Privacy policy

This notice explains how Unisal S.r.l. · Pasticceria Lisita processes the personal data of people who visit www.lisita.it, use its forms, order with Click & Collect, buy from the online shop, use the Lisita app or sign in with a Lisita account, under Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003.

Data controller

Unisal S.r.l. · Pasticceria Lisita
Via Domitiana 262/266, 81034 Mondragone (CE), Italy
VAT no. 04184240614
Phone +39 0823 973768
Email info@lisita.it
Certified email (PEC) unisal@pec.it

Data processed

Browsing data

The systems that run the site collect, during normal use, some technical data whose transmission is part of how the Internet works: IP address, browser and device type, page requested, date and time. They are used only to run the site and protect it from abuse; we do not use them to identify or profile you.

Data you give us

• Contact: name, email, subject and message.
• Book a table: first and last name, email, date, time, number of guests and any notes.
• Click & Collect and cakes: first name, last name, phone, products chosen, pick-up day and time, for cakes the details requested (for example the inscription) and any notes. The order is sent via WhatsApp to our business number.
• Events, Lisita su misura and food truck: name, email, phone, date, place, number of guests, type of event and service, message.
• Lisita for business and Become a reseller: business name, VAT number, city, contact person, email, phone and the details of the request.
• Supply catalogue: venue name and email, given to download the catalogue.
• Work with us: your application details and CV. Please do not include unnecessary data in your CV, in particular health data or other special categories of data.
• Newsletter: email address.
• Lisita account (the same for website and app): email, password (stored securely by the authentication service; we never see it), first name, last name, phone, date of birth if you provide it, and order history.
• Lisita app and Lisita Card: card number, points, level and the count of orders and cakes booked; your personal friend code and, if you sign up with a friend’s code, the link to their account so that both of you receive points. Orders and cake bookings made in the app reach us via WhatsApp, as on the website, and stay in your order history.
• Notifications: if you allow them, an identifier of your device (token) that lets us send you push notifications. Some reminders, such as the morning one, are scheduled directly on your phone and send us no data.
• Online shop: order, shipping and payment details are collected on the Shopify checkout.

Providing your data is optional, but without the required fields we cannot reply, prepare your order or confirm your booking. Our services are not intended for children under 14.

Purposes and legal bases

• Replying to requests and managing bookings, Click & Collect orders, quotes for events and supplies, your account and shop purchases: performance of a contract or of steps taken at your request (art. 6.1.b GDPR).
• Assessing job applications: pre-contractual steps taken at your request (art. 6.1.b GDPR).
• Managing the Lisita Card, points, levels and their benefits, according to the terms: performance of a contract (art. 6.1.b GDPR).
• Sending you the newsletter and the welcome discount code: your consent (art. 6.1.a GDPR), which you can withdraw at any time with the link in every email.
• Sending you push notifications from the app: your consent, given through your phone’s permission (art. 6.1.a GDPR); you can withdraw it at any time in your device or app settings.
• Complying with legal obligations, for example tax and accounting: legal obligation (art. 6.1.c GDPR).
• Keeping the site secure and defending our rights: the controller’s legitimate interest (art. 6.1.f GDPR).

We do not make decisions based solely on automated processing and we do not use your data for profiling.

Retention

• Contact requests, bookings, quotes and catalogue requests: 24 months from the last contact.
• Click & Collect orders: the time needed to prepare and hand them over; tax documents for 10 years, as required by law.
• Job applications and CVs: 12 months from receipt, unless you agree to a longer period.
• Newsletter: until you unsubscribe.
• Lisita account and Lisita Card: as long as the account is active; you can delete it at any time from the app (Profile → Delete account) or by writing to us, and the data is erased, except what must be kept by law.
• Notification token: as long as notifications stay on or until the account is deleted.
• Browsing data: for the period set by the hosting provider’s systems, unless needed to investigate abuse.

Recipients

Data is processed by authorised Pasticceria Lisita staff and by the providers that help us run our services, appointed as data processors under art. 28 GDPR:

• Cloudflare, Inc.: website hosting and form handling;
• Plus Five Five, Inc. (Resend): email delivery of the messages you send us through the website forms;
• Shopify International Limited: online shop, checkout, payments and newsletter;
• Google Ireland Limited (Firebase): Lisita account, order history, Lisita Card and running the app;
• 650 Industries, Inc. (Expo): delivery of the app’s push notifications.

When you send a Click & Collect order or a cake booking via WhatsApp, the message goes through the WhatsApp service of Meta Platforms Ireland Limited, which processes it under its own privacy policy. Data may also be disclosed to advisers and authorities where required by law. It is never published or sold.

Transfers outside the European Union

Some providers may also process data outside the European Economic Area, for example in the United States or Canada. In these cases the transfer takes place with the safeguards set out in arts. 44-49 GDPR: European Commission adequacy decisions, such as the EU-U.S. Data Privacy Framework, or standard contractual clauses.

Your rights

You can ask at any time for access to your data, rectification, erasure, restriction of processing and portability, object to processing based on legitimate interest and withdraw your consent, without affecting processing already carried out (arts. 15-22 GDPR). Write to info@lisita.it: we will reply within 30 days. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Cookies

For the use of cookies and similar technologies, see the cookie policy.

Changes

We may update this policy when our services or the law change. The date at the top shows the latest update.