Privacy policy

Controller

The following party is responsible for processing personal data on this digital menu:

• Trattoria BellaViste
• Bella Vistastrasse 123, 6003, Luzern, CH
• Email: kontakt@trattoria.bella.ch
• Phone: +41 827 7234 8

Scope

This privacy policy covers the digital menu at trattoria-bella-vista.more-menu.com. It follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the European General Data Protection Regulation (GDPR).

Opening the menu

When you open the menu, your device sends technically necessary information to our hosting provider: IP address, time of the request, the page requested, and details about your browser and operating system. These server logs serve secure operation and troubleshooting and are not combined with other data.

Fonts and images are served from our own servers, so simply opening the menu creates no connection to Google or any other third party.

Usage statistics

To see which dishes and categories are of interest, we record anonymous usage events: opening the menu, opening a dish, categories reached, time spent on a dish, and the display language chosen.

No permanent identifier is used. Your device is given a random id that changes every day and is stored only locally in your browser. Recognising you across several days or across different businesses is therefore impossible by design; we build no profiles and link the data to no individual.

Cookies and local storage

We use no advertising or tracking cookies. Only the following technically necessary entries are used:

Local storage entries never leave your device. Because no marketing or tracking cookies are involved, the menu needs no cookie banner.

Ratings and messages

You can rate individual dishes with stars. We store the rating, the dish, and the daily rotating device id described above — the latter only so that the same dish is not rated twice on the same day. Your name is not recorded.

You can also leave us a message. We store the text of your message, the dish it refers to where applicable, and an irreversible hash of your IP address. That hash exists solely to prevent abuse and bulk submissions; the IP address itself is neither stored nor displayed anywhere.

Please do not put anything in the message that you would rather not share. If you would like a reply, give us your contact details — we will then process them in order to answer you.

Table reservations

When you reserve a table through our page, we process what you enter in the form: your name, an email address or phone number, the party size, the requested time and any note. We need this to accept the reservation, send you the confirmation and reach you if something changes.

The legal basis is carrying out the reservation you requested. Providing the data is voluntary — but without a name and a way to contact you we cannot confirm the booking.

After your visit we send you one single message, thanking you and asking you to review us on a review platform. It is sent exactly once per reservation and carries an unsubscribe link; once you unsubscribe you will not receive one for future reservations either. The basis is the consent you give when booking — you can withdraw it at any time, and doing so leaves the reservation itself untouched.

To honour an unsubscribe we do not store your email address in the clear, only an irreversible checksum of it — enough not to write to you again, too little to become a mailing list.

Your contact details are deleted automatically 90 days after the reserved date. All that remains afterwards is that a booking of that size existed at that time — with no reference to you.

Links to third-party services

The menu links to a review platform. No data is transmitted to those providers until you click such a link. From that point their own privacy terms apply.

Processors

We work with carefully selected service providers to run the menu:

• More-Menu (Switzerland) — provides and operates the digital menu on our behalf
• Vercel — hosting and delivery of the page
• Supabase — database and image storage
• Resend — sends the notification when a guest message reaches us
• Resend — sends the reservation confirmation and reminder

These providers process the data solely on our instructions and are contractually bound to confidentiality. Where processing takes place outside Switzerland or the EEA, it is based on recognised safeguards such as the Standard Contractual Clauses.

Retention

• Server logs: kept briefly by the hosting provider, then deleted automatically
• Individual usage events: 90 days, after which only daily totals without any device reference remain
• Ratings: the star and the dish are kept, the daily rotating device id is removed automatically 7 days after the rating — after that the entry cannot be traced back to any device
• Guest messages: 90 days at the most, then deleted automatically and in full — sooner, once we have dealt with them and delete them ourselves
• Reservations: name and contact details for 90 days after the booking, then anonymised automatically — date, party size and status remain without any personal reference

Your rights

You have the right to obtain information about the personal data we process about you, and to have it corrected, deleted or its processing restricted. You may object to processing and request the release or transfer of your data.

Please note: the usage statistics and the ratings deliberately contain nothing that would let us identify you. Without additional information from you we therefore cannot attribute those entries to any individual.

To exercise your rights, please contact the controller named above. You may also turn to the competent supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC).

Changes

We update this privacy policy when the processing described here changes. The version published here is the one that applies. Last updated: 21 August 2026.