Privacy Notice

1.1 Napoli Napoli Supper Club, founded and operated by Giordana Attilio in the Emirate of Dubai, United Arab Emirates, is the controller of the personal data described in this notice and determines the purposes and means of its processing.

1.2 This notice describes the processing of personal data of guests, enquirers, correspondents and members of the Napoli Napoli Community. It forms part of the Agreement and is to be read together with the Terms and Conditions.

1.3 The Host processes personal data in accordance with applicable United Arab Emirates law, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its implementing regulations, as amended from time to time.

2.1 Booking and enquiry data: name, email address, telephone number, the Experience booked, the number of guests, the amount paid, a payment reference, and correspondence with the Host.

2.2 Dietary and allergen data: information disclosed by the Guest about allergies, intolerances and dietary requirements. The Guest acknowledges that such information may constitute sensitive personal data and, by disclosing it, consents to its processing for the purposes set out in clause 3 and to its disclosure to those preparing and serving the Experience.

2.3 Community data, where the Guest chooses to join: profile name, photograph, biography, social handles, visibility preference, group memberships and messages sent within the Community.

2.4 Technical data necessarily generated by the operation of the website and its hosting.

2.5 Payment card details are never transmitted to, received by or stored by the Host. They are processed exclusively by the payment services provider.

3.1 To perform the contract: to confirm and administer bookings, to prepare and serve Experiences safely in light of disclosed dietary information, to communicate about a booking, and to process payment, credit notes and refunds.

3.2 To comply with legal obligations, including accounting, tax and food-safety record-keeping.

3.3 For the Host's legitimate interests in operating, securing and improving its business, maintaining records of what was booked and paid, preventing fraud and abuse, and establishing, exercising or defending legal claims.

3.4 On the basis of consent, where consent has been given: participation in the Napoli Napoli Community, the visibility preference chosen within it, and any optional marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

3.5 The Host does not sell personal data. The Host does not add a person to a marketing list by reason only of their having made a booking.

4.1 Personal data is disclosed to those persons within the Host's operation who require it to perform their duties, and to service providers acting as processors on the Host's documented instructions, comprising its website hosting provider, its database provider, its payment services provider and its transactional email provider.

4.2 Each processor receives only such data as is necessary for its function and is bound by contractual obligations of confidentiality and security.

4.3 Personal data may be disclosed where required by law, by a competent authority or by an order of a court, or where necessary to establish, exercise or defend legal claims.

5.1 Certain processors operate infrastructure outside the United Arab Emirates. Where personal data is transferred outside the United Arab Emirates, the Host takes reasonable steps to ensure that the transfer is made in accordance with applicable law and that an appropriate level of protection is maintained by contract.

6.1 Booking and payment records are retained for the period required by applicable accounting, tax and limitation law, and thereafter deleted or anonymised.

6.2 Dietary and allergen data is retained for so long as it is required to serve the Guest safely and to evidence what was disclosed, and thereafter deleted or anonymised.

6.3 Community data is retained for so long as the account remains open and is deleted, subject to clause 6.1, on closure of the account. Messages sent within a group remain visible to that group.

6.4 Enquiries and correspondence are retained for so long as necessary to deal with the matter and to keep a record of it.

7.1 Subject to applicable law and to any exemption available under it, a data subject has the right to request access to their personal data, its correction, its erasure, the restriction of its processing, the portability of data provided by them, and to object to processing carried out on the basis of legitimate interests, and to withdraw consent where processing is based on consent.

7.2 Requests should be made in writing to the Host's published email address. The Host will respond within the period prescribed by applicable law. The Host may require reasonable verification of identity before acting on a request.

7.3 The exercise of the right of erasure does not extend to records the Host is required or entitled to retain under clause 6.1, or which are necessary to establish, exercise or defend legal claims.

7.4 A data subject who is not satisfied with the Host's response may complain to the competent supervisory authority in the United Arab Emirates.

8.1 The Host maintains technical and organisational measures appropriate to the nature of the data and the risk, including access control, encryption in transit, and the use of reputable service providers.

8.2 No method of transmission or storage is entirely secure. Subject to clause 11.1 of the Terms and Conditions, and to the maximum extent permitted by applicable law, the Host does not warrant absolute security and shall not be liable for any unauthorised access, disclosure or loss occurring despite the measures described in clause 8.1.

9.1 This notice may be amended from time to time. The version in force at the date a booking is confirmed applies to that booking and is recorded against it.