The data controller is Umami Group S.r.l., VAT no. 03541490540, REA PG-296768, registered office Via Los Angeles 145, fraz. Santa Maria degli Angeli, 06081 Assisi (PG), Italy, represented by its legal representative Dott. Roberto Scarponi. Contacts: e-mail info@umamibeer.it, certified e-mail (PEC) umamigroup@pec.it, phone 392 204 3500.

2. Which data we process and why

2.1 Browsing data

The systems running this website collect some data whose transmission is inherent to Internet protocols: IP address, date and time of the request, requested page, server response code, browser and operating system. We use them to run the site, keep it secure (e.g. against abuse and attacks) and detect malfunctions.
Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). Retention: only as long as strictly necessary for these purposes, unless needed to investigate crimes.

2.2 Visit statistics (cookie-free)

To know how many people visit the site, which pages are read most and where visitors come from, we use an in-house statistics system that uses no cookies and shares no data with third parties. For each page view we record the page, language, referring site, device type, browser and operating system. The IP address is not stored: to count unique visitors we compute, together with browser data, an encrypted code using a key that changes every day and is then destroyed, so that nobody can be identified and visits on different days cannot be linked.
Legal basis: our legitimate interest in improving the site (Art. 6(1)(f) GDPR). Retention: 25 months.

2.3 Registration and customer area

You need an account to order online. We ask for your first and last name, e-mail, phone number and a password (stored only in encrypted form), plus any delivery addresses you choose to save. We verify your phone number with a code sent by text message and your e-mail with a confirmation message. The customer area shows your orders, bookings and loyalty points.
Legal basis: performance of a contract and of pre-contractual steps at your request (Art. 6(1)(b) GDPR). Retention: while the account is active; you may ask us to delete it at any time.

2.4 Takeaway and delivery orders

To prepare and deliver an order we process the products chosen, any notes, the time, the payment method (payment is made on delivery or collection) and, for delivery, the address. To calculate distance, travel time and delivery cost the address is sent to Google’s route calculation service (see section 4). We e-mail you the order confirmation and may call you about the order or the delivery.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal obligations such as tax rules (Art. 6(1)(c) GDPR). Retention: order data for 24 months; tax documents for 10 years (Art. 2220 of the Italian Civil Code).

2.5 Table bookings

To book we need your name, phone number, e-mail, number of guests, date and time; your e-mail is used for the confirmation and to change or cancel the booking. In the notes you may tell us about allergies or intolerances: we use them only to prepare your food safely.
Legal basis: your request (Art. 6(1)(b) GDPR); for allergy and intolerance information, which concerns health, your explicit consent (Art. 9(2)(a) GDPR), given by writing it and withdrawable at any time. Retention: 24 months from the booking date.

2.6 “Contact us” form and reviews

When you write to us through the “Contact us” form we use your name, e-mail, optional phone number and message to reply. When you leave a review on the site we publish its text, rating and the name you give, after checking it; your e-mail, if provided, is not published.
Legal basis: your request (Art. 6(1)(b) GDPR); for publishing the review, your consent (Art. 6(1)(a) GDPR). Retention: messages for 24 months; reviews while published or until you ask for removal.

2.7 Internal order statistics

We use order data in aggregate form (e.g. most requested dishes and delivery areas) to plan our menu and service, without making decisions about you personally. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

2.8 Protection of our rights

In case of disputes we may use the necessary data to establish, exercise or defend our rights, including in court (Art. 6(1)(f) GDPR), for as long as needed.

3. Providing your data

Data marked as mandatory in the forms is needed to provide the service you request: without it we cannot create your account, fulfil your order, confirm your booking or reply to you. Other data is optional.

4. Who receives the data

Data is processed by our authorised staff and, only for the purposes above, by the providers that help us run our services, appointed as data processors (Art. 28 GDPR):

  • NeTS Information Technology of Roberto Scarponi (Assisi, Italy): development and maintenance of the site and systems;
  • the hosting providers that host the site and its data on servers in the European Union;
  • Microsoft (Microsoft 365): sending confirmation e-mails and handling our mail;
  • Aruba S.p.A.: sending the text messages with the phone verification code;
  • Google: calculating delivery distance and time (receives the delivery address).

The site also shows public third-party content loaded from their servers: photos from our Instagram profile (Meta), public Google reviews with their authors’ photos and, only if you open it or accept cookies, Google’s interactive map. In these cases your browser shares your IP address with those services; for the interactive map see also the Cookie Policy. Some of these providers may process data outside the European Union (e.g. in the United States): such transfers rely on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.

Data may also be disclosed to public authorities where required by law and, in case of disputes, to legal advisers and courts. We do not sell or share data with third parties for marketing purposes.

5. Security

The site uses encrypted HTTPS; passwords are stored only in encrypted form; access to data is restricted to authorised staff; systems are protected and backed up regularly.

6. Minors

The site’s services are not intended for children under 14. Alcoholic drinks are sold to adults only.

7. Your rights

By writing to the contacts in section 1 you may at any time:

  • access your data and obtain a copy (Art. 15);
  • have it rectified or completed (Art. 16);
  • have it erased (Art. 17) or restrict its processing (Art. 18);
  • receive it in a structured format to transmit it to another controller (portability, Art. 20);
  • object to processing based on legitimate interest (Art. 21);
  • withdraw your consent, without affecting processing carried out before withdrawal (Art. 7(3)).

You may also lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, PEC protocollo@pec.gpdp.it.

8. Changes

We may update this notice, for instance for new services or changes in the law: the date at the top shows the latest update.