Your data

Privacy policy

This policy explains what data L'art Napulè collects, why, how long it is kept and how to exercise your rights. It covers the website, online ordering, the loyalty programme and the game played from the shop window.

Last updated15/01/2026

Data controller

The data controller is the company operating the L'art Napulè restaurant, whose full legal information is set out in the legal notice.

Data controller: L'art Napulè, La Casa del Napoli
Address: 4 boulevard de Clichy, 75009 Paris
Contact for your data: contact@artnapule.fr
Phone: 06 61 02 79 79

Data we collect

We only collect what is needed to prepare your order, keep you informed, and run the game and the loyalty programme.

Contact identity, your first name, your email address and your phone number.
Order data, cart contents, ordering mode, chosen slot, table number, amount paid and order number.
Delivery address, street, postal code, city, floor and access instructions, only for delivered orders.
Device identifier, a random identifier generated by your browser when you take part in the game.
Loyalty data, points balance, history of points earned and rewards redeemed, promo codes issued.
Payment data, handled directly by our payment provider. We neither receive nor store your card number.
Technical data, server connection logs, needed to keep the service secure.

Purposes and legal bases

Each processing operation rests on a specific legal basis.

Prepare, charge for and deliver your order: Performance of the contract
Keep you posted on the progress of the order: Performance of the contract
Keep accounts and meet tax obligations: Legal obligation
Run the loyalty account and send rewards: Performance of the contract
Let you play the game and send the prize won: Consent
Send the restaurant's commercial offers: Consent
Prevent a repeat entry in the game before the waiting period ends: Legitimate interest, fraud prevention
Keep the site secure and prevent abuse: Legitimate interest

The game and the device identifier

Taking part in the game is optional and rests on your consent, collected with a tick box before the wheel is spun. You can withdraw it at any time, which removes your details from our contact list.

To keep the game fair, a random technical identifier is generated by your browser and kept in the local storage of your device, then recorded with your entry. It contains no name, no email and no browsing data. It is used only to check whether this device has already played during the waiting period set by the restaurant.

Your email or phone number is used to send you the promo code you won, and is subject to the same anti abuse check. Your first name is used only to personalise that message.

Clearing your browser's local storage removes that identifier from your device. The entry already recorded is still kept for its retention period.

Retention periods

We do not keep data for longer than necessary.

Marketing contacts and game players' details: 3 years from the last interaction
Game entries and the associated device identifier: 12 months
Loyalty account and history: 3 years after the last order
Orders, invoices and accounting records: 10 years, statutory accounting retention
Delivery address: Kept with the corresponding order
Proof of consent for the game and for offers: 3 years from collection
Server technical logs: 12 months

At the end of these periods, data is deleted or irreversibly anonymised.

Who receives your data

Your data is never sold, rented or passed to third parties for advertising. It is available to the restaurant team, only as needed to run the service, and to the following providers, who act on our instructions.

Payment provider: Stripe, card payment processing and fraud prevention
Website and database host: TuniCyberLabs, hosting of the site and the database
Email sending provider: Resend, sending order confirmation and tracking emails
Text message provider: Twilio, sending order tracking text messages
Order delivery: Delivery handled by the restaurant staff, no data passed to a third party

Transfers outside the European Union

Data is hosted in the European Union. Some providers, in particular the payment provider, may carry out processing outside the European Union. Such transfers are then covered by the European Commission's standard contractual clauses or by an adequacy decision.

Security

Traffic to the site is encrypted, access to the management interface is protected by authentication and limited to the people who need it. Card details never pass through our servers.

In the event of a data breach likely to create a high risk to your rights, you will be informed in line with the General Data Protection Regulation.

Your rights

You hold the following rights over your data at any time.

Right of access, confirm that we process your data and receive a copy of it.
Right to rectification, have inaccurate or incomplete data corrected, for example a wrong phone number.
Right to erasure, ask for your data to be deleted, except where the law requires us to keep it, in particular for accounting records.
Right to restriction, ask for processing to be frozen temporarily while a dispute is checked.
Right to portability, receive the data you gave us in a machine readable format, and have it sent to another controller.
Right to object, object to processing based on our legitimate interest, and at any time to marketing.
Right to withdraw consent, for the game and for commercial offers, at any time, without affecting messages already sent lawfully.
Post mortem directives, set out what should happen to your data after your death.

How to exercise your rights

Write to the contact email address shown on the contact page, stating what your request is about, or send a letter to the restaurant.

Every offer email we send also carries an immediate unsubscribe link.

We answer within one month of receiving the request, a period that can be extended by two months if the request is complex. If we have serious doubt about your identity, we may ask for proof.

Complaint to the CNIL

If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the CNIL.

Address: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Website: www.cnil.fr

Cookies and browser storage

This site uses no advertising cookie and no third party analytics tracker. It relies mainly on your browser's local storage, which stays on your device and is not sent to our servers automatically.

Cart, local storage: Keeps the cart contents, the ordering mode and the applied promo code, until the order is confirmed or the browser is cleared
Loyalty contact, local storage: Remembers the phone number or email used to check the points balance, so you do not have to type it again
Game device identifier, local storage: Random identifier used to check that a device does not play again before the waiting period ends
Language cookie: Remembers the language you chose, French or English, for twelve months
Payment provider cookies: Set only on the payment screen, to secure the transaction and detect fraud

You can clear local storage and cookies from your browser settings. The cart and the preferences saved on this device will then be lost.

Minors

The game and the loyalty programme are aimed at adults. We do not knowingly collect data about children under fifteen without the agreement of a parent or guardian. If such a collection is reported to us, the data is deleted.

Changes to this policy

This policy may change as the service does, for example when a new provider is added. The last update date is shown at the top of this page. If a purpose or a legal basis changes significantly, we will tell you and, where needed, ask for your consent again.

Back to home