Skip to content
ITAENG

Privacy

Privacy policy

Data controller

RIVA IMPRESA RESTAURI ITALIA S.r.l.
Registered office: P.zza G. Ambrosoli, 1, 20144 Milano (MI)
Tax code / VAT number: 08465630153
Certified e-mail (PEC): 08465630153.assimprendil@pec.ance.it

Contact form

When you submit the form on the Contattipage, we collect: name, e-mail address, phone number (optional), subject (optional), message, the locale you submitted from, a daily-rotated, non-reversible hash of your IP address, whether the Cloudflare Turnstile anti-spam check passed, the timestamp of your consent, and the version of this privacy policy you accepted. We do not collect or store your browser's user-agent string. The data is stored in the contact_submissions table and, if a recipient address is configured, forwarded by e-mail via Resend to the person who answers enquiries. The legal basis is your consent (Art. 6(1)(a) GDPR), given by ticking the consent checkbox.

Job applications

When you submit an application through the Lavora con noi page, we collect: name, e-mail address, phone number (optional), the role/profile you are applying for (optional), a message (optional), the locale you submitted from, your CV file (name, size and content), and a daily-rotated, non-reversible hash of your IP address. Submission is protected by the same Cloudflare Turnstile anti-spam check as the contact form. The CV is stored in a private storage bucket, accessible only to authorised staff, and the other fields in theapplications table; retention period: [TO BE CONFIRMED]. If a recipient address is configured, the application is also forwarded by e-mail via Resend. The legal basis is the pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).

Cookies and similar technologies

This site does not show a cookie banner and does not use profiling or third-party advertising cookies. Only strictly technical cookies are used:

  • Supabase session cookie — issued only inside the restricted area (/dashboard) to keep an administrator signed in during their session. It is never set for visitors who are not logged in.
  • Cloudflare Turnstile challenge cookie — set on the contact form (/contatti) and on the job-application form (Lavora con noi) to complete the anti-spam check. It is short-lived and strictly technical.

Under Italian Garante Provv. 231/2021, strictly technical cookies do not require prior consent. Should non-essential cookies (analytics, profiling) ever be introduced, a consent banner will be added and this page updated accordingly.

Fonts

The site's typefaces are loaded via Next.js' next/font, which downloads and self-hosts the font files at build time from the site's own domain. No request is made to Google Fonts servers when you browse the site, and no data about you is shared with Google for this purpose.

Interactive historical map

Some pages embed an interactive map of the company's history. To draw it, your browser downloads map tiles directly from CARTO (*.basemaps.cartocdn.com). These are direct browser-to-provider requests we do not proxy, so CARTO receives your IP address as part of an ordinary HTTP request; we do not receive or store this information. The elevation data (an Amazon Web Services public dataset) is fetched by our own server and served from this site: your browser does not contact Amazon.

Google Search Console

The site includes a meta tag used solely to verify domain ownership in Google Search Console. It does not load any script and does not collect data about visitors.

Recipients of the data / third-party processors

The following providers act as data processors (or, where noted, as independent controllers for their own service), and are located outside the European Union with appropriate safeguards (Standard Contractual Clauses):

  • Supabase Inc. (USA) — database and file storage
  • Resend Inc. (USA) — transactional e-mail delivery
  • Vercel Inc. (USA) — hosting and serverless functions
  • Cloudflare Inc. (USA) — Turnstile anti-spam check on the contact and job-application forms

The site also uses Vercel Web Analytics for aggregated, cookieless traffic measurement. Vercel Web Analytics does not set cookies, does not use persistent identifiers and does not collect personal data: measurements are aggregated statistics, with no individual tracking.

The application database (Supabase) is hosted in the region [TO BE CONFIRMED].

Cross-border transfers

Transfers of data to the US-based providers listed above rely on Standard Contractual Clauses (SCC) approved by the European Commission and, where applicable, on the EU–US Data Privacy Framework (DPF) recognised as adequate by the European Commission's decision of 10 July 2023.

Retention period

Contact-form messages are kept for up to 24 months from submission [TO BE CONFIRMED]. Job-application attachments (CVs) are kept for up to 12 months from submission [TO BE CONFIRMED]. The daily-rotated IP hash is computed in a non-reversible way and cannot be traced back to the original address.

Your rights

Under Articles 15–22 GDPR you have the right to access your data, request rectification or erasure, object to processing, request restriction or portability, and withdraw consent at any time. To exercise these rights, contact the data controller by certified e-mail (PEC): 08465630153.assimprendil@pec.ance.it.

Changes to this policy

This page may be updated over time; the version currently published here is the one in force. Material changes are reflected in the “privacy policy version” recorded against new contact-form submissions.