Privacy notice on the processing of personal data
Last updated: October 2026
PLATEOUT
Introduction
This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the GDPR), Legislative Decree no. 196 of 30 June 2003, as subsequently amended (the Privacy Code), and other applicable provisions on personal data protection.
It describes how personal data is processed in relation to the portal available at https://plateout.com (the Portal). It does not apply to third-party websites reachable through links from the Portal, or to processing carried out independently by individual dining venues.
1. Data controller
The Data Controller is Plateform S.r.l., with registered office at Via Andrea Costa 202/6, 40134 Bologna (BO), tax code, VAT number and registration number in the Bologna Business Register 03953561200, REA number BO-558327, fully paid-up share capital of EUR 100,000.00, email address supporto@plateout.com. The Controller responds within 72 working hours of receipt, without prejudice to statutory deadlines for exercising the rights referred to in section 11.
2. Who this notice applies to
The Portal involves processing personal data concerning three categories of people, on different grounds. This distinction is relevant because the legal basis, exercisable rights and ways of exercising them differ.
| Category | Who they are | How we obtain the data |
|---|---|---|
| A. People browsing the Portal | Any visitor to the Portal's pages | Directly, through browsing |
| B. People submitting a report | Anyone completing the contact form or writing to the indicated addresses | Directly from the data subject |
| C. People whose data appears on listings | Owners and contact persons of dining venues; people who may be depicted in photographs | From publicly accessible sources, not from the data subject |
3. Children
The Portal is intended for people aged fourteen or over, the age provided by Article 2-quinquies of the Privacy Code for consent relating to information society services. We do not knowingly collect data concerning children under fourteen. If we become aware of such processing, we delete the data.
4. People browsing the Portal
4.1 Browsing data. The IT systems enabling the Portal to operate acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols: IP address, browser and device type, operating system, pages requested, request time and server response outcome. This data is used to enable proper service delivery, for security and to derive statistical information in aggregate form.
4.2 Approximate location. The Portal offers a “Use my location” function to find nearby venues. The User's device determines the location only after explicit authorisation, which can be withdrawn at any time through browser or device settings.
Coordinates are read on the device and transmitted to our systems solely to search for nearby venues. They are neither recorded nor retained and are not used for other purposes.
4.3 Purposes, legal bases and retention.
| Purpose | Legal basis | Retention |
|---|---|---|
| Providing and operating the Portal | The Controller's legitimate interest in providing a functioning and secure service (Article 6(1)(f), GDPR) | System logs: no longer than twelve months |
| Security, prevention of abuse and establishment of liability | The Controller's legitimate interest in protecting its infrastructure (Article 6(1)(f), GDPR) | Twelve months |
| Usage statistics in aggregate form | The Controller's legitimate interest in improving the service (Article 6(1)(f), GDPR) | Aggregate data not attributable to identified persons |
| Searching for nearby venues | Consent, given through device authorisation (Article 6(1)(a), GDPR) | No retention: coordinates are used only to perform the search |
5. People submitting a report
The Portal's contact form can be used to report errors, inconsistencies or malfunctions relating to a listing or the Portal, request the correction or removal of a listing, and report content alleged to infringe one's own or third-party rights.
The data processed is that entered in the form: name, email address, any telephone number, name of the relevant venue and report text. Providing it is optional, but without contact details it is not possible to respond.
| Purpose | Legal basis | Retention |
|---|---|---|
| Handling the report and responding to the data subject | The Controller's legitimate interest in responding to requests received; for requests to exercise rights, compliance with a legal obligation (Article 6(1)(c) and (f), GDPR) | Twenty-four months after the report is closed |
| Checking whether a request is substantiated and correcting or removing published content | The Controller's legitimate interest in the accuracy of published information (Article 6(1)(f), GDPR) | Twenty-four months after the report is closed |
| Defence in legal proceedings, in the event of disputes | The Controller's legitimate interest in protecting its rights (Article 6(1)(f), GDPR) | For as long as necessary for protection, according to limitation periods |
Data collected through the form is not used for commercial or promotional purposes.
6. People whose data appears on listings
This section constitutes the notice required by Article 14 GDPR for data we have not collected from the data subject.
6.1 What data we process and where it comes from. Information and photographs published on listings have been obtained from publicly accessible sources, particularly business listings published on Google Maps, through extraction carried out by a third-party provider. Acquisition does not take place in real time: information is collected at specific times and may be updated periodically, even only in part. The Portal does not query sources when it is viewed, and each listing displays the date of its last update.
The acquired information primarily concerns the business: name, address, public telephone number, opening hours, price range, category, average rating and total review count, photographs. Email addresses are not acquired.
However, such information may also relate to natural persons in two cases:
a) when the establishment's name or contact details coincide with those of its owner or a contact person, or otherwise allow them to be identified, as usually happens with sole proprietorships;
b) when photographs depict identifiable people, whether staff or customers.
Only the average rating and total number of reviews published on the source are displayed, in aggregate form. Review texts and the names of their respective authors are not published.
6.2 Photographs and measures adopted. During acquisition, photographs published on listings are subjected to an automated filter intended to exclude images in which people's faces are recognisable.
Anyone who considers themselves depicted in a photograph published on the Portal may request its removal under point 6.4; we do so immediately and in any event within 72 working hours, without requiring reasons for the request.
6.3 Purpose and legal basis. Processing is based on the Controller's legitimate interest and the public's interest (Article 6(1)(f), GDPR) in making information about commercial activities already accessible to anyone available in an organised form, and enabling people to make informed choices about where to eat.
In assessing the balance between this interest and data subjects' rights and freedoms, we considered that the processed information was already publicly accessible; that it primarily concerns a business activity directed at the public and relates to natural persons only indirectly; that only the average review rating is displayed in aggregate form, without review texts or authors' names, and therefore without evaluative content attributable to individual persons; that photographs are subjected to the filter described in point 6.2; and that each data subject has a right to object that can be exercised immediately, as described in the following point. The balancing assessment is documented and available at the supervisory authority's request.
6.4 Right to object, rectification and erasure. Anyone may object to processing and request removal of their data from the Portal by writing to supporto@plateout.com or using the contact form. In particular:
- a venue's owner or manager may request the correction, update or removal of its listing; to fulfil the request we may ask for evidence of the connection with the establishment;
- anyone depicted in a photograph may request its removal;
- anyone who considers published information inaccurate may request its rectification.
We provide an initial response within 72 working hours and resolve the request within thirty days of receipt. Removal from the Portal does not entail removal of the content from its source; this must be requested directly from the source's operator.
6.5 How the notice is provided. Given the number of published listings and the absence of individual contact details for data subjects, individually communicating this notice would require a disproportionate effort under Article 14(5)(b), GDPR. The notice is therefore provided by publication on the Portal, in a position accessible from every page and referenced on each listing.
6.6 Retention. Venue information is retained for as long as the listing remains published. Where an objection is upheld, the data is removed from the Portal and only evidence of the request is retained, for the time necessary to honour the objection during any subsequent database alignments as well.
7. Automatically generated descriptions
Venue descriptions published on listings are generated automatically using an artificial intelligence system provided by a third party, to which only the venue's name and address are transmitted, together with generation instructions.
Reviews, review authors' names, users' browsing data or other personal data are not transmitted to this service. Descriptions are not verified by the Controller and do not constitute an assessment, rating or ranking of venues.
8. The path to Plateform
The Portal does not host any commercial enquiry form. By selecting “Are you a restaurateur?” in the menu, the prompt on the home page or, on a listing without online booking, the message “Are you the owner of this restaurant? Contact us”, the User is directed to Plateform S.r.l.'s website.
From that point, any data collection, including requests for a product demonstration and any consent to receive promotional communications, takes place on Plateform S.r.l.'s website and is governed by the privacy notice published there. The Controller remains Plateform S.r.l., but purposes and retention periods are those described in that notice.
The booking page reached from listings of venues with online booking is a different case: data entered to book is processed by the individual venue as controller, under its own notice; Plateform S.r.l. acts as the Plateform service provider on behalf of the venue.
9. Data recipients
Data may be processed by:
- the Controller's authorised staff, bound by confidentiality and instructed under Article 29 GDPR;
- the external provider that builds and maintains the Portal;
- DigitalOcean, the infrastructure provider hosting the Portal; the servers used are located in Frankfurt and Amsterdam;
- Apify, the provider of the service used to acquire information published on listings;
- Perplexity, the provider of the system used to generate descriptive texts;
- Google, for displaying listing photographs, loading interface icons and automatically translating texts;
- OpenStreetMap, for maps on listings;
- public and judicial authorities, in cases provided by law.
Providers processing personal data on behalf of the Controller are appointed as processors under Article 28 GDPR.
Data is not disseminated, except as necessary for publication of listings under section 6, and is not transferred to third parties for their own promotional purposes.
10. Transfers outside the European Economic Area
The infrastructure hosting the Portal is located within the European Union, at data centres in Frankfurt and Amsterdam.
Some third-party services used, particularly those provided by Google and Perplexity, involve transfers of data to third countries. In these cases, transfers take place on the basis of safeguards provided by Chapter V GDPR, such as a European Commission adequacy decision or the standard contractual clauses adopted by the Commission, supplemented by any necessary additional measures.
Information about the safeguards adopted and copies of the relevant documentation may be requested by writing to the addresses indicated in section 1.
11. Data subject rights
Under Articles 15 to 22 GDPR, the data subject has the right to:
- obtain confirmation that processing exists and access their data (Article 15);
- request rectification of inaccurate data and completion of incomplete data (Article 16);
- request erasure of data in the cases provided by Article 17;
- request restriction of processing in the cases provided by Article 18;
- receive data in a structured, commonly used and machine-readable format, in cases provided by Article 20;
- object at any time to processing based on legitimate interest, under Article 21;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Rights may be exercised by writing to supporto@plateout.com. We respond within thirty days of receipt of the request, a period that may be extended in the cases and manner provided by Article 12(3), GDPR.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Piazza Venezia 11, 00187 Rome; garante@gpdp.it) or seek a judicial remedy.
12. Security
The Controller adopts appropriate technical and organisational measures to protect personal data from destruction, loss, alteration, disclosure or unauthorised access, under Article 32 GDPR. Processing is carried out using IT tools and organisational arrangements strictly related to the stated purposes.
13. Changes to this notice
The Controller may update this notice, for example following regulatory changes or the introduction of new functionality. The applicable version is the one published on this page, indicating the date of the last update. You are invited to consult it periodically.