Privacy policy

Last updated: 11 November 2026

This notice, provided under Article 13 of Regulation (EU) 2016/679 (GDPR), explains how personal data is processed when you browse the Sina Hotpot website and make reservation or contact requests.

1. Data controller and contacts

The controller is RISTORANTE SINA HOTPOT S.R.L., with registered office at Via Cava 109, 59100 Prato (PO), Italy. VAT / tax code / Pistoia-Prato Companies Register number: 02455830972. For personal data enquiries: sinahotpot@gmail.com.

Location contacts: Prato +39 348 032 8697; Florence +39 344 681 3199.

2. Data processed and how the form works

The reservation form uses your name, party size, date, time and location to prepare a request. Mobile number, email address, occasion and organisational notes are optional. If you provide contact details, the restaurant can use them to respond to your request. When you contact us separately through WhatsApp or email, we may also receive the contact details associated with that channel, your message and subsequent communications.

Submitting the form sends your entries through Shopify’s contact service for email notification to the restaurant. It does not open or send from your own email account. WhatsApp is an additional contact option: opening a prepared message may disclose the message parameters to WhatsApp, and the restaurant receives that WhatsApp message only when you send it yourself. A submitted request is confirmed as a booking only after the restaurant accepts it.

Shopify and technical services may process IP addresses, device and browser information, website requests, usage data and identifiers, subject to the features in use and your cookie choices.

3. Purposes and legal bases

• Managing reservations and responding to requests: steps prior to a contract or performance of the requested service, GDPR Article 6(1)(b).
• Keeping the website available and secure and preventing abuse: legitimate interests in operating and protecting our services, GDPR Article 6(1)(f).
• Meeting applicable administrative or legal duties: GDPR Article 6(1)(c).
• Optional features, non-essential analytics and personalised advertising: consent where required, GDPR Article 6(1)(a) and Article 122 of the Italian Privacy Code. Refusing or withdrawing consent does not affect your ability to request a reservation.

4. Required information and health data

Required form fields are needed to prepare a usable request; without them, we may be unable to handle it. Mobile number, email address, notes and occasion are optional. Providing at least one contact method helps the restaurant reply. Sending a request is not treated as consent to promotional communications.

Do not enter allergies, intolerances, diagnoses or other health information in the form. Contact the location directly about dietary or safety requirements. If recording health data is necessary to arrange the service, we will provide the relevant information and request separate, specific and explicit consent under GDPR Article 9(2)(a); the data will be used only for that requirement and for the time needed to provide the service.

5. Recipients and Shopify’s role

Data may be processed by authorised staff and providers needed to operate the website and communications, including Shopify and its technical providers. Shopify International Limited, Ireland, is involved in processing European customer data. For features provided on our behalf, Shopify acts as a processor under its data processing agreement.

Shopify Network Intelligence is enabled. For these enhanced services, Shopify also processes data as an independent controller: it combines information about interactions with our website with information from other stores and its own services to provide, develop and improve analytics, performance, personalisation and advertising services. Other merchants cannot access your data. Non-essential processing and targeted advertising require consent where applicable; you can manage it in cookie preferences.

For these activities, see the Shopify Consumer Privacy Policy. You can also exercise rights relating to Shopify’s processing through its privacy portal.

WhatsApp, TheFork, Instagram, Facebook, email services and Google Maps process data under their own notices when you use their links or services. Embedded maps load only after a separate, explicit choice; until then, you can read the addresses without loading a map.

6. International transfers

Storage in Europe does not exclude processing or access from outside the European Economic Area. Shopify and other providers may make such transfers under applicable safeguards: adequacy decisions, Shopify’s Binding Corporate Rules for the transfers they cover and standard contractual clauses, with additional measures where needed. Contact us for information about the safeguards used and how to obtain a copy.

Current details: Shopify Data Processing Addendum and Shopify Binding Corporate Rules.

7. Retention

Ordinary reservation requests and related communications are kept for the time needed to handle them and normally no longer than 12 months from the request. Longer retention may be necessary for legal duties, security or the establishment, exercise or defence of legal claims. Administrative records are retained for the periods required by applicable law.

Technical data retention depends on its function and provider; cookie durations and local preference storage are described in the Cookie policy. Data processed by Shopify as an independent controller follows the criteria in its policy. Health data, if collected directly for the service, is not subject to the ordinary 12-month period: we limit its retention to the specific requirement, unless another relevant legal basis applies.

8. Rights and complaints

Subject to the GDPR, you may request access, correction, deletion, restriction and portability, object to processing based on legitimate interests and withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully. Manage cookies in preferences; send other requests to sinahotpot@gmail.com.

We respond without undue delay, normally within one month. If the complexity or number of requests requires an extension, we will inform you within the first month and explain why; the extension may be up to two further months. You may complain to the Italian Garante per la protezione dei dati personali or another competent supervisory authority.

9. Automated decisions and updates

We do not make decisions on reservation requests based solely on automated processing that produce legal or similarly significant effects. Shopify’s analytics and personalisation activities are described above and in its policy. Changes to this notice will be published with a revised update date.