MORGAN'SPrivacy notice
Booking a table, asking for the room, giving a dinner as a gift: what we keep, and for how long.
Version 2026-10-15.3 · updated 15 October 2026 · This is a courtesy translation: if anything differs, the Italian version prevails.
Who handles your data
The data controller is Morgan's Restaurant di Morgan Mohamed, Via Aganoor Pompili 19, 06065 Passignano sul Trasimeno (PG), Italy, VAT no. 03445450541. For any question about your data: monia.morgan@libero.it, or +39 075 828198.
What we collect, and why
Booking a table
With the «Book» form you send us the day, time, number of guests, name, phone and email and, if you like, the course (the set menu) and a note. We need them to handle your request, confirm it and write to you about this booking: the processing is based on your request to book, that is on pre-contractual measures (Art. 6(1)(b) GDPR). Without name, phone, email, day, time and guests we cannot take the request; course and note are optional.
Requesting a private event
With the «Request a date» form you send us the occasion, how many people you will be (a range), the date if you already have one, name, phone, email and an optional note. They are used to prepare a quote, call you back and let you know the request has arrived; the legal basis is the same (Art. 6(1)(b)).
The emails we send you
We only write to you about what you asked for: that your request has arrived, the confirmation of the table or our reply if there is no room that day, the changes you ask us for, a reminder the day before, for an event the receipt of the request and, for a gift card, the voucher (to you and, if you ask, to the recipient). No newsletters, no advertising. We never put your notes in emails, nor your phone number. They are sent on our behalf by Resend (see «Who sees them»).
Allergies and intolerances in the notes
People often write allergies, intolerances or coeliac disease in the notes: this is health data, which we may only use with your explicit consent (Art. 9(2)(a)). That is why, when you write a note, the form asks you to tick a dedicated box: without it the note is not sent. The consent is only used to prepare your table; you can withdraw it at any time by writing to us, and withdrawing it does not affect what was done before. If you prefer, write nothing: you can tell us about allergies on the phone or at the restaurant.
Requesting a gift card
If you request a voucher on the site you send us the amount, the recipient's name and the message (these two only if you write them), and your name, phone and email. The phone is used to call you about payment, which does not take place on the site: it is made at the restaurant or in the way we agree by phone. The email is used to send you the voucher once paid. Of the voucher we then keep the code, the value and the dates, to recognise it when it is used. The legal basis is your request and the purchase contract (Art. 6(1)(b)) and, for accounting, our legal obligations (Art. 6(1)(c)). To retry an interrupted delivery, the address and email content are kept in the delivery queue until a successful send, for no more than 3 days. This also applies to vouchers emailed at the restaurant and to reminders.
If you choose to have it sent to the recipient, you also give us their email address, the name you sign the gift with («from») and the day and time of sending. We use them only to send them the voucher at that moment (Resend sends it on our behalf), on the basis of the purchase contract (Art. 6(1)(b)): their address is deleted the day after sending. Only give us someone's address if you are sure they will be happy to receive the gift this way.
Every voucher has a QR code that opens its page: anyone with the QR code or the link can see the voucher, name and message included. Keep it safe, like a gift ticket.
Visiting the site
The site uses no analytics, advertising or profiling tools, and loads nothing from Google or social networks: fonts and images come from our own server. Like any website, the server receives the IP address and the technical data of the request (browser, page requested): these are used by Cloudflare, which hosts the site, to show you the pages and protect them from abuse (legitimate interest in security, Art. 6(1)(f)). To count repeated form submissions the IP address is used for one minute and is not stored. Cookies are described in the cookie policy.
How long we keep it
| What | For how long |
|---|---|
| The notes of a booking | Until the day after the booked date, then they delete themselves |
| Your email (booking or event) | Until the day after the date; for an event with no date, 90 days from the request |
| A table request | 12 months from the booked date, then it is deleted. Only anonymous daily counts remain (how many bookings, how many guests), with no data on who booked |
| The notes of an event | Until the day after the event; if there was no date, 90 days from the request |
| An event request | 12 months from the date of the event (or from the request, if there was no date) |
| Name, phone and email of someone requesting a voucher | 30 days after the voucher is issued; if the request goes no further, it is closed after 60 days and the contact details are deleted |
| Address and content in the email queue | Until a successful send, for at most 3 days; only the technical outcome remains |
| The email of someone receiving a voucher as a gift | Until the day after sending (or until the voucher is cancelled) |
| Names and message on a voucher | 12 months after the voucher expires or is used |
| Code, value and dates of a voucher sold | 10 years, for accounting obligations |
| Technical data of the visit (Cloudflare) | A few days, then they delete themselves |
The site carries out these deletions by itself, every night.
Who sees them
- Authorised restaurant staff, from the bookings panel.
- Cloudflare, Inc., which hosts the site and the request database, as data processor (Art. 28). The database is bound to the European Union: Cloudflare stores and runs it only in data centres within the EU. For any transfers to the United States, Cloudflare is certified under the EU–US Data Privacy Framework.
- Resend, Inc., which sends on our behalf the emails about bookings, events and vouchers: it receives the address and the text of the email (never the notes). It acts as data processor (Art. 28); it is based in the United States, and the transfer is covered by the standard contractual clauses of its data processing agreement.
When a request arrives, the restaurant receives a Telegram notification with day, time, guests and course (or occasion, range and date): never name, phone, email or notes, which stay only in our database. Data is not sold, used for advertising or disclosed.
Your rights
You can ask us at any time to see your data, correct it, delete it, restrict its use, object to processing based on legitimate interest or receive it in a readable format (Arts. 15–22 GDPR), and withdraw your consent regarding the notes. Just write to monia.morgan@libero.it. If you believe your data is being handled improperly you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.