Privacy policy

We have not appointed a data protection officer because this is not required for our activities.

a) Contact form

Data: name, email address, phone number and message content.

Purpose: responding to your enquiry.

Legal basis: legitimate interests (Article 6(1)(f) GDPR) or taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).

Retention: 12 months after the correspondence has ended.

b) Phone orders

We use the information you provide by phone (name, phone number and order details) solely to prepare your order and arrange collection. We do not record phone calls.

We do not retain order details for longer than necessary to fulfil the order, except for information on invoices, which we retain in accordance with tax law (10 years).

c) Hosting and consent management with Cloudflare Zaraz

Cloudflare provides access to our website and protects it against misuse. In doing so, it processes information including your IP address, the requested URL, access time, browser details and technical connection data. The legal basis is our legitimate interest in secure and reliable operation (Article 6(1)(f) GDPR). Technical logs are required only for as long as necessary to provide the service, resolve errors and prevent or investigate security incidents.

We manage Google Analytics 4 and Microsoft Clarity through Cloudflare Zaraz. Zaraz processes technical access data, usage events and your consent choice; it may forward data to those providers through Cloudflare. Clarity also loads a Microsoft script in your browser. Using Zaraz therefore does not, in itself, prevent personal data from being transferred.

The zaraz-consent cookie stores your choice. Managing and respecting consent serves to fulfil our data protection obligations (Article 6(1)(c) GDPR).

d) Google Analytics 4

We use Google Analytics 4 to analyse page views, traffic sources and interactions. The data processed includes visited URLs, referring pages, access times, browser and device information, and pseudonymous visitor and session identifiers. Cookies or similar identifiers can link multiple visits.

Legal basis: your freely given consent (Article 6(1)(a) GDPR and, for access to your device, Article 225 ZEKom-2). In Zaraz, the tool belongs to the “Statistics and analytics” category and is activated only after consent. You can use the website without giving consent.

Our Zaraz configuration disables forwarding your original IP address to Google. This does not automatically make other usage data anonymous. The Zaraz feature for Google advertising audiences is disabled.

Retention: user and event data is subject to GA4's unchanged default retention period of two months, after which it is automatically deleted. New activity may restart the retention period for user identifiers. This period does not apply to aggregated statistical reports. Withdrawing consent stops future collection based on consent but does not automatically delete data already stored. Please send deletion requests to pizzanai.pibox@gmail.com.

e) Microsoft Clarity

Clarity helps us identify usability problems and improve the website. It captures page views, clicks, scrolling, mouse movements, technical device and browser information, IP addresses and pseudonymous identifiers. This data is used to create heatmaps and reconstructed session recordings (session replays). This does not involve camera or audio recording.

Legal basis: your freely given consent (Article 6(1)(a) GDPR and Article 225 ZEKom-2). Clarity is loaded only after you consent to “Statistics and analytics”. Our integration communicates consent for analytics to Microsoft, but not for advertising. According to Microsoft, input fields are masked; other visible content may be included in recordings.

Microsoft also processes data as an independent controller under its own privacy statement, including to provide, secure and improve its products. Processing is therefore not exclusively carried out on our behalf.

Retention: Microsoft states that ordinary session recordings are retained for 30 days. Tagged or favourited sessions, heatmaps and click data are retained for nine months.

f) Fathom Analytics

Fathom Analytics is used for statistical analysis of page views and selected interactions, such as clicks on phone links or the menu. The service does not use analytics cookies. It nevertheless receives technical data such as the IP address and browser identifier, as well as the page address, traffic source, device information and event name.

According to Fathom, it creates a site-specific identifier using a random value that changes daily. This allows page views within a day to be linked; a persistent visitor identifier for tracking across websites is not intended. The daily change does not automatically delete stored events. We receive statistical analyses.

Legal basis: our legitimate interest in measuring traffic with the minimum necessary data and improving the website (Article 6(1)(f) GDPR), insofar as there is no access to the device that requires consent. You may object to processing on this basis on grounds relating to your particular situation.

International processing may involve transfers, particularly to the USA and Canada. For covered recipients in the USA, the adequacy decision for the EU–US Data Privacy Framework may apply if they hold the relevant certification; otherwise, appropriate safeguards are required, such as EU standard contractual clauses. The decision for Canada applies only to covered commercial organisations. You can request information and copies of the relevant safeguards at pizzanai.pibox@gmail.com.