Privacy Notice — WhatsApp Channel

Pursuant to Art. 13 GDPR (Regulation (EU) 2016/679, the "GDPR"), this notice concerns the processing of personal data arising from interaction, via WhatsApp, with the business number of the Restaurant Quarantotto, technically operated through the MenuLampo platform.

1. Who processes the data (controller and processor)

The WhatsApp number is registered to Quarantotto S.r.l. (hereinafter "the Restaurateur"), who is the data controller. The routing and automated processing of messages, for the purpose of updating the digital menu, take place through the systems of RAD LAB di Riccardo M'Rad (P.IVA 11078251219, with registered office at Via Chiummano n. 47, 80072 Barano d'Ischia - NA; privacy contacts: riccardo@radlab.it, PEC: riccardomrad@pec.it), which acts as data processor (Art. 28 GDPR) on behalf of the Restaurateur.

2. Data processed, purposes and legal bases

When you send a message to this number, the system automatically captures your telephone number, your WhatsApp profile name and the text content or images you send. The purposes vary depending on the sender.

A) If you are the Restaurateur or authorised staff. The text messages and images are analysed, structured and stored for the sole purpose of modifying, adding or removing items from the digital menu.

• Legal basis: RAD LAB processes this data as processor, on the documented instructions of the Restaurateur-controller (Art. 28 GDPR); the legal basis on the Restaurateur's side is the performance of the contractual relationship and the management of its own service (Art. 6(1)(b) GDPR).

B) If you are a customer/diner (incidental receipt). This channel is intended primarily for the Restaurateur's technical use. Should you use it for general enquiries or for booking, your message and your number pass through the technical infrastructure. RAD LAB does not use such messages for profiling or analysis and handles their mere technical transit as data processor (Art. 28 GDPR) on behalf of the Restaurateur.

• Legal basis: the performance of pre-contractual measures or requests addressed to the Restaurant, and the Restaurateur's legitimate interest in managing communications with customers (Art. 6(1)(b) and Art. 6(1)(f) GDPR).
• We ask you not to share in the chat any sensitive data or data concerning your health.

3. Third-party providers and transfers outside the EU

The following providers are engaged to deliver the service, acting as processors/sub-processors:

• WhatsApp LLC (USA) and Meta Platforms Ireland Ltd (EU) — routing of messages via WhatsApp Cloud API. This entails a transfer of data to the United States. WhatsApp LLC adheres to the EU-U.S. Data Privacy Framework: pursuant to Art. 45 GDPR the transfer is based on the adequacy decision (EU) 2023/1795.
• Anthropic, PBC (USA) — used solely for the automatic translation of dish names and descriptions; the recognition of WhatsApp commands is deterministic and does not employ artificial intelligence. In the absence of an applicable adequacy decision, the transfer takes place pursuant to Art. 46 GDPR on the basis of the Standard Contractual Clauses (SCC) adopted by the European Commission, supplemented by technical and organisational measures. The data transmitted via the commercial API are not used by the provider to train its models and are retained only for a limited period, for security purposes and the prevention of abuse.
• Hetzner Online GmbH (Germany, EU) — the databases that store the menu configurations reside within the European Union.

4. Retention

The data necessary for managing the menu is retained for the duration of the contract between the Restaurateur and RAD LAB. The history of management messages is retained for the strictly necessary time for technical and diagnostic purposes, in accordance with criteria of data minimisation and rotation. Upon termination of the contract, the Restaurateur's data is deleted within the technically necessary time, in application of the principle of storage limitation (Art. 5(1)(e) GDPR). Messages from numbers not authorised to manage the menu are not intended for retention in our systems and are discarded once recognised as such. For direct conversations between you and the Restaurant not aimed at updating the menu (for example enquiries or bookings), the retention periods are determined independently by the Restaurateur, as data controller, in accordance with its own privacy notice.

5. Rights and complaints

Pursuant to Arts. 15-22 GDPR you may exercise the rights of access, rectification, erasure, restriction, portability (where applicable) and objection, by contacting the Restaurateur (quarantottosrl@gmail.com) and, for technical matters, RAD LAB (riccardo@radlab.it). You may request a copy of the safeguards adopted for transfers outside the EU (e.g. Standard Contractual Clauses) at the same contact points. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante) (Art. 77 GDPR — www.garanteprivacy.it).

Nature of the provision of data and automated decision-making. The use of WhatsApp is voluntary: if you do not use this channel, we will not be able to receive or handle your requests through it. No automated decision-making producing legal effects within the meaning of Art. 22 GDPR is carried out; the automated tools solely interpret and translate the content of the menu.

6. Updates

This notice may be updated in the event of technical or regulatory changes. Last updated: 22/06/2026 14:15 CEST.