Privacy Policy

How we process and protect your personal data.

Last updated: 2 September 2026

This notice is provided pursuant to Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended (Privacy Code) to everyone who interacts with this website, with the connected mobile applications and with the TaacDelivery ordering and delivery service.

1. Data controller

Galeppi Samuele
Address: Via Santo Stefano 22, 23900 Lecco (LC), Italy
VAT no. 03927580138
Email: info@taacdelivery.it
Phone: +39 349 341 4287

Partner restaurants independently process the data they need in order to prepare the order and to meet their own tax obligations: for that processing they are autonomous controllers.

2. Categories of data collected

• Data you provide: first name, last name, email address, phone number, delivery address and notes for the rider, password (stored only as a hash, never in clear text), any billing details (tax code, VAT number, certified email, SDI recipient code).
• Order data: contents, history, amount, payment method, time and status of delivery. Full payment card details neither pass through nor are stored on our servers: payment is handled by PCI-DSS certified operators.
• Browsing data collected automatically by the IT systems: IP address, browser type and operating system, pages visited, date and time of requests.
• Location data: only the coordinates of the delivery address you enter, in order to calculate distance and cost. We do not track your position in the background.
• Cookies and similar technologies: see the Cookie Policy.

3. Purposes of processing and legal bases

4. How data is processed

Data is processed using IT and telematic tools, with technical and organisational measures appropriate to the risk, so as to ensure confidentiality, integrity and availability. Account passwords are stored only as hashes and cannot be read even by the controller. Access to data is limited to authorised personnel and to the processors listed in section 6.

5. Retention periods

• Order and invoicing data: 10 years from the issue of the document, for tax obligations.
• Customer account data: until the account is deleted by the user.
• Access logs and browsing data: maximum 12 months.
• Data collected through contact and application forms: maximum 24 months or until consent is withdrawn.
• Cookie consent records: 24 months, for accountability purposes under art. 7 GDPR.

6. Recipients of the data

Data may be disclosed to parties acting as processors under art. 28 GDPR, or as autonomous controllers where indicated:

• Partner restaurants — limited to the data needed to prepare the order (autonomous controllers for their own obligations).
• Riders and logistics partners — name, address, phone number and delivery notes, only for as long as needed to complete the delivery.
• Hosting and web infrastructure provider.
• Email and transactional email providers.
• Satispay S.p.A. and GetYourCash — for electronic payments (autonomous controllers for payment data).
• TeamSystem S.p.A. (Fatture in Cloud) — for electronic invoicing.
• Google Ireland Limited — Google Tag Manager, Google Analytics, Firebase Cloud Messaging. Analytics and marketing services operate only with your consent to the relevant cookies.
• OpenStreetMap Foundation — maps and address lookup.
• Consultants, accountants and lawyers, within the limits of the related purposes.
• Competent authorities, where required by law.

Data is neither disseminated nor sold to third parties for their own commercial purposes.

7. Transfers outside the European Economic Area

Data is normally processed within the European Economic Area. Some providers (in particular Google) may transfer data to third countries: such transfers take place in compliance with the safeguards under Chapter V of the GDPR, that is on the basis of European Commission adequacy decisions or standard contractual clauses.

8. Your rights

You may exercise at any time the rights set out in articles 15 to 22 of the GDPR:

• access to your personal data;
• rectification of inaccurate or incomplete data;
• erasure ("right to be forgotten");
• restriction of processing;
• data portability in a structured, machine-readable format;
• objection to processing based on legitimate interest;
• withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• lodging a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

To exercise them, write to info@taacdelivery.it. We reply within one month of receiving the request.

9. Whether providing data is mandatory

Providing the data needed to perform the contract and to comply with legal obligations is mandatory: without it, the order cannot be completed and the service cannot be provided. Providing data for analytics and marketing purposes is optional and subject to consent: refusing has no effect on your ability to place orders.

10. Automated decision-making

We carry out no processing based solely on automated decision-making, including profiling, that produces legal effects concerning the data subject or similarly significantly affects them.

11. Minors

The service is not intended for children under 14, who may not register an account. The sale of alcoholic drinks is reserved to persons over 18, as stated in the Terms and conditions.

12. Changes

The controller may update this notice. The version in force is always published on this page, together with the date it was last updated.