Privacy Policy

Last updated: November 2026

This Privacy Policy explains how GiaoGiao Market ("we", "us") collects and processes your personal data when you use our website and loyalty programme, in accordance with the EU General Data Protection Regulation 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended.

1. Data we collect

• Identity & contact: name, email address, phone number (optional: used for WhatsApp order updates and, if you ask for it, the WhatsApp flyer).
• Account credentials: a password, stored only in encrypted (hashed) form, and one-time email verification codes.
• Orders: items reserved, pickup date/time, order notes, and order history.
• Loyalty data: points balance, membership tier, coupons and rewards (including task rewards), and any votes you cast in the past.
• Marketing preference: whether you have consented to promotional communications.
• WhatsApp flyer: if you sign up, your WhatsApp number, WhatsApp profile name, and the date and ID of the message you signed up or unsubscribed with.
• Wallet card (optional): if you choose to add your member card to Apple Wallet or Google Wallet, your name, card code, joining date and, where shown, points balance are saved in the Wallet on your phone and processed by Apple or Google under their respective privacy policies. With Apple Wallet your phone also sends us a device identifier and a notification token: we use them only to update the card and delete them when the Wallet tells us the card has been removed. You can remove the card from the Wallet at any time.
• Technical data: IP address, browser type, device and approximate location, and pages viewed (collected only with your consent — see Section 4).

We do not knowingly collect special categories of data (e.g. health, religion). Online card payment is not currently offered; orders are paid in store on pickup, so we do not store card numbers.

2. How we use your data and legal basis

2.1 Monthly flyer on WhatsApp

After your receipt we may print a slip with a QR code that opens WhatsApp with the message «VOLANTINO» already typed. By sending «VOLANTINO» to our WhatsApp number +39 055 098 1527, or by ticking the flyer box when you join as a member, you agree to receive the GiaoGiao Market flyer and offers from us on WhatsApp, about once a month. You do not need to be a member, and it is not a condition of purchase.

• What we record: your WhatsApp number, WhatsApp profile name, and the date and ID of the message you signed up or unsubscribed with. If the number belongs to a member, the sign-up is also linked to the member profile.
• Automatic reply: we answer «VOLANTINO» straight away with this week's offers and, if you are not a member yet, an invitation to join the members' programme.
• How to unsubscribe: reply STOP at any time, free of charge; you will only get a confirmation message. Members can also switch it off at giaogiaomarket.com/volantino. STOP ends the flyer and also withdraws consent to our other promotional messages; order updates continue.
• Who sees the messages: +39 055 098 1527 is shared with the GiaoGiao restaurants, run by the same data controller (Fortune Nature S.R.L.), so the messages you send to it are visible to the staff who run that chat. Messages go through Twilio (WhatsApp Business platform) and WhatsApp (Meta), with the safeguards described in Section 5.

3. Who we share your data with

We do not sell your personal data. We share it only with service providers acting as data processors on our behalf, and only as needed:

• Hosting: our website and database are hosted on servers in the European Union (Frankfurt region).
• Google Analytics: Google Ireland Ltd., for anonymised website statistics (only with your consent).
• Google Ads: Google Ireland Ltd., to measure which of our ads lead to an order (only with your consent).
• Messaging & email: our email providers and, for WhatsApp, Twilio and WhatsApp (Meta), used to send verification codes, order updates and, if you ask for it, the monthly flyer.
• Authorities: public authorities where required by law.

If you order through Deliveroo or Glovo, those platforms act as independent data controllers under their own privacy policies.

4. Cookies and analytics

4.1 Essential cookies

We use strictly necessary cookies/local storage to run the site (e.g. session, cart, language and consent preferences). These do not require consent (Art. 122(1), Legislative Decree 196/2003).

4.2 Analytics cookies (Google Analytics 4)

With your explicit consent we use Google Analytics 4 (measurement ID G-SMLJG1P2EE) with IP anonymisation enabled. Data may be transferred to the United States under the EU–US Data Privacy Framework. The Google tag is present on every page but starts with consent denied (Google Consent Mode v2): analytics activate only after you accept via the cookie banner, and until then no analytics cookie is written and no analytics data is collected. Choosing "Essential only" collects no analytics. You can withdraw consent at any time by clearing your browser cookies. See Google's privacy policy.

4.3 Ad measurement cookies (Google Ads)

With your consent we use the Google Ads conversion tag (ID AW-17992083667) to know which of our Google ads lead to an order. When an order is confirmed, Google receives the order number and amount: it does not receive your name, phone or email, and we do not use this data to show you personalised ads. The tag starts with consent denied (Google Consent Mode v2) and, if you choose "Essential only", no advertising cookie is written. Data may be transferred to the United States under the EU–US Data Privacy Framework. Until 1 October 2026 the banner only asked for consent to analytics cookies: anyone who accepted back then is asked again. You can withdraw consent at any time by clearing your browser cookies.

5. International data transfers

Your data is primarily stored within the European Economic Area. Where a provider transfers data outside the EEA (e.g. Google), the transfer is protected by an adequacy decision and/or Standard Contractual Clauses.

6. How long we keep your data

• Account data: until you delete your account.
• Order/transaction records: 10 years (Italian tax law, Art. 2220 Civil Code).
• Marketing data: until you withdraw consent.
• WhatsApp flyer: until you reply STOP. After that we keep only your number and the sign-up and unsubscribe dates, so that we do not message you again and can show that you consented; you can ask us to delete them at giaogiaomarket@gmail.com.
• Technical logs: up to 12 months.
• Analytics: up to 14 months.
• Advertising cookies (Google Ads): 90 days.

7. Your rights

Under Articles 15–22 GDPR you have the right to access, rectify, erase ("right to be forgotten"), restrict and object to processing, to data portability, and to withdraw consent at any time without affecting prior lawful processing. To exercise these rights, email giaogiaomarket@gmail.com; we respond within 30 days.

You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la Protezione dei Dati Personali — Piazza Venezia 11, 00187 Roma — garanteprivacy.it.

8. Children

The service is intended for users aged 14 or over (Art. 8 GDPR; Italian Legislative Decree 101/2018). Users under 14 require the consent of a parent or legal guardian.

9. Security

We apply appropriate technical and organisational measures, including TLS/SSL encryption in transit, hashed passwords and access controls. No method of transmission or storage is 100% secure, but we review our measures regularly.

10. Changes to this policy

We may update this policy to reflect changes in the law or our practices. Material changes will be announced on the site or by email. The "last updated" date above always reflects the current version.

11. Contact

Fortune Nature S.R.L. — P.IVA 02487680973 — Via dei Servi 35R, Firenze — giaogiaomarket@gmail.com