Your Privacy

Last updated: September 4, 2026.

The Casa del Pellegrino di Crema cares about your trust even before your data. This information explains, clearly, what data we process, why, for how long and what rights you have, pursuant to Regulation (EU) 2016/679 («GDPR») and Legislative Decree. 196/2003 updated (Privacy Code).

1. Data controller

The data controller is Casa del Pellegrino, with headquarters in Piazza Papa Giovanni Paolo II 1, 26013 Crema (CR).
Tel.: +39 351 655 7630 — Email: casadelpellegrinocrema@gmail.com.

Data Protection Officer (DPO): Davide Balestracci — tel. +39 335 121 8476.

2. What data we process

We only process the data that you provide to us or that is necessary for you to use the site and our services:

• Site navigation: technical data (IP address, browser type, pages viewed) via anonymous statistics, only if you accept from the cookie banner (Google Analytics with anonymized IP).
• Booking a table (from the site or via WhatsApp): name, surname, telephone, date and time, number of people, presence of children/high chair, any intolerances or allergies and notes. Information on allergies/intolerances are "special categories" (health data, art. 9 GDPR): we process them Alone to serve you safely at the table, we do not use them for anything else and we do not profile them.
• Subscription to the «Friends of the House» / ​​newsletter: email, name, surname, telephone (only if you choose WhatsApp updates), your communication preferences, date of consent and IP address (in protected form) as proof of consent.
• When you contact us via email, WhatsApp or telephone: name, contact details and the content of the message.

We do not knowingly collect data that reveals religious beliefs, opinions or other sensitive data other than as set out above.

3. Why we process them and on what legal basis

• Manage your booking and contact you about it - legal basis: execution of pre-contractual/contractual measures at your request (art. 6.1.b). Allergies/intolerances: yours explicit consent to process them for the service (art. 9.2.a).
• Send you newsletters, invitations to events and dinners, updates on services (email or WhatsApp) — legal basis: yours consent, free and revocable (art. 6.1.a). For updates and booking via WhatsApp we use the number you indicate.
• Profiling (more relevant communications based on your interests) — Alone if you give specific and separate consent (art. 6.1.a). We do not make automated decisions that produce legal effects on you.
• Respond to your requests contact details - legal basis: consent and/or our legitimate interest in giving you feedback (art. 6.1.f).
• Comply with legal obligations (e.g. accounting/tax, where applicable) — legal basis: legal obligation (art. 6.1.c).
• Site statistics — legal basis: consent (art. 6.1.a), provided by the cookie banner.

4. Provision of data

Contribution is always free. However, some data is necessary for the service you request: to register you need thee-mail and the tick on the information; for updates/reservations via WhatsApp serves the telephone number; to book a table you need name, telephone, date and number of people. Without this data we cannot provide that single service. Everything else is optional.

5. To whom we communicate the data (external managers)

We do not sell or give away your data. We use reliable suppliers who deal with them on our behalf as data controllers, only to operate the services:

• Very full (Italy) — management of the menu of the day and reservations.
• Short (Sendinblue, France · EU) — sending email newsletters, when active.
• Hosting provider (Register.it / server in the EU) — publication and technical conservation of the site.
• Google Ireland Ltd. — statistics (Google Analytics) and maps (Google Maps), only with your consent.
• Meta Platforms Ltd. / WhatsApp — messaging, if you write to us or choose updates via WhatsApp.

The data may also be communicated to public authorities when required by law.

6. Transfers outside the European Union

Some suppliers (e.g. Google, Meta) may also process data outside the European Economic Area, mainly in the United States. In this case the transfer takes place with the guarantees provided by the GDPR (Standard Contractual Clauses of the EU Commission and/or adhesion to the Data Privacy Framework). The automatic translation of the names of the dishes on the menu can rely on foreign services, but without transmitting any personal data of users.

7. How long we keep them for

• Reservations: for the time necessary to manage them and, if required, to fulfill legal obligations (usually up to 12 months, except for longer obligations).
• Newsletter subscription / Friends of the House: as long as you remain registered. Upon unsubscription, the data is removed or made anonymous (we only retain proof of revocation).
• Contact requests: for the time necessary to respond to you and manage the case (usually up to 24 months).
• Statistics: for the times foreseen by the tool, in aggregate/anonymized form.

8. How we protect data

We adopt adequate technical and organizational measures: encrypted transmission (HTTPS), access reserved only to authorized persons of the House, minimization of the data collected and storage on protected systems. We treat your data with the same care with which we welcome people.

9. Your rights

At any time you can exercise the rights provided for by the articles. 15–22 of the GDPR: log in to your data, correct them, delete them (“right to be forgotten”), limit it or oppose to the treatment, obtain the portability and revoke consent at any time (the revocation does not affect the processing already carried out). Just write to casadelpellegrinocrema@gmail.com or contact the DPO Davide Balestracci (tel. +39 335 121 8476): we will reply to you without delay.

For the newsletter you can unsubscribe with a click from the link at the bottom of each email. If you believe that the processing violates the law, you have the right to propose complaint to the Guarantor for the protection of personal data (garanteprivacy.it).

10. Minors

Our online services are not aimed at children under 14 years of age. We do not knowingly collect their data; if we realize we have done so, we delete them.

11. Cookies

Let's use a single anonymous statistics cookie (Google Analytics, anonymized IP) e only if you accept it from the initial banner. We do not use advertising profiling cookies. You can refuse (“Only necessary”) or change your mind at any time by deleting the site's cookies from your browser.

12. Changes to this policy

We may update this policy to accommodate new features or regulations. The current version is always the one published here, with the date of last update at the top.

For any questions about privacy, write to us at casadelpellegrinocrema@gmail.com: we are here to help you.