Data Processing Policy

This Data Processing Policy supplements our Privacy Policy and describes in greater detail how La Fiamma processes personal data collected through our website, reservation system, and online ordering platform.

1. Data Controller

La Fiamma NYC, 45 Main St Ste 240, Brooklyn, NY 11201-1098, acts as the data controller for personal information collected through this website.

2. Categories of Data Processed

3. Data Processors We Use

• Stripe, Inc. — payment and deposit processing (PCI-DSS Level 1 certified).
• Email / SMS communication providers — reservation and order confirmations.
• Website hosting & analytics providers — site performance and security.
• Reservation management platform — booking calendar and table management.

All third-party processors are contractually required to process data only as instructed and to apply appropriate technical and organizational security measures.

4. Data Retention

Reservation and order records are typically retained for up to 7 years to satisfy tax and accounting obligations. Marketing consent records are retained until consent is withdrawn. Technical/cookie data is retained per the retention periods described in our Cookies Policy.

5. International Data Transfers

Where data is processed by providers located outside the United States, we require appropriate safeguards (such as standard contractual clauses) to be in place, consistent with applicable law.

6. Security Measures

• Encryption of data in transit via TLS/SSL.
• No storage of full payment card numbers on La Fiamma servers — all card data is handled directly by Stripe.
• Access to guest data limited to authorized staff on a need-to-know basis.
• Regular review of third-party processor security practices.

7. Data Subject Rights & Requests

You may request access to, correction of, or deletion of your personal data, or object to certain processing, by contacting us using the details below. We will respond to verified requests within the timeframes required by applicable law.