Website: https://eggentaler.com
Last updated: 26 August 2026
This notice explains which personal data we collect when you visit eggentaler.com, contact us, book a table or request a stay, why we process it, who we share it with and what rights you have. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
In short
When you contact us or make a booking, we use the data you give us (name, telephone, email, dates of stay, message) only to reply and manage the booking.
While you browse, and only if you accept it in the cookie banner, we use Google Analytics to understand how the site is used and the Meta Pixel to measure our campaigns on Facebook and Instagram. If you do not accept, these tools set no cookies and do not identify you.
If you stay with us, we process guest data to manage the stay and to fulfil the obligations the law imposes on accommodation providers.
We send you promotional communications only with your specific consent or, if you are already a customer, for offers similar to the services you have used, and you can object at any time.
We do not sell your data and we do not use it for automated decision-making. You can change your cookie choices at any time via the “Cookie settings” link at the bottom of every page.
1. Data controller
Eggentaler S.r.l. / Eggentaler GmbH
Via Val d’Ega 47, 39053 Cardano, Cornedo all’Isarco (BZ), Italy
VAT no. 03050300213
CIN IT021023A1TYPVOSPY
Email: info@eggentaler.com
Certified email (PEC): eggentaler@legalmail.it
Telephone: +39 0471 365294
The controller has not appointed a Data Protection Officer (DPO), as the legal requirements for doing so are not met. For any question about this notice, write to info@eggentaler.com.
2. What data we process, why, and on which legal basis
2.1 Contact form
Data: first and last name, email address, text of the message and any other information you choose to include.
Purpose: to reply to your request.
Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
Retention: 24 months from submission, then deletion, unless the request leads to a contractual relationship.
Tools: the form is managed by the Contact Form 7 software installed on our site; messages are sent to our email address and stored on the site (Flamingo component) for the period indicated. The form is protected by Google reCAPTCHA (see section 3).
2.2 Stay request through the booking widget
The “Rooms” page embeds the request form of Booking Südtirol, a service of HGV-Service Cooperativa (HGV-Service Genossenschaft), Via Macello 59, 39100 Bolzano (BZ), Italy, VAT no. 00576540215.
Data: title, first name, last name, email, telephone, country, arrival and departure dates, number and type of guests, room requested, notes.
Purpose: to check availability and reply to your stay request; the form sends a request, not a binding booking or a payment.
Legal basis: pre-contractual steps at your request and, if the booking is confirmed, performance of the contract (Art. 6(1)(b) GDPR).
Retention: for the duration of the negotiation and, in case of a stay, for the statutory periods indicated in section 2.4.
Roles: HGV-Service receives the request and forwards it to us; for this activity it acts as a processor on our behalf. Under its own terms, HGV-Service may also retain the request data and process it for its own purposes (information and commercial communications from Booking Südtirol), for which it acts as an independent controller: the Booking Südtirol privacy notice and terms are available at https://www.bookingsuedtirol.com and are shown to you when you submit the request together with this notice.
2.3 Table reservations, telephone calls and email
Restaurant reservations are made exclusively by telephone or email. We process name, telephone, number of guests, date, time and any dietary requirements or allergies you tell us about spontaneously.
Purpose: to manage the reservation and the service.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for health-related information (allergies, intolerances), your explicit consent given by communicating it to us (Art. 9(2)(a) GDPR): we use it only to serve you safely and delete it after the service.
Retention: 12 months from the reservation date (to manage no-shows and recurring requests), subject to accounting obligations; information on allergies and intolerances is deleted immediately after the service.
2.4 Hotel stays: legal obligations
If you stay with us, we process the identification data of guests, identity document details and invoicing data.
Purposes and legal bases:
- obligations under public security legislation applicable to accommodation providers, including identifying guests and communicating their details to the competent authorities within the terms and in the manner established by law: legal obligation (Art. 6(1)(c) GDPR);
- statistical, tax and tourist tax obligations under national and provincial legislation: legal obligation (Art. 6(1)(c) GDPR);
- management of the stay and of the services (pool, sauna, restaurant): performance of the contract (Art. 6(1)(b) GDPR).
Retention: for the periods set by the applicable rules (in particular 10 years for tax and accounting records); otherwise, for the duration of the stay and the following 30 days.
2.5 Promotional communications and custom audiences
If you give us your consent (for example by ticking the relevant box in a form, when booking or at check-in), we may use your email address and telephone number to send you news, offers and invitations relating to the restaurant and the hotel, by email, SMS or messaging services. With a separate consent we may also transmit your email address or telephone number in encrypted (hashed) form to Meta Platforms Ireland Ltd. to create “custom audiences” and show you our ads on Facebook and Instagram, or to exclude you from them.
Legal basis: consent (Art. 6(1)(a) GDPR; Art. 130 Italian Privacy Code), which can be withdrawn at any time via the link at the bottom of every message or by writing to info@eggentaler.com.
Existing customers: if you have already stayed or dined with us, we may send you by email offers relating to services similar to those you have used, without prior consent, as permitted by Art. 130(4) of the Italian Privacy Code; you can object at any time, free of charge, in the same way.
Retention: until consent is withdrawn or you object, and in any case no longer than 24 months from the last relevant contact.
We do not currently carry out these activities: this section describes how we will handle them if we activate them, and we will never use previously collected data for these purposes without valid consent.
2.6 Browsing data and server logs
While you browse, the IT systems that run the site automatically collect the IP address, date and time of the request, page requested, browser and operating system.
Purpose: to run the site, ensure its security and prevent abuse.
Legal basis: the controller’s legitimate interest in the security and proper functioning of the service (Art. 6(1)(f) GDPR).
Retention: logs are kept by the hosting provider for a limited period and in any case no longer than necessary for security.
2.7 Site usage statistics (Google Analytics 4)
With your consent we use Google Analytics 4 to know how many people visit the site, where they come from, which pages they view and which actions they take (for example a click on the telephone number, opening the booking form, sending a request). We do not collect names, email addresses or other data that identify you directly; IP addresses are truncated by Google before storage.
Legal basis: consent (Art. 6(1)(a) GDPR), which can be withdrawn from the cookie settings.
If you do not consent: Google Analytics runs in “consent mode” and sends only aggregated, cookieless signals that do not allow you to be recognised between visits.
Retention: 14 months.
2.8 Campaign measurement and remarketing (Meta Pixel)
With your consent the site loads the Meta Pixel, which allows us to measure the effectiveness of our ads on Facebook and Instagram (how many people who saw an ad then visited the site, called or sent a request) and to show our ads to people who have already visited the site or to similar audiences.
Legal basis: consent (Art. 6(1)(a) GDPR), which can be withdrawn from the cookie settings.
If you do not consent: the Pixel is not loaded and no data is sent to Meta.
Joint controllership: for the “event statistics” transmitted through the Pixel, the controller and Meta Platforms Ireland Ltd. are joint controllers under Art. 26 GDPR, according to the agreement available at https://www.facebook.com/legal/controller_addendum.
2.9 Reviews
On the site we display reviews published by guests on Booking.com through the Trustindex service. Reviews contain the name (or initial), date, score and text as made public by their authors on the original platform. We do not collect visitor data through this service; profile images may be loaded from Booking.com and Google servers.
3. Providers and recipients of data
Data may be processed, on our behalf and according to our instructions, by the following providers appointed as processors under Art. 28 GDPR:
| Provider | Service | Location | Data | Transfer outside the EU |
|---|---|---|---|---|
| Raidboxes GmbH | Website hosting, backups, server logs | Münster, Germany | Logs, form contents stored on the site | No |
| HGV-Service Genossenschaft (Booking Südtirol) | Stay request form | Bolzano, Italy | Request form data | No |
| Usercentrics A/S (Cookiebot) | Cookie banner and consent log | Copenhagen, Denmark | Anonymous consent key, choices made, date and time | No |
| Google Ireland Ltd. | Google Tag Manager, Google Analytics 4, reCAPTCHA, Google Fonts | Dublin, Ireland | Browsing data, cookie identifiers (GA4 only with consent), IP address | Yes, USA: Google LLC is certified under the EU-US Data Privacy Framework |
| Meta Platforms Ireland Ltd. | Meta Pixel | Dublin, Ireland | Cookie identifiers and browsing events (only with consent) | Yes, USA: Meta Platforms Inc. is certified under the EU-US Data Privacy Framework |
| Trustindex.io | Reviews widget | Budapest, Hungary | No visitor data | No |
| Google Ireland Ltd. | Google Maps (map on the Contact page), YouTube (video on the Gallery page) | Dublin, Ireland | IP address, interaction data with the map and the video | Yes, USA (Data Privacy Framework) |
Google Tag Manager is the technical tool we use to manage the other scripts: by itself it collects no personal data and sets no cookies.
Google reCAPTCHA protects the contact form from spam by analysing visitor behaviour (mouse movements, IP address, Google cookies if present). We consider it a necessary security measure: the legal basis is the controller’s legitimate interest in protecting the site from automated submissions and abuse (Art. 6(1)(f) GDPR). The service may set Google cookies (__Secure-ENID, _GRECAPTCHA) even before you make your choice in the banner. Google’s Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms) apply.
Google Fonts: the site’s typefaces are loaded from Google’s servers; in doing so your browser transmits your IP address to Google. Legal basis: legitimate interest in the correct display of the site (Art. 6(1)(f) GDPR).
Data may also be disclosed to: public security authorities and public bodies competent for the obligations the law imposes on accommodation providers (security, statistics, tourist tax), tax advisers and banks for accounting purposes, and public authorities where required by law. Restaurant and hotel staff access data within the limits of their duties and under the controller’s instructions.
Transfers to third countries. Google and Meta services may involve the transfer of data to the United States. The transfer takes place on the basis of the European Commission adequacy decision of 10 July 2023 (EU-US Data Privacy Framework), under which Google LLC and Meta Platforms Inc. are certified, confirmed by the General Court of the European Union in its judgment of 3 September 2025 (case T-553/23). As a fallback, the standard contractual clauses approved by the Commission (Decision 2021/914) apply. You can request a copy of the safeguards applied by writing to info@eggentaler.com.
4. How data is processed
Data is processed using IT and paper-based tools, with security measures suitable to prevent unauthorised access, loss or disclosure: encrypted connection (HTTPS), access control, regular backups, system updates. The site is hosted in data centres within the European Union. We do not carry out profiling with legal effects or decisions based solely on automated processing.
5. Provision of data
Providing the data requested by the forms (marked as mandatory) is necessary to reply to the request or manage the booking: without it we cannot do so. Providing identification data and the identity document on arrival at the hotel is required by law. Consent to statistics and marketing cookies is optional: refusing it does not limit in any way the use of the site or of our services.
6. Your rights
At any time you can:
- obtain confirmation that processing is taking place and access your data (Art. 15 GDPR);
- request rectification (Art. 16) or erasure (Art. 17);
- obtain restriction of processing (Art. 18);
- receive the data you have provided in a structured format and transmit it to another controller (portability, Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)); for cookies use the “Cookie settings” link at the bottom of every page;
- lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of your country of residence, or bring an action before the courts.
To exercise your rights write to info@eggentaler.com or by post to the controller’s address. We reply within one month, extendable by two months in complex cases.
7. Minors
The site and our services are not aimed at children under 14. Bookings for minors are made by parents or by those exercising parental responsibility, who provide us with the data required for the stay.
8. Changes
We may update this notice to reflect changes in the law or in the services we use. The version in force is always the one published on this page, with the date of last update at the top. In the event of substantial changes we will indicate this with a notice on the site.
Cookie Policy
What cookies are
Cookies are small text files that the site saves on your device. They are used to make the site work, to remember your choices, to produce statistics and, with your consent, to measure advertising campaigns. Similar technologies (pixels, scripts, local storage) may be used alongside cookies, and this policy applies to them in the same way.
How we manage consent
On your first visit a banner appears (managed by Cookiebot by Usercentrics) through which you can accept all cookies, refuse them or choose individual categories. Until you choose, the site sets only strictly necessary cookies. Your choice is recorded in a technical cookie (CookieConsent) and you are asked again after 12 months or if we change the services we use. You can change or withdraw it at any time via the Cookie settings link at the bottom of every page.
The site implements Google’s “consent mode”: until you consent to the Statistics and Marketing categories, Google Analytics sets no cookies and the Meta Pixel is not loaded.
Cookie categories
Necessary (always active)
Essential for the site to work. They do not require consent (Art. 122 Italian Privacy Code).
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| CookieConsent | Cookiebot (Usercentrics) | Stores your cookie choices | 1 year |
| wp-wpml_current_language | Site (WPML) | Remembers the language chosen (IT/EN/DE) | Session |
| _GRECAPTCHA | Google reCAPTCHA | Distinguishes people from bots in the contact form (security) | 6 months |
| rc::a, rc::c | Google reCAPTCHA | Same purpose, browser local storage | Persistent / session |
| __Secure-ENID, NID | Set by embedded Google services (reCAPTCHA, Maps) | 6-13 months |
Preferences
We currently use no preference cookies beyond the necessary ones.
Statistics (require consent)
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google Analytics 4 | Anonymous visitor identifier used to distinguish visits | 2 years |
| _ga_EEBSNBVZRM | Google Analytics 4 | Maintains session state | 2 years |
Marketing (require consent)
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _fbp | Meta Pixel | Identifies the browser to measure Facebook/Instagram ads and for remarketing | 3 months |
| _fbc | Meta Pixel | Stores the click identifier of a Meta ad, if you arrive from one | 3 months |
| VISITOR_INFO1_LIVE, YSC | YouTube | Set only if you start the video on the Gallery page | 6 months / session |
Third-party content
Google Maps. The Contact page embeds an interactive Google Maps map, loaded from Google’s servers to show you where we are. We consider the map functional content and display it on the basis of legitimate interest (Art. 6(1)(f) GDPR); when it loads, Google receives your IP address and may set its own cookies (for example __Secure-ENID, NID) according to its notice: https://policies.google.com/technologies/cookies. If you prefer to avoid this, you can block third-party cookies in your browser: the address and directions are in any case provided as text on the same page.
YouTube. The Gallery page embeds a YouTube video in “privacy-enhanced mode” (youtube-nocookie.com domain): no cookie is set until you start playback; on playback YouTube/Google may set its own cookies (for example VISITOR_INFO1_LIVE, YSC) according to the notice indicated above.
Automatically updated cookie declaration
The complete, always up-to-date list of cookies detected on the site, with duration and provider, is generated by Cookiebot’s monthly scan and shown below:
How to disable cookies in your browser
In addition to the banner, you can block or delete cookies from your browser settings: Chrome (chrome://settings/cookies), Firefox (Settings → Privacy & Security), Safari (Preferences → Privacy), Edge (Settings → Cookies and site permissions). Blocking necessary cookies may prevent some site features from working.
To disable Google Analytics on all sites you can install Google’s browser add-on: https://tools.google.com/dlpage/gaoptout. To manage Meta’s ad preferences: https://www.facebook.com/adpreferences.
Legal references
Regulation (EU) 2016/679 (GDPR); Italian Legislative Decree 196/2003 as amended (Personal Data Protection Code), Art. 122; Guidelines of the Italian Data Protection Authority on “Cookies and other tracking tools” of 10 June 2021; Directive 2002/58/EC (ePrivacy).