Your data, explained clearly.

This privacy policy applies to the website incanto-olten.ch, in German, English and Italian. The party responsible under Swiss data protection law for the processing described here is:

• Giovanni Carrieri, trading as a sole proprietorship under the name Incanto
• Marktgasse 32, 4600 Olten, Switzerland
• Phone: +41 76 514 07 72
• Email: incanto.olten@gmx.ch

This policy is written under the Swiss Federal Act on Data Protection (FADP), in force in its revised form since 1 September 2023. If you are reading this from the European Union or the European Economic Area, the protections described below are, in substance, equivalent to what the General Data Protection Regulation (GDPR) would give you for the same processing.

It covers the public website at incanto-olten.ch, including its reservation form, and the restricted administration area our staff use to manage the menus, opening hours and takeaway discounts shown on it. The takeaway page is for information only: there is no online ordering, and it collects nothing from you. It does not cover WhatsApp, your email provider, Google Maps, Instagram or Facebook: each of those is a separate service with its own privacy policy, and this document only describes what happens up to the point a link on this site hands you over to one of them.

Like any website, this one is served by infrastructure that automatically processes technical connection data for every request it receives: your IP address, the date and time of the request, the page requested, the browser and device type, and the page you arrived from. This is handled by our hosting provider, Vercel Inc. (see section 9), for the sole purposes of delivering the pages you ask for, keeping the service running and protecting it against abuse. We do not otherwise collect this data ourselves, do not combine it with any other information, and do not use it to identify individual visitors.

To know how many people visit this site and which pages are read, we use Vercel Web Analytics, the statistics service of the same hosting provider. It sets no cookie and stores nothing in your browser: each visit is counted against a short-lived identifier that Vercel computes from the technical details of the request, which changes every day and cannot be traced back to you. What reaches us is only the aggregate: how many visits there were, which pages were read most, which country they came from and what kind of device was used. No profile, no recognition across other websites, no advertising.

If your browser reports that our Content-Security-Policy has blocked something it should not have, a short technical note is written to our application log: which rule was involved, the origin that was blocked, and the path of the page it happened on. No cookie, IP address or other visitor identifier is included in that note by us.

This website sets exactly one cookie, named incanto-locale. It remembers which of the three languages you are reading in, so that an address without a language prefix (such as incanto-olten.ch/menu) shows you that language again on your next visit instead of guessing from your browser settings every time. It expires after one year, is read only by this website, and is never sent to any third party.

Because this cookie stores nothing beyond a language preference and is not used for tracking, profiling or advertising, Swiss law does not require your prior consent before it is set. You can delete it at any time through your browser’s settings; the site continues to work exactly as before, and simply falls back to reading your browser’s own language setting until you choose again.

This is the only cookie this website sets for visitors. The visitor statistics described in section 3 work without one. There is no advertising network, no social-media tracking pixel and no third-party cookie of any kind on the public pages of this site.

When you press “Send request”, the form sends what you entered to our server: your name, phone number, email address, the date, time and number of guests, any note you add, and the language you are reading in. Until that moment everything stays in your own browser, and if you close the page beforehand, nothing has left your device.

The server checks the request against the same rules as the form and turns it into two emails, sent through our email delivery provider, Brevo (see section 9). The first goes to our inbox at incanto.olten@gmx.ch: that is the one we answer, and our answer reaches you directly. The second goes to you, at the address you gave, as a summary of what you asked for. The server does not keep the request: there is no database of bookings. From then on we handle it like any other correspondence, as explained in section 6.

We ask only for what we need to handle your request and reply to you: your name, phone number and email address; the note is optional. There is no box to tick: handling a booking you ask us for needs no consent, and the sentence next to the button only points you to this policy.

If the request cannot be sent, the form offers to let you call us or send the same request from your own email program. In that case your message is an ordinary email, handled under your email provider’s own terms, and it reaches the same inbox.

A party of more than twenty is asked to call us directly instead of using the form; that call is covered by section 6.

If you call, WhatsApp, email or write to us, whether or not you used the form to start the conversation, we process what you send us (typically your name, contact details and the content of your message) to reply to you and, where relevant, to organise your reservation. We keep that correspondence only for as long as we reasonably need it to do so; once your visit is over, we do not keep it further unless you get in touch with us again, ask us to keep it, or a document arising from it, an invoice for instance, must be kept under Swiss commercial-law retention rules (ten years, under Article 958f of the Swiss Code of Obligations).

The Instagram account linked from this site (@incanto.olten) and our Facebook page are operated by us but hosted by Meta Platforms Ireland Limited. If you message us or comment through Instagram or Facebook, that exchange is additionally governed by Meta’s own privacy policy.

The pages under /admin let two named members of our staff manage the PDF menus, the opening hours and the takeaway discounts shown on this site. That content is kept in private storage at our hosting provider, Vercel, and contains no personal data. Signing in there is protected by an account system operated by our authentication provider, Supabase Inc., which sets a session cookie in the browser of whoever signs in. This area, and the account data behind it, is not accessible to and does not process any data about ordinary visitors to the public site.

The typefaces used across this site are downloaded once when the site is built and are then served from incanto-olten.ch itself. Reading this site never causes a request to Google’s font servers, and no data about you reaches Google through them.

The same goes for the country flags next to the phone field on the reservation form: they are served from incanto-olten.ch itself, so opening that field sends nothing to a third party. The flag graphics come from the Twemoji project (© Twitter, Inc. and contributors, licensed under CC-BY 4.0).

Links to Google Maps, our Instagram profile and our Facebook page open those services in a new tab only if you choose to click them; visiting this site does not itself send anything to Google or Meta.

We use a small number of providers to run this site and, in doing so, we may share technical data and, for bookings, the details of the request with them under the roles described here. None of them is permitted to use what they process on our behalf for their own purposes.

• Vercel Inc.: hosts this website, serves every page, processes the technical connection data described in section 3, produces the cookieless visitor statistics described there, and runs the server that receives reservation requests (section 5) without storing them.
• Supabase Inc.: runs the sign-in to the administration area (section 7) and processes only our staff members’ accounts for it, never data about visitors.
• Brevo (Sendinblue SAS, Paris, France): sends the two emails for each reservation request (section 5). To do so it processes the details of the request and keeps a log of what was sent (sender, recipient, subject, delivery status) for the shortest period the service allows. The email to the restaurant is plain text. The summary you receive is formatted (HTML): Brevo adds a pixel to it and routes its links through its own servers to count opens and clicks, but we have set it up to count them only anonymously and in aggregate, without linking them to your address. The logo and typefaces in that email are loaded from our own website.
• GMX: provides our mailbox at incanto.olten@gmx.ch, where reservation requests and your correspondence with us arrive.
• WhatsApp Ireland Limited (Meta): if you choose to message us via WhatsApp, WhatsApp acts as an independent controller of that message once it reaches its systems.
• Your own email or telecommunications provider: if you choose to email or call us, they carry that communication under their own terms.

We do not sell your data, and we do not share it with anyone for advertising or marketing purposes.

Some of the providers listed in section 9, in particular Vercel and Meta, are established, or operate infrastructure, outside Switzerland and the European Economic Area, including in the United States. Where that is the case, they are contractually bound to protect your data to a level recognised as adequate under Swiss law: through a mechanism such as the Swiss-U.S. Data Privacy Framework, standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner, or another safeguard permitted under Article 16 of the FADP.

Brevo and GMX process data in the European Union, whose member states Switzerland recognises as providing adequate data protection. Some of Brevo’s sub-processors are established in the United States; the contractual safeguards just described, provided for in Brevo’s data processing agreement, apply to them.

Under Swiss law, we do not need a separate legal basis for each processing operation in the way the GDPR requires, but we are bound by law to process your data lawfully, proportionately, for the purpose we have told you about, and no longer than that purpose requires. In practice: we process a reservation request, and any correspondence around it, to organise your visit and reply to you, and send you a summary so you have a record of what you asked for, we process technical connection data to keep the site running and secure, and we set the language cookie because you asked us to remember your choice.

Correspondence about a specific reservation is kept only as long as needed to arrange and complete it, plus a reasonable period afterwards in case a question comes up; our server does not keep reservation requests, and the delivery log stays with Brevo for the shortest period the service allows; the language cookie expires after one year as described in section 4; technical connection data is kept by our hosting provider for a limited period in line with its own operational retention practice; and any document that becomes part of our accounting records, an invoice for instance, is kept for ten years under Article 958f of the Swiss Code of Obligations.

Every page on this site is served over an encrypted connection (HTTPS), and browsers are instructed to insist on one for two years through the Strict-Transport-Security header. A Content-Security-Policy restricts which sources of code and content a page is allowed to load from, precisely to reduce the damage an injected script could otherwise do. The reservation form sends your details only over that encrypted connection. The server that receives them accepts requests only from this site’s own pages, checks them against the same rules as the form and passes them on by email without storing them, so there is no database of past requests that could be exposed, and neither your name nor your contact details end up in the server’s logs.

The administration area is protected by individual staff accounts, and the PDF menus it manages are stored in a private cloud storage bucket that is not directly reachable from the internet; every download is served through this site’s own server.

Under the Federal Act on Data Protection, you have the right to ask us: whether we process data about you, and if so what data and for what purpose (right of access); to have inaccurate data corrected (right to rectification); to have your data deleted or to object to its processing, subject to any retention we are legally required to observe (right to erasure and to object); and, where the processing is automated and based on your consent or on a contract with you, to receive the data you gave us in a common electronic format (right to data portability).

To exercise any of these rights, reach us through the contact details in section 1 or in section 16. We will need enough information to be reasonably sure we are speaking to the right person before we act on your request, and we will respond within the time the law allows.

If you believe we have not handled your data lawfully, you can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland (www.edoeb.admin.ch) or, if the GDPR applies to you, with the data protection authority of the EU member state where you live or work.

This site is a restaurant’s booking page, not a service aimed at children. We do not knowingly collect data from minors beyond what a parent or guardian submits on their behalf when booking a table for a family, and such data is used solely for that reservation.

We may update this policy if the way this site works changes, or if the law requires it. The date at the top of this page is the date it was last substantively revised; a change to that date is the only notice you will receive, so we encourage you to check back here if you have concerns.

For any question about this policy or about your data, write to Giovanni Carrieri at incanto.olten@gmx.ch or call +41 76 514 07 72.