Last updated: 8 October 2026

Privacy Policy

This Privacy Policy describes how the personal data of users, potential customers, restaurant operators, guests and other individuals interacting with Ziblo (hereinafter the “Data Subject” or the “User”) is processed.

This Privacy Policy applies to the website https://www.ziblo.it, the web application app.ziblo.it and any public pages created by Users through the Platform, for example https://app.ziblo.it/business-name (collectively, the “Service” or the “Platform”).

Personal data is processed in compliance with Regulation (EU) 2016/679 (“GDPR”), Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, and applicable personal data protection laws.

1. Data Controller

The Data Controller of the personal data collected through the website [www.ziblo.it](http://www.ziblo.it) and the application app.ziblo.it is:

Alessandro Matta
Via Leopoldo Pellas 43, 50141 Florence, Italy
VAT No./Tax Code: 01681880496
PEC: matta@pec.alessandromatta.it
Email: servizioclienti@ziblo.it

To exercise their rights or for any request concerning the processing of personal data, the Data Subject may contact the Data Controller at servizioclienti@ziblo.it.

2. Privacy Roles within the Ziblo Platform

Ziblo is a platform that allows restaurants, bars, pizzerias, farm stays, venues, accommodation facilities, event organizers and similar businesses to manage content, menus, products, reservations, events, quotations and guests.

The privacy role of Ziblo may vary depending on the type of processing carried out.

Data collected directly by Ziblo

For data collected directly through the website, application registration, Account, information requests, newsletter, support, billing, subscription management, security and technical management of the Platform, Alessandro Matta normally acts as the Data Controller.

Data of restaurant customers

When a restaurant operator or other Business manager uses Ziblo to collect and manage personal data of their End Customers, for example through reservations, events, contact requests, guest records or public Business pages, the restaurant operator normally acts as an independent Data Controller.

In such cases, Ziblo may process personal data on behalf of the restaurant operator as a Data Processor, on the basis of a data processing agreement, where required pursuant to Article 28 of the GDPR.

An End Customer who makes a reservation at a venue through Ziblo should contact the restaurant operator directly for information concerning the processing of their personal data, the purposes of processing, reservation conditions and the exercise of rights relating to their relationship with the venue.

3. Types of Data Processed

The Data Controller may process the following categories of personal data.

Browsing and Technical Data

When using the website and application, data whose transmission is implicit in the use of Internet protocols and computer systems may be processed, including:

IP address and technical connection information;
browser type, operating system and device used;
date, time and duration of access;
pages viewed and actions performed within the Platform;
technical logs, session identifiers and information necessary for Service security;
any error reports and diagnostic data.

Data Provided Directly by the User

The Data Controller may process data provided by the User during registration, Business configuration, information requests, contact with support, newsletter subscription or activation of Paid Modules, including:

first and last name;
email address;
telephone number, if provided;
password and access credentials, processed in protected form;
Business-related information, such as company name, business name, registered office, contact details, type of venue and administrative information;
billing data and tax information;
content of requests submitted to support;
preferences and settings configured within the Platform.

Data Entered by Restaurant Operators into the Service

Restaurant operators may enter into the Platform data relating to the management of their Business, including menus, products, ingredients, tags, events, quotations, reservations and guest records.

Such data may include, depending on how the restaurant operator uses the Service:

first and last name of the End Customer;
email address and telephone number;
date, time, number of persons and reservation details;
notes provided by the customer;
information concerning an event or request received;
reservation history and operational preferences;
other information entered by the restaurant operator or provided by the End Customer.

The restaurant operator is responsible for collecting only the data that is necessary and for providing Data Subjects with an appropriate privacy notice. Restaurant operators must not use the Platform to collect or process special categories of personal data, such as health data, unless this is strictly necessary, lawful and supported by an appropriate legal basis and adequate safeguards.

Payment Data

Where Paid Modules are activated, the Data Controller may process administrative and billing data necessary to manage the contractual relationship.

Where external payment providers are used, payment instrument data will be processed directly by the relevant provider in accordance with its own privacy policy. Ziblo may receive limited information from the provider, such as payment status, transaction identifier, subscription status and data necessary for accounting management.

Cookies and Tracking Technologies

The website, application and any public pages of the Service may use cookies, similar technologies, local storage technologies and other tracking systems.

Detailed information concerning the types, purposes, duration, third parties involved and management of preferences is available in the Cookie Policy.

4. Purposes and Legal Bases for Processing

Personal data may be processed for the following purposes and on the following legal bases:

Registration, creation and management of the Account: to enable registration, access to the application, Business configuration, profile management and use of available features. Legal basis: performance of a contract or pre-contractual measures, pursuant to Article 6(1)(b) of the GDPR.
Provision of the Service: to enable use of the Platform’s features, including management of locations, menus, products, content, reservations, events, quotations, guests, public pages, settings and summary data. Legal basis: performance of a contract, pursuant to Article 6(1)(b) of the GDPR.
Support and contact requests: to respond to requests submitted by email, contact forms, support channels or other communications. Legal basis: performance of pre-contractual measures or a contract, pursuant to Article 6(1)(b) of the GDPR, or the legitimate interest of the Data Controller pursuant to Article 6(1)(f) of the GDPR.
Subscription, billing and payment management: to manage activation of Paid Modules, issue tax documents, verify payments, manage renewals and comply with accounting obligations. Legal basis: performance of a contract pursuant to Article 6(1)(b) of the GDPR and compliance with legal obligations pursuant to Article 6(1)(c) of the GDPR.
Newsletter and promotional communications: to send updates, news, commercial communications and promotional content relating to Ziblo where consent is required. Legal basis: consent of the Data Subject pursuant to Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time.
Service communications: to send messages necessary for Account management, security, Service changes, contractual updates, support requests, payments or other non-promotional communications. Legal basis: performance of the contract and the legitimate interest of the Data Controller, pursuant to Article 6(1)(b) and (f) of the GDPR.
Statistical analysis, measurement and Service improvement: to analyze use of the website and Platform in aggregated form or through non-technical cookies, assess campaign effectiveness, understand browsing behavior and improve the user experience. Legal basis: consent of the Data Subject, where required, pursuant to Article 6(1)(a) of the GDPR.
Security, fraud and abuse prevention: to prevent unauthorized access, fraudulent use, violations of the Terms, cyberattacks, technical anomalies and other potentially harmful behavior. Legal basis: legitimate interest of the Data Controller pursuant to Article 6(1)(f) of the GDPR.
Compliance with legal obligations: to comply with regulatory, tax, administrative, accounting and judicial obligations or requests from competent authorities. Legal basis: legal obligation pursuant to Article 6(1)(c) of the GDPR.

5. Processing Methods and Security Measures

Personal data is processed using electronic, telematic and, where necessary, documentary means.

The Data Controller adopts reasonable and appropriate technical and organizational measures based on the nature of the data processed, with the aim of ensuring the security, confidentiality, integrity, availability and resilience of systems and services.

Such measures may include, depending on the circumstances, access controls, credential management, backups, system protection, technical monitoring, log recording, access restrictions and internal organizational procedures.

However, no IT system can be considered completely secure. Users are encouraged to use strong passwords, not to share their credentials and to promptly report any unauthorized access or anomalies.

6. Cookie Management and Consent Preferences

Ziblo uses different tools to manage cookies, similar technologies and consent preferences depending on the domain or digital environment used by the Data Subject.

Institutional Website www.ziblo.it

The institutional website http://www.ziblo.it is built using WordPress and uses Complianz to manage the cookie banner, consent preferences and cookie-related documentation.

Complianz may be used to display the consent banner, preventively block non-essential cookies and tracking technologies, collect and store the preferences expressed by the user, allow consent to be modified or withdrawn, and make the Cookie Policy or cookie declaration available.

The User may modify or withdraw their preferences concerning non-essential cookies at any time through the “Manage Consent”, “Cookie Settings” command or another equivalent link available on [www.ziblo.it](http://www.ziblo.it).

app.ziblo.it Application and Public Business Pages

The application app.ziblo.it and any public pages created through Ziblo, for example https://app.ziblo.it/business-name, use CookieScript to manage preferences relating to cookies and tracking technologies.

CookieScript may be used to display the cookie banner, collect, record and document users’ consent preferences, allow consent to be modified or withdrawn, and make the declaration of cookies detected on the relevant domains available.

In connection with these activities, CookieScript may process technical data and information relating to consent, such as the date and time of the choice, expressed preferences, technical identifiers, IP address or part thereof, browser, device and other information necessary to demonstrate, store or manage consent, within the limits of applicable law and the configuration adopted.

The User may modify or withdraw their preferences concerning non-essential cookies at any time through the “Cookie Settings”, “Manage Preferences” command or another equivalent link available in the app.ziblo.it application, on Public Business Pages or in the applicable Cookie Policy.

Strictly necessary cookies required for the technical operation of the website or application may be used without consent, to the extent permitted by applicable law. Analytics, statistical, profiling, marketing or non-essential third-party cookies are activated only after the User’s consent, where required by law.

Detailed information concerning types, purposes, duration, providers involved and methods for managing preferences is available in the respective Cookie Policies:

for the WordPress website: Cookie Policy for www.ziblo.it;
for the application and Public Business Pages: Cookie Policy for app.ziblo.it.

7. Recipients of Personal Data

Personal data may be processed by persons authorized by the Data Controller and by external providers who, depending on the circumstances, act as Data Processors, independent Data Controllers or authorized persons.

Categories of recipients may include:

- hosting, cloud, technical infrastructure, security, backup and Platform maintenance providers;
- email, customer support, CRM and newsletter delivery service providers;
- Complianz — WordPress plugin used on the www.ziblo.it website to manage the cookie banner, consent preferences and cookie-related documentation.
- CookieScript — platform used on app.ziblo.it and any Public Business Pages to manage cookie preferences, the consent banner and cookie declarations.

statistical analysis, advertising and campaign measurement service providers, activated only to the extent consent is required;
payment and subscription management service providers, where activated;
consultants, professionals, accountants, lawyers and parties providing administrative, tax, legal or technical assistance;
public authorities, bodies, supervisory authorities or other parties legally entitled to receive data pursuant to legal obligations or orders issued by competent authorities.

Personal data is not disclosed to the public, unless required by law or based on a specific request or authorization from the Data Subject.

Declared Main Providers

Aruba Business — hosting, infrastructure and technical services for the website and/or Platform.
CookieScript — management of cookie preferences, consent banner and cookie declaration.
Brevo (Sendinblue SAS) — newsletter subscription management and delivery, where used. For further information: Brevo Privacy Policy.
Google (Google Ireland Limited / Google LLC) — any statistical analysis, measurement and advertising campaign services, such as Google Analytics 4 and Google Ads, activated with prior consent where required.
Stripe — payment and subscription management, if used.

The Data Controller invites Data Subjects to consult the privacy policies of the respective providers for further information concerning processing carried out directly by such providers.

8. Transfer of Data Outside the European Economic Area

Some providers used by the Data Controller may process personal data outside the European Economic Area (“EEA”).

In such cases, transfers shall take place in compliance with the safeguards provided for by the GDPR, such as European Commission adequacy decisions, Standard Contractual Clauses adopted by the European Commission, supplementary protective measures or other safeguards provided for by applicable law.

Further information concerning international transfers may be requested by writing to [servizioclienti@ziblo.it](mailto:servizioclienti@ziblo.it) or by consulting the privacy policies of the providers involved.

9. Data Retention Period

Personal data is retained for the period strictly necessary for the purposes for which it was collected, except for longer periods required or permitted by law.

In particular:

Account and Service data: for the duration of the contractual relationship and thereafter for the period necessary to handle requests, disputes, legal obligations, fraud prevention, protection of the Data Controller’s rights and backup procedures.
Support or contact request data: for the time necessary to handle the request and, where necessary, for a subsequent period useful for documenting the communication or protecting the Data Controller’s rights.
Billing and accounting data: for the period required by applicable tax and civil laws, generally up to 10 years.
Data processed for newsletters and promotional communications: until consent is withdrawn, the User unsubscribes or requests deletion, except where minimum information needs to be retained to document the withdrawal.
Data relating to cookies and tracking technologies: according to the periods and methods indicated in the Cookie Policy and in the preferences selected by the Data Subject.
End Customer data entered by restaurant operators: according to the instructions of the restaurant operator acting as Data Controller, the duration of the contractual relationship with the restaurant operator, legal obligations and the provisions of any applicable data processing agreement.

10. Data Subject Rights

The Data Subject may exercise, where provided for by applicable law, the rights set out in Articles 15–22 of the GDPR.

In particular, the Data Subject may request:

access to their personal data;
rectification of inaccurate data or completion of incomplete data;
erasure of personal data, where provided for by law;
restriction of processing, where provided for by law;
data portability, where applicable;
objection to processing based on the legitimate interest of the Data Controller;
withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
not to be subject to a decision based solely on automated processing, including profiling, where provided for by law.

To exercise their rights, the Data Subject may send a request to servizioclienti@ziblo.it.

Where data has been entered into Ziblo by a restaurant operator as part of the management of reservations, guests, events or other Business services, the Data Subject is invited to contact the restaurant operator first, as the Data Controller. Ziblo will cooperate with the restaurant operator within the limits provided by applicable law and the agreements in place.

The Data Subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), available at http://www.garanteprivacy.it, if they believe that the processing of their personal data violates applicable law.

11. Mandatory or Optional Nature of Data Provision

Providing the data necessary for registration, Account management, provision of the Service, billing and compliance with legal obligations is necessary to use Ziblo or specific Platform features.

Refusal to provide such data may make it impossible to create an Account, use the Service or access certain features.

Providing data for newsletters, promotional communications, non-essential cookies and other purposes based on consent is optional. Failure to provide or withdrawal of consent does not affect the use of the Service’s essential features, except where a specific feature strictly depends on the relevant processing.

12. Cookies

The Service uses cookies and similar technologies. Detailed information concerning cookie types, purposes, duration, third parties involved and methods for managing consent is available in the Cookie Policy.

Preferences concerning non-essential cookies may be modified or withdrawn at any time through the “Cookie Settings”, “Manage Preferences” command or another equivalent link available on the website, in the application or in the Cookie Policy.

13. Amendments to this Privacy Policy

The Data Controller may update this Privacy Policy at any time, in particular to reflect changes in applicable law, organizational or technical changes or changes to the services offered.

Changes will be published on this page with the date of the latest update. Where required by law or where the change is material, the Data Controller may also notify Users by email, through an Account notification or by another appropriate means.

14. Contact

For any questions concerning this Privacy Policy, the processing of personal data or the exercise of rights under applicable law, the Data Controller may be contacted at:

servizioclienti@ziblo.it