Privacy Policy

business 1. Data Controller

The controller of the personal data described in this notice, within the limits set out in section 2, is DI BARTOLO CLAUDIO, a sole proprietorship operating under the siMangia brand, with registered office at Via Danimarca 33, 93012 Gela (CL), Italy, VAT number 02172370856 (“siMangia”).

Contact details: certified e-mail (PEC) [email protected] — e-mail [email protected]. For any request concerning the protection of personal data, you may contact the Controller at the details above.

handshake 2. Roles: Controller and Processor

siMangia provides restaurants with a platform for managing bookings, the dining room, takeaway orders, loyalty programmes, communications and phone calls, including a voice assistant based on artificial intelligence. siMangia's role depends on the data concerned:

• chevron_right Data of restaurant customers (bookings, orders, customer records, loyalty programme, communications and calls to the voice assistant): the controller is the restaurant with which the booking is made or which is called; siMangia processes such data on behalf of the restaurant as a processor pursuant to Article 28 of Regulation (EU) 2016/679 (“GDPR”), under a data processing agreement and solely on the restaurant's documented instructions. The full privacy notice for such processing is provided by the restaurant, to which requests to exercise data subject rights should be addressed in the first instance.
• chevron_right Data of restaurateurs and users of the management system (management of the contractual relationship, accounts, authentication and service security) and data of visitors to the website www.simangia.app: siMangia acts as controller. The processing of restaurant staff data for the restaurant's own purposes (for example, work organisation) remains under the restaurant's control.

database 3. Personal Data Collected

a) Website visitors

• chevron_right Browsing data — IP address, browser type, pages visited and technical session data, including through cookies (see section 7)
• chevron_right Data provided voluntarily — name, contact details and content of messages sent through contact forms or by e-mail

b) Restaurateurs and users of the management system

• chevron_right Identification and contact data — first name, last name, e-mail address, role and venue
• chevron_right Credentials — username and password, stored exclusively in non-reversible encrypted form
• chevron_right Access and usage data — dates and times of access, IP address and user agent in security logs, operations performed in the management system
• chevron_right Contractual and billing data of the restaurateur and, where necessary, the data and documents of the legal representative required to activate the service telephone number

c) Restaurant customers (data processed on behalf of the restaurant)

• chevron_right Identification and contact data — first name, last name, telephone number, e-mail and date of birth, if collected by the restaurant
• chevron_right Bookings and orders — date, time, number of guests, room and table, notes, dishes ordered, pick-up time, amounts, number of visits and no-shows
• chevron_right Food allergies and intolerances — data concerning health (Article 9 GDPR), processed only with the data subject's explicit consent recorded in the service
• chevron_right Consents, loyalty programme and communications — outcome, date, source and wording of consents; points, rewards and games; e-mail delivery status and, for marketing communications sent only to those who have consented, opens and clicks; ratings and comments after the visit

d) Calls to the voice assistant (data processed on behalf of the restaurant)

• chevron_right Caller's number — if not withheld, together with the date, time, duration and outcome of the call
• chevron_right Content of the request — transcript of the conversation, summary, bookings created or changed and callback requests
• chevron_right Audio recording — not stored, unless recording is expressly provided for in the contract with the restaurant, in which case the restaurant informs callers accordingly. The voice is streamed in real time only for as long as necessary for processing and, for calls transferred to staff, for forwarding to the venue's phone

devices 4. The siMangia Apps

• chevron_right “siMangia” for tablets — the app only opens the management system at app.simangia.app and does not collect any data other than the technical session cookie and the photos that staff choose to upload. The camera is used only when the user opens it.
• chevron_right “siMangia Forward” for Android — an app that the restaurant installs on its own phone to forward calls and receive those transferred by the assistant. For the data it processes, please refer to its privacy notice: app.simangia.app/telefono/privacy.

target 5. Purposes and Legal Bases

For the data of which it is controller, siMangia processes personal data for the following purposes:

• chevron_right Provision of the service, management of accounts and of the contractual relationship with restaurateurs — performance of a contract or of pre-contractual measures (Art. 6(1)(b) GDPR)
• chevron_right Security of the service, prevention of abuse and unauthorised access — legitimate interest of the Controller (Art. 6(1)(f) GDPR)
• chevron_right Responding to requests sent through the website or by e-mail — pre-contractual measures at the data subject's request or legitimate interest (Art. 6(1)(b) and (f) GDPR)
• chevron_right Compliance with legal obligations, including accounting and tax obligations — legal obligation (Art. 6(1)(c) GDPR)
• chevron_right Establishment, exercise or defence of legal claims — legitimate interest of the Controller (Art. 6(1)(f) GDPR)

Data of restaurant customers and of calls to the assistant are processed solely for the purposes and on the legal bases determined by the controlling restaurant and set out in its privacy notice; siMangia does not use them for its own purposes, does not sell them and does not disclose them to third parties except as described in section 8 or as required by law.

support_agent 6. Voice Assistant and Artificial Intelligence

When the assistant answers a call, the caller is informed at the beginning of the conversation that they are interacting with an artificial intelligence system, in accordance with Article 50 of Regulation (EU) 2024/1689 (“AI Act”), and that the call is transcribed.

The system converts speech into text, formulates replies by means of a language model and speaks with a synthetic voice, using the restaurant's information (opening hours, availability, menu) and, if the caller uses the number with which they booked, the details of their booking. The assistant can change or cancel only the bookings associated with the calling number, does not take decisions based solely on automated processing which produce legal effects concerning the data subject or similarly significantly affect them (Article 22 GDPR), and the caller can always ask to speak to a person or to be called back.

cookie 7. Cookies

The website uses technical cookies necessary for its operation and for storing user preferences (for example, the light or dark theme). The website pages also embed the Google tag (Google Ads) and typefaces provided by Google Fonts. The management system uses only a technical session cookie; restaurants' booking pages do not use profiling cookies, analytics tools or third-party tools. For more details, please refer to our Cookie Policy.

share 8. Sub-processors and Third Parties

To provide the service, siMangia relies on the following providers, which process data on its behalf (as sub-processors pursuant to Article 28(2) and (4) GDPR, for restaurant data) and which are bound by contract to data protection obligations substantially equivalent to those undertaken by siMangia:

• chevron_right Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) — servers, storage of all service data and backups, at the Nuremberg data centre (Germany, EU); no transfers outside the EU
• chevron_right Eleven Labs Inc. (169 Madison Ave #2484, New York, NY 10016, USA) — telephone assistant: speech recognition, language model, speech synthesis and conversation management (audio in transit, caller's number, transcript, restaurant and customer data relevant to the call); processing in the USA and the EU
• chevron_right Eleven Labs sub-processors (list published at compliance.elevenlabs.io), including Google LLC / Google Cloud for the Gemini language model — processing of the conversation text to generate replies; processing in the USA and the EU
• chevron_right Twilio Ireland Limited (70 Sir John Rogerson's Quay, Dublin 2, Ireland), with Twilio Inc. (USA) — the assistant's service number and call routing (caller's number, call metadata, audio in transit); processing in the EU and the USA
• chevron_right Plus Five Five, Inc. (“Resend”) (2261 Market Street #5039, San Francisco, CA 94114, USA) — sending of e-mails (address, message content, delivery events); processing in the USA

The following are not sub-processors: the restaurant's telephone operator, with which the restaurant has its own contract; Cloudflare, Inc., which provides only the DNS service for the domains and does not process service data; the mail providers of e-mail recipients. Data are not disseminated or sold and may be disclosed to authorities where required by law.

public 9. Transfers of Data outside the European Economic Area

Data are stored on servers located in the European Union (Germany). Some providers of the telephone assistant and of the e-mail service also process data in the United States or make them accessible from there. Such transfers take place in compliance with Chapter V GDPR and, in particular:

• chevron_right to recipients certified under the EU-U.S. Data Privacy Framework, on the basis of the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795, Art. 45 GDPR); certifications can be verified at dataprivacyframework.gov;
• chevron_right failing that, or in addition, on the basis of the standard contractual clauses adopted by Implementing Decision (EU) 2021/914 (Art. 46(2)(c) GDPR) or of approved binding corporate rules (Art. 47 GDPR), with any supplementary measures required.

A copy of the safeguards adopted may be obtained by writing to the Controller.

schedule 10. Retention Period

Data are kept only for as long as strictly necessary for the purposes for which they are processed; at the end of that period they are deleted or anonymised, including through automated procedures run daily. For data processed on behalf of restaurants, retention periods are set by the controlling restaurant, which may change them; unless it instructs otherwise, the following apply:

• chevron_right Customer records and booking and order history — 24 months from the last booking, visit or interaction, followed by anonymisation; bookings, orders and availability alerts not linked to a customer: 24 months from their date
• chevron_right Full call transcripts — 90 days, after which only the call log, without text, is kept; at Eleven Labs, transcripts and conversation data are kept for 30 days
• chevron_right Call log (number, date, duration, outcome, summary) and completed callback requests — 12 months, followed by anonymisation: only the day, duration, outcome and cost are kept
• chevron_right Audio recordings of calls — not stored, unless otherwise provided for in the contract with the restaurant
• chevron_right Allergies and intolerances — until consent is withdrawn or the customer record is anonymised
• chevron_right Data for marketing communications — until consent is withdrawn or an objection is made; e-mails sent and open and click data: 24 months
• chevron_right Points, rewards and games — for the duration of the loyalty programme, anonymised together with the customer record
• chevron_right Ratings and comments — 24 months
• chevron_right Evidence of consents and withdrawals — for the whole duration of the processing and for the following 10 years, for defence purposes, in minimal form (date, source and outcome)
• chevron_right Log of operations performed by users of the management system — 12 months
• chevron_right System administrator access logs — at least 6 months and no more than 12
• chevron_right Backups — 14 days on a rolling basis
• chevron_right Data of restaurateurs and accounts — for the duration of the contract; after its termination, all restaurant data are returned or deleted within 90 days, plus 14 days for backups, except for documents that the law requires to be kept longer (for example, accounting records and invoices, for 10 years under Article 2220 of the Italian Civil Code)

shield_person 11. Data Subject Rights

Under Articles 15-22 of the GDPR, data subjects have the right to:

• chevron_right Access — obtain confirmation of the processing and a copy of their data
• chevron_right Rectification — correct inaccurate or incomplete data
• chevron_right Erasure — request the erasure of their personal data
• chevron_right Portability — receive their data in a structured, machine-readable format
• chevron_right Objection — object to processing based on legitimate interest and to marketing communications
• chevron_right Restriction — request the restriction of processing
• chevron_right Withdrawal of consent — withdraw any consent given at any time, without affecting the lawfulness of processing carried out before the withdrawal

To exercise your rights in relation to data of which siMangia is controller, you may contact the Controller at [email protected] or by certified e-mail (PEC) at [email protected]. For data processed on behalf of a restaurant, requests should be addressed to the controlling restaurant; if they are received by siMangia, they are forwarded without delay to the restaurant, which siMangia assists in responding. A response is provided within one month of the request, which may be extended in the cases provided for in Article 12(3) GDPR.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it).