privacy & cookies
This page explains, in plain words, which personal data we handle, why and for how long. It applies to everyone: website visitors, guests and people who book, job applicants and suppliers. The Italian version is the reference text.
Who we are · Website & cookies · Guests & bookings · Job applicants · Suppliers · Your rights
Who handles your data
Data controller: Ripieno S.r.l. · sede legale Via San Gregorio 40, 20124 Milano · P.IVA 11549070966, the company running Mastro Tortello (Via Carlo Tenca 15, 20124 Milano) and the other Mastro venues.
Privacy contact: info@mastrotortello.com. We have not appointed a Data Protection Officer, as it is not required for our business.
Rules that always apply
- We only process the data we need, with secure tools and only through authorised Mastro staff.
- We never sell or publish your data, and we make no automated decisions about you: a person always reads and decides.
- Some providers help us and act as data processors: website hosting (Aruba, Italy), email and documents (Google, Aruba), our payroll consultant and accountant. Some (e.g. Google) may process data outside the EU, with the safeguards required by the GDPR (adequacy decisions or standard contractual clauses).
- The external services we link to (Book with Google, Google Maps, Instagram, Facebook, TripAdvisor, job sites such as Indeed and Subito) are independent controllers of the data you leave with them and have their own privacy notices.
Website visitors
Browsing data. The server hosting this site automatically logs some technical data (IP address, page requested, browser, date and time) to run the site and protect it from abuse. Legal basis: our legitimate interest (Art. 6.1.f GDPR). The hosting provider deletes these logs on its own technical schedule, usually within a few months.
Guests, bookings, orders and events
- Bookings: name, phone, party size, date and any notes you leave (also via Book with Google) are used to manage your table. Basis: doing what you ask us (Art. 6.1.b). Kept for 12 months at most.
- Allergies and intolerances: if you tell us, we use them only to prepare your dish safely and do not record them beyond your visit.
- Orders, events, catering and food truck: contact and invoicing details, to handle the order (Art. 6.1.b) and meet tax obligations (Art. 6.1.c). Invoices are kept for 10 years, as required by law.
- Email, phone and social media messages: used only to reply to you and deleted when no longer needed.
Job applicants
Which data. What you send us: name, contact details, area, CV, experience, availability, driving licence, certificates (e.g. food hygiene, safety). Or, if we found you, only what you published in your ad or profile on a job site (title, area, description, date and link), or the name and contact given to us by a team member who referred you. We do not ask about health, religion, political or trade-union views: if they are in your CV, we do not use them. Your CV may have no photo.
| Why | Legal basis |
|---|---|
| Assessing your application, contacting you, arranging interviews and trial shifts | Pre-contractual steps you asked for (Art. 6.1.b) |
| Writing to you for the first time after reading your public "looking for work" ad | Our legitimate interest in hiring, consistent with you publishing the ad (Art. 6.1.f) |
| Keeping you on file for future roles beyond the periods below | Your consent (Art. 6.1.a), which you can withdraw at any time |
| Paying the bonus to whoever referred you, if you are hired | Legitimate interest and our referral scheme rules |
How long. If you do not reply to our first message, we delete your data within 6 months. If the selection ends without hiring, within 12 months, or up to 24 months if you agree to stay on file. If you are hired, your data moves to your staff file and the employee privacy notice applies.
Who sees it. The Mastro staff in charge of hiring (owners and venue managers), the providers listed above, the job sites you or we wrote from, and our payroll consultant if you are hired.
Do you have to give it? No, but without a contact and some information about your experience we cannot assess your application.
Suppliers and partners
We process the contact details of people working for our suppliers and partners only to handle orders, contracts, payments and tax obligations (Art. 6.1.b and 6.1.c), for the length of the relationship and then for the periods required by law.
Your rights
At any time you can ask to see your data, correct it, delete it, restrict its use, receive a copy, object to processing based on legitimate interest and withdraw any consent you gave. Write to info@mastrotortello.com: we reply within 30 days. You can also complain to the Italian Data Protection Authority (garanteprivacy.it).
Last updated: 11 November 2026. If we change anything important, we will say so here.