1. Controller and scope
Casa Clelia is responsible for processing through casa-clelia.com, its administration area and private service forms. This version does not publish a tax number, street address or email address. Data requests may be initiated through the website contact form.
This policy covers visitors, prospective clients, clients, organisers, invited diners and authorised administrators.
2. Information we may request
We request only information connected with an enquiry, service planning and delivery, food safety or protected site administration.
- Enquiry details: preferred date, place, guest count, service and optional telephone.
- Event details: organiser, schedule, venue, menu structure, seating and operational needs.
- Diner details: name or alias, attendance, preferences and, where necessary, allergies, intolerances, coeliac requirements or other dietary accommodations.
- Operational records: products, suppliers, lots, expiry dates, receipts and food-safety checks.
- Respectful analytics: visited pages, actions, language, general device category and technical performance without trying to identify a visitor.
3. Purposes
We use data to answer enquiries, assess feasibility, prepare proposals, coordinate events, adapt menus, protect diners, document controls, prevent abuse and secure the service.
An enquiry is not used for marketing or newsletters without separate permission. We do not make solely automated decisions with legal or similarly significant effects.
4. Required and optional information
Forms identify required fields. Optional data may be withheld. Without information necessary to assess an allergy, venue or date, Casa Clelia may be unable to safely confirm or deliver the service.
Telephone, precise map coordinates, beverage choices, handedness and ordinary preferences are optional. Privacy and safety acknowledgements are required to submit an enquiry.
5. Sensitive diner information
Allergies, intolerances, coeliac requirements and other health information receive additional protection and are requested privately only when relevant to safer food preparation.
Each adult diner supplies and consents to their own information. A responsible adult may complete a form for a minor or dependent person. We do not ask for complete medical records, prescriptions or unrelated medication.
Higher-risk requirements receive human review and may be accepted, accepted with controls, require clarification or be declined when safe accommodation is not possible.
7. Retention and deletion
Information is kept only as long as needed for its stated purpose and applicable responsibilities. As an initial operational rule, an enquiry without a booking is reviewed after twelve months and an identifiable dietary profile is scheduled for deletion or anonymisation thirty days after the event, unless a documented reason or renewed recurring-service consent applies.
Commercial records, contracts and incident reports follow the period appropriate to their nature. Retention jobs are reviewable and never duplicate sensitive content in logs.
8. Your rights
You may request access, correction, updating, inclusion or deletion and may withdraw consent where applicable. Reasonable identity verification may be required.
Requests are handled within the time limits of Law No. 18,331. You may also contact Uruguay’s Personal Data Regulatory and Control Unit.
9. Security
We use role-based access, multi-factor authentication, encryption for sensitive information, one-time invitation links, private file storage, activity records and separation between public content and operational files.
No system has zero risk. Incidents are contained, assessed and communicated as required by applicable rules.
10. Policy versions
Each publication has a version and effective date. An acceptance points to the exact text in force. Material changes are explained and renewed consent is requested when purposes or sensitive-data processing change.