LG FOOD SOCIETÀ A RESPONSABILITÀ LIMITATA

Piazza Benedetto Cairoli 2 – 00186 Rome | VAT No. 14323141003 | REA RM-1512471

privacy@deromamor.com | lgfoodsrls@legalmail.it | www.deromamor.com

PRIVACY POLICY ON THE PROCESSING OF PERSONAL DATA

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018

Version of May 13, 2026

This privacy policy describes how LG Food S.r.l. — owner of the website deromamor.com — collects, uses, and protects the personal data of users who access the website or interact with the services offered therein. Data processing is carried out in full compliance with current legislation regarding personal data protection.

1. DATA CONTROLLER

For any request regarding the processing of their personal data, the data subject can write to privacy@deromamor.com. The Data Controller will respond within 30 days of receiving the request, extendable by a further 60 days in cases of particular complexity.

2. TYPES OF PERSONAL DATA PROCESSED

In relation to the different processing purposes set out in Section 3, LG Food S.r.l. collects and processes the following categories of personal data:

a) Data provided directly by the user

Through the SevenRooms booking system, the following identification and contact data are collected: first name, last name, email address, phone number, date and time of reservation, number of guests, and table preferences. If spontaneously indicated by the user, information regarding food allergies or intolerances may also be processed, which fall under the category of special data (health data) pursuant to Article 9 of the GDPR.

Payment data is managed exclusively via the Stripe payment gateway integrated into SevenRooms. Stripe operates under two distinct corporate registrations depending on the reservation location: on behalf of LG Food S.r.l. for the Via Poli 27 location (Deroma) and on behalf of Mapica S.r.l. for the Largo del Nazareno 13 location (Gran Deroma). In both cases, neither LG Food S.r.l. nor Mapica S.r.l. acquires or retains any payment instrument data on its own.

b) Data collected automatically through tracking technologies

Navigating the site results in the automatic collection of certain technical data, including: IP address, browser type and operating system, visited pages and duration of stay, approximate geographical data, advertising identifiers, and cookies. Such data is processed both for aggregate statistical purposes and, subject to user consent, for profiling and marketing purposes.

3. PURPOSES AND LEGAL BASES OF PROCESSING

The processing of personal data occurs for the purposes and on the legal bases indicated below:

• a) Management of reservations and contractual relationship

  • Legal basis: Execution of a contract or pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR). Data collected via SevenRooms is used for the technical management of reservations, customer communication, and the proper delivery of the catering service.

• b) Processing of health-related data

  • Legal basis: Explicit consent of the data subject (Art. 9(2)(a) GDPR) and protection of vital interests (Art. 9(2)(c) GDPR). Information on allergies and food intolerances, if provided, is processed exclusively to adapt the service and ensure the safety of the data subject. Such data is retained by SevenRooms for the duration of the contractual relationship and can be erased upon request at any time pursuant to Article 17 of the GDPR.

• c) Commercial communications and newsletters

  • Legal basis: Consent of the data subject (Art. 6(1)(a) GDPR). Subject to consent, the user may receive promotional communications via the DEM system integrated into SevenRooms. Consent may be revoked at any time.

• d) Statistical analysis of the website

  • Legal basis: Legitimate interest of the Data Controller (Art. 6(1)(f) GDPR), or consent where required by applicable law. Browsing data is processed by Google Analytics in an aggregate and anonymized form, without cross-device profiling (Google Signals is disabled).

• e) Marketing, advertising, and remarketing

  • Legal basis: Consent of the data subject (Art. 6(1)(a) GDPR). Data collected via Google Ads and Meta (Facebook/Instagram), including the Meta Pixel, is used to create localized advertising campaigns, measure conversions, conduct remarketing, and build Custom Audiences. Campaigns are geographically limited to Italian territory, within a radius of 17–20 km from the operating location.

4. SUPPLIERS AND PROCESSORS

LG Food S.r.l. uses third parties who process data as Data Processors pursuant to Article 28 of the GDPR, or as autonomous Data Controllers. An updated list of Processors is available upon request.

SevenRooms Inc.

• Registered Office: 228 Park Ave S, PMB 33706, New York, NY 10003-1502, USA

• GDPR Role: Data Processor (Art. 28 GDPR)

• Extra-EU Safeguard: Standard Contractual Clauses (SCC) approved by the European Commission

• Processed Data: First name, last name, email, phone, reservations, allergies/intolerances, IP address

• Purposes: Reservation management, CRM, newsletters, protection of the data subject’s health

• Payment: Stripe Gateway — registered under LG Food S.r.l. (Via Poli 27) and Mapica S.r.l. (Largo del Nazareno 13). Neither company accesses credit card data.

Google Ireland Limited — Google Analytics & Google Ads

• Registered Office: Gordon House, Barrow Street, Dublin 4, Ireland | VAT Reg IE6388047V | Reg No. 368047

• GDPR Role: Autonomous Data Controller

• Analytics Data: Anonymized IP, browsing data, browser metadata, approximate geographical data

• Analytics Purpose: Aggregate statistical analysis of website performance (Google Signals disabled)

• Ads Data: Profiling cookies, advertising IDs, conversion data, interaction history

• Ads Purpose: Optimization of ad campaigns and ROI monitoring

Meta Platforms Ireland Limited — Meta & Meta Pixel

• Registered Office: Merrion Road, Dublin 4, D04 X2K5, Ireland | VAT Reg No. IE9692928F

• GDPR Role: Autonomous Data Controller / Processor for the Pixel

• Meta Data: Cookies, social identifiers (if logged in), browsing data, actions taken on the site

• Pixel Data: Conversion events, visited URLs, technical device parameters

• Purposes: Custom Audiences, remarketing, ad performance measurement, social campaigns

5. COOKIES AND TRACKING TECHNOLOGIES

The deromamor.com website uses cookies and similar technologies. In compliance with the Italian Data Protection Authority Guidelines, a consent banner is displayed upon first access allowing the user to select which cookie categories to accept.

• Necessary Technical Cookies: Installed automatically and do not require user consent. They include session and preference cookies required for proper site functioning.

• Analytical Cookies: Google Analytics — activated subject to user consent, or treated as technical cookies if the IP is anonymized and data is not shared with third parties for other purposes.

• Profiling and Marketing Cookies: Require explicit user consent. They include Google Ads cookies, the Meta Pixel, and interaction cookies for Meta social platforms (Facebook/Instagram).

Users can manage their preferences at any time using the consent panel on the site, their browser settings, or the following tools:

• Google Ad Settings: adssettings.google.com

• Meta Privacy Center: [facebook.com/privacy/centers](https://facebook.com/privacy/centers)

6. TRANSFERS OF DATA TO THIRD COUNTRIES

Certain personal data is transferred outside the European Economic Area (EEA), specifically to the United States, as part of services provided by SevenRooms Inc. Such transfers adhere to Article 46 of the GDPR through the adoption of Standard Contractual Clauses approved by the European Commission. Google and Meta also adopt equivalent mechanisms for transfers to the USA. The Data Controller periodically checks the adequacy of safeguards adopted by extra-EU suppliers.

7. DATA RETENTION PERIOD

Personal data is retained only as long as strictly necessary to fulfill the purposes for which it was collected, respecting the principles of data minimization and storage limitation under Article 5 of the GDPR.

8. RIGHTS OF DATA SUBJECTS

Pursuant to Articles 15 to 22 of the GDPR, data subjects have the right to:

• Access their personal data and obtain a copy (Art. 15 GDPR);

• Request the rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR);

• Obtain the erasure of their data where applicable (Art. 17 GDPR — right to be forgotten);

• Request the restriction of processing in certain circumstances (Art. 18 GDPR);

• Receive their data in a structured, machine-readable format (Art. 20 GDPR — data portability);

• Object to processing based on legitimate interest or for direct marketing purposes (Art. 21 GDPR);

• Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Requests must be sent to privacy@deromamor.com. The Data Controller will respond within 30 days (extendable by 60 days in complex cases). If the data subject believes that processing violates the GDPR, they have the right to lodge a complaint with their supervisory authority (in Italy, the Garante per la protezione dei dati personali at www.garanteprivacy.it).

9. GEOGRAPHIC TARGETING AND USER CATEGORIES

The deromamor.com website targets an international audience. However, paid advertising campaigns are restricted to Italian territory within an operating radius of 17–20 km from the location (centered on Rome) for both Meta Ads and Google Ads.

The site is not intended for individuals under 18 years of age. The Data Controller does not knowingly collect personal data from minors. If data belonging to minors is accidentally acquired, it will be promptly deleted.

There is no user account registration or private member area, with the sole exception of the newsletter subscription managed via SevenRooms.

10. SECURITY MEASURES

LG Food S.r.l. adopts appropriate technical and organizational measures to guarantee a level of security appropriate to the risk, pursuant to Article 32 of the GDPR. In particular:

• All communications take place via HTTPS/TLS protocol;

• Data access is restricted to authorized and properly instructed personnel;

• Payment data is managed exclusively by Stripe (PCI-DSS compliant), with no transmission through the Controller’s systems;

• External suppliers are selected based on their security guarantees and are contractually bound to comply with applicable regulations.

11. CHANGES TO THIS PRIVACY POLICY

The Data Controller reserves the right to update this policy at any time, particularly following legal, technological, or organizational changes. Updates will be published on this page with an updated date at the top and bottom. In the event of substantial changes, newsletter subscribers will be notified via direct communication.

LG Food S.r.l. — Privacy Policy on the Processing of Personal Data — May 13, 2026

Document drafted pursuant to Regulation (EU) 2016/679 and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.