Privacy Policy
This Privacy Policy explains how Restoran Francesco ("we", "us", "our") collects, uses and protects personal data of visitors to this website (restoran-francesco.com) and of guests who reserve a table through our online form. Our processing complies with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Croatian Act on the Implementation of the General Data Protection Regulation (NN 42/2018).
1. Data controller
The data controller is:
- Name:
- Nitesco d.o.o. (trading as Restoran Francesco)
- Croatian Tax ID (OIB):
- 27913553952
- Registered address:
- Dr. Franje Tuđmana 93, 23206 Sukošan, Croatia
- Phone:
- +385 23 681 587
- Email:
- info@restoran-francesco.com
For any questions about how your personal data is processed or to exercise your rights, please contact us at the email above.
2. What data we collect
Through our reservation form we process the following data which you provide directly:
- your name,
- phone number,
- email address,
- requested reservation date and time,
- party size,
- notes (optional).
For technical reasons, when the form is submitted the system also temporarily logs:
- the IP address from which the form was sent,
- browser identifier (User-Agent),
- timestamp of submission.
No other personal data is collected. The site does not use tracking cookies, third-party analytics or advertising services.
3. Purposes and legal bases
Reservation handling
Your name, phone, email, date/time, party size and notes are processed solely to handle and confirm your reservation (pre-contractual steps for a hospitality service). Legal basis: Article 6(1)(b) GDPR (performance of a contract or pre-contractual steps at the data subject's request).
Security and abuse prevention
We process the IP address and User-Agent to protect the form against automated abuse (e.g. spam and denial-of-service attempts). Legal basis: Article 6(1)(f) GDPR (legitimate interest of the controller in keeping its systems secure). We consider that this interest is not overridden by your rights as the processing is minimal and short-lived.
4. Retention
- IP address and User-Agent: deleted at the latest 30 days after the form is received.
- Other reservation data: deleted at the latest 90 days after the reservation date, or earlier if the reservation does not go ahead.
- If a request leads to a complaint, dispute or legal claim, we may retain data for as long as needed to defend such a claim, in line with applicable limitation periods.
5. Recipients
We do not sell or share your data with third parties for marketing purposes. Technically, your data may be accessible only to:
- Hosting provider — Hostinger International Ltd., Lithuania (EEA), where the reservation database resides;
- SMTP provider — Hostinger / Titan Mail (smtp.titan.email), used solely to send the reservation notification to our staff;
- Public authorities — only where required by law (e.g. police, courts, the Croatian Personal Data Protection Agency).
6. International transfers
As stated above, we use providers located within the EU/EEA. If this changes in future, any transfer will be safeguarded by appropriate measures (Standard Contractual Clauses or another mechanism under Articles 44–49 GDPR).
7. Your rights
You have the following rights regarding your personal data:
- access — confirmation of whether we process your data and a copy of it;
- rectification of inaccurate or incomplete data;
- erasure ("right to be forgotten") where there is no longer a basis for processing;
- restriction of processing in the cases set out by law;
- portability (receiving your data in a machine-readable format);
- objection to processing based on legitimate interest (point 3 above).
To exercise any of these rights, contact us at info@restoran-francesco.com. We will respond without undue delay, and at the latest within one month.
8. Right to lodge a complaint
If you believe the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority:
Croatian Personal Data Protection Agency (AZOP)
Selska cesta 136, 10000 Zagreb, Croatia
Phone: +385 (0)1 4609-000
Email: azop@azop.hr
Web: azop.hr
9. Data security
We implement reasonable technical and organisational measures, including HTTPS transport, parameterised database queries, per-IP rate limiting, and storing configuration secrets outside the code repository. No method of data transmission is absolutely secure; we aim to apply protection appropriate to the nature of the data.
10. Automated decision-making
We do not make decisions producing legal effects based solely on automated processing, nor do we carry out profiling.
11. Cookies and tracking
This website does not use tracking cookies, nor does it load third-party analytics scripts (Google Analytics, Facebook Pixel, etc.). The location map (Google Maps) is loaded only after you click the corresponding button.
12. Changes to this policy
We may update this policy from time to time. The current version is always available on this page, with the date of the last update shown at the top.