Your data, explained clearly.

This privacy policy applies to the website incanto-olten.ch, in German, English and Italian. The party responsible under Swiss data protection law for the processing described here is:

• Giovanni Carrieri, trading as a sole proprietorship under the name Incanto
• Marktgasse 32, 4600 Olten, Switzerland
• Phone: +41 76 514 07 72
• Email: incanto.olten@gmx.ch

This policy is written under the Swiss Federal Act on Data Protection (FADP), in force in its revised form since 1 September 2023. If you are reading this from the European Union or the European Economic Area, the protections described below are, in substance, equivalent to what the General Data Protection Regulation (GDPR) would give you for the same processing.

It covers the public website at incanto-olten.ch, including its reservation form, and the restricted administration area our staff use to manage the menus shown on it. It does not cover WhatsApp, your email provider, Google Maps, Instagram or Facebook: each of those is a separate service with its own privacy policy, and this document only describes what happens up to the point a link on this site hands you over to one of them.

Like any website, this one is served by infrastructure that automatically processes technical connection data for every request it receives: your IP address, the date and time of the request, the page requested, the browser and device type, and the page you arrived from. This is handled by our hosting provider, Vercel Inc. (see section 9), for the sole purposes of delivering the pages you ask for, keeping the service running and protecting it against abuse. We do not otherwise collect this data ourselves, do not combine it with any other information, and do not use it to identify individual visitors.

To know how many people visit this site and which pages are read, we use Vercel Web Analytics, the statistics service of the same hosting provider. It sets no cookie and stores nothing in your browser: each visit is counted against a short-lived identifier that Vercel computes from the technical details of the request, which changes every day and cannot be traced back to you. What reaches us is only the aggregate: how many visits there were, which pages were read most, which country they came from and what kind of device was used. No profile, no recognition across other websites, no advertising.

If your browser reports that our Content-Security-Policy has blocked something it should not have, a short technical note is written to our application log: which rule was involved, the origin that was blocked, and the path of the page it happened on. No cookie, IP address or other visitor identifier is included in that note by us.

This website sets exactly one cookie, named incanto-locale. It remembers which of the three languages you are reading in, so that an address without a language prefix (such as incanto-olten.ch/menu) shows you that language again on your next visit instead of guessing from your browser settings every time. It expires after one year, is read only by this website, and is never sent to any third party.

Because this cookie stores nothing beyond a language preference and is not used for tracking, profiling or advertising, Swiss law does not require your prior consent before it is set. You can delete it at any time through your browser’s settings; the site continues to work exactly as before, and simply falls back to reading your browser’s own language setting until you choose again.

This is the only cookie this website sets for visitors. The visitor statistics described in section 3 work without one. There is no advertising network, no social-media tracking pixel and no third-party cookie of any kind on the public pages of this site.

The reservation form on this site does not send anything to our server. Everything you type into it, meaning your name, phone number, email address, the date, time and number of guests, and any note you add, stays in your own browser and is used only to compose a message. When you press “Send via WhatsApp” or “Send by email”, your browser opens that message in WhatsApp or in your own email program, addressed to us; nothing is transmitted anywhere before that moment, and if you close the page beforehand, nothing has left your device.

From the moment you send it, your message is an ordinary WhatsApp message or email like any other, and is handled under WhatsApp’s or your email provider’s own terms rather than ours. We receive it in our own WhatsApp Business account or our inbox at incanto.olten@gmx.ch and use it only to arrange your table. See section 6 for how we handle it from there, and section 9 for WhatsApp’s role as an independent party in this exchange.

A party of more than twenty is asked to call us directly instead of using the form; that call is covered by section 6.

If you call, WhatsApp, email or write to us, whether or not you used the form to start the conversation, we process what you send us (typically your name, contact details and the content of your message) to reply to you and, where relevant, to organise your reservation. We keep that correspondence only for as long as we reasonably need it to do so; once your visit is over, we do not keep it further unless you get in touch with us again, ask us to keep it, or a document arising from it, an invoice for instance, must be kept under Swiss commercial-law retention rules (ten years, under Article 958f of the Swiss Code of Obligations).

The Instagram account linked from this site (@incanto.olten) and our Facebook page are operated by us but hosted by Meta Platforms Ireland Limited. If you message us or comment through Instagram or Facebook, that exchange is additionally governed by Meta’s own privacy policy.

The pages under /admin let two named members of our staff upload and remove the PDF menus shown on this site. Signing in there is protected by an account system operated by our authentication provider, Supabase Inc., which sets a session cookie in the browser of whoever signs in. This area, and the account data behind it, is not accessible to and does not process any data about ordinary visitors to the public site.

The typefaces used across this site are downloaded once when the site is built and are then served from incanto-olten.ch itself. Reading this site never causes a request to Google’s font servers, and no data about you reaches Google through them.

The one exception is the country-flag icon shown next to the phone number field on the reservation form: it is loaded, when that field is shown, from Cloudflare’s public icon library at cdnjs.cloudflare.com. That single request discloses your IP address and browser information to Cloudflare, in the same way any request to any website does. If that request fails or is blocked, the field simply shows a two-letter country code instead and continues to work.

Links to Google Maps, our Instagram profile and our Facebook page open those services in a new tab only if you choose to click them; visiting this site does not itself send anything to Google or Meta.

We use a small number of providers to run this site and, in doing so, we may share technical data with them under the roles described here. None of them is permitted to use what they process on our behalf for their own purposes.

• Vercel Inc.: hosts this website, serves every page, processes the technical connection data described in section 3 and produces the cookieless visitor statistics described there.
• WhatsApp Ireland Limited (Meta): if you choose to send a reservation request or message us via WhatsApp, WhatsApp acts as an independent controller of that message once it reaches its systems.
• Your own email or telecommunications provider: if you choose to email or call us, they carry that communication under their own terms.

We do not sell your data, and we do not share it with anyone for advertising or marketing purposes.

Some of the providers listed in section 9, in particular Vercel and Meta, are established, or operate infrastructure, outside Switzerland and the European Economic Area, including in the United States. Where that is the case, they are contractually bound to protect your data to a level recognised as adequate under Swiss law: through a mechanism such as the Swiss-U.S. Data Privacy Framework, standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner, or another safeguard permitted under Article 16 of the FADP.

Under Swiss law, we do not need a separate legal basis for each processing operation in the way the GDPR requires, but we are bound by law to process your data lawfully, proportionately, for the purpose we have told you about, and no longer than that purpose requires. In practice: we process a reservation request, and any correspondence around it, to organise your visit and reply to you, we process technical connection data to keep the site running and secure, and we set the language cookie because you asked us to remember your choice.

Correspondence about a specific reservation is kept only as long as needed to arrange and complete it, plus a reasonable period afterwards in case a question comes up; the language cookie expires after one year as described in section 4; technical connection data is kept by our hosting provider for a limited period in line with its own operational retention practice; and any document that becomes part of our accounting records, an invoice for instance, is kept for ten years under Article 958f of the Swiss Code of Obligations.

Every page on this site is served over an encrypted connection (HTTPS), and browsers are instructed to insist on one for two years through the Strict-Transport-Security header. A Content-Security-Policy restricts which sources of code and content a page is allowed to load from, precisely to reduce the damage an injected script could otherwise do. The reservation form has no server-side counterpart to attack: because it never transmits your details to us, as explained in section 5, there is no database of past requests that could be exposed.

The administration area is protected by individual staff accounts, and the PDF menus it manages are stored in a private cloud storage bucket that is not directly reachable from the internet; every download is served through this site’s own server.

Under the Federal Act on Data Protection, you have the right to ask us: whether we process data about you, and if so what data and for what purpose (right of access); to have inaccurate data corrected (right to rectification); to have your data deleted or to object to its processing, subject to any retention we are legally required to observe (right to erasure and to object); and, where the processing is automated and based on your consent or on a contract with you, to receive the data you gave us in a common electronic format (right to data portability).

To exercise any of these rights, reach us through the contact details in section 1 or in section 16. We will need enough information to be reasonably sure we are speaking to the right person before we act on your request, and we will respond within the time the law allows.

If you believe we have not handled your data lawfully, you can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland (www.edoeb.admin.ch) or, if the GDPR applies to you, with the data protection authority of the EU member state where you live or work.

This site is a restaurant’s booking page, not a service aimed at children. We do not knowingly collect data from minors beyond what a parent or guardian submits on their behalf when booking a table for a family, and such data is used solely for that reservation.

We may update this policy if the way this site works changes, or if the law requires it. The date at the top of this page is the date it was last substantively revised; a change to that date is the only notice you will receive, so we encourage you to check back here if you have concerns.

For any question about this policy or about your data, write to Giovanni Carrieri at incanto.olten@gmx.ch or call +41 76 514 07 72.