Last updated: 2 October 2026
Data controller: PF2 S.r.l. – Viale Antonio Gramsci 62, 88051 Cropani (CZ), Italy – Tax code/VAT no. 03937980799 – Certified email (PEC): fnrsrl@pec.it
Privacy contact: info@masonslobster.it – tel. +39 375 902 3054
This notice explains how PF2 S.r.l. (“we”), which operates the website https://masonslobster.eu and the restaurants trading as Mason’s Famous Lobster Rolls, processes the personal data of website visitors and customers, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. What data we process
- Browsing data: IP address, browser and device type, pages visited, access time, server logs. Collected automatically to run and secure the website.
- Data you provide through the booking form: first name, surname, phone number, number of guests, date and time, chosen restaurant and useful information (free-text field: please only include what is necessary, e.g. allergies or intolerances).
- Data you provide through the contact, catering and events forms: name, email, phone number, company, content of your request.
- Data you provide by email or phone when you write to the addresses shown on the website or call our restaurants.
- Cookies and measurement tools: see the Cookie Policy.
We do not request payment details through the website. We do not knowingly process data of children under 14: bookings must be made by an adult.
2. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Managing your table booking and contacting you to confirm or change it | Art. 6(1)(b) GDPR – pre-contractual and contractual steps requested by the data subject | 12 months from the booking date |
| Replying to requests for information, catering, events, partnerships | Art. 6(1)(b) and 6(1)(f) GDPR – responding to your request / legitimate interest | 24 months from the last contact |
| Handling unsolicited job applications received by email | Art. 6(1)(b) GDPR and Art. 111-bis of the Italian Privacy Code | 12 months from receipt |
| Website security, fraud and cyber-attack prevention | Art. 6(1)(f) GDPR – legitimate interest | Logs: 12 months, unless needed for legal defence |
| Aggregate website usage statistics (Google Analytics 4) | Art. 6(1)(a) GDPR – consent given via the cookie banner | 14 months |
| Compliance with legal obligations (tax, accounting) and legal defence | Art. 6(1)(c) and 6(1)(f) GDPR | Statutory periods (10 years for accounting records) |
| Marketing communications (newsletter, offers), only if activated | Art. 6(1)(a) GDPR – specific and separate consent | Until consent is withdrawn |
3. Provision of data
Providing the data marked as mandatory in our forms is necessary to process your booking or request; without it we will not be able to handle it. Consent to statistical cookies and to marketing communications is optional and refusing it has no effect on your use of the website or on the restaurant services.
4. Recipients of the data
Data relating to the United Kingdom: personal data provided for bookings, enquiries, catering and events relating to Mason’s restaurants in the United Kingdom is used and processed by Mason’s Lobster UK Ltd and its authorised staff to manage the booking or request and related communications.
Data is processed by authorised staff of PF2 S.r.l. and by the staff of the Mason’s restaurants involved in your booking. It may also be shared with:
- technical service providers appointed as data processors under Art. 28 GDPR: Mason’s EU AG (Zug, Switzerland), which provides hosting and technical maintenance of the website; Google Ireland Ltd (Analytics, Tag Manager, Fonts); Trustindex.io (reviews widget); Defiant Inc. (Wordfence – security); WPMU DEV (Forminator – the software runs on our own server and form data is not transmitted to the vendor);
- group companies: Mason’s EU AG (Zug, Switzerland), licensee of the Mason’s brand for Europe, also for administrative and management-control purposes;
- consultants and professionals (accountants, lawyers) and public authorities where required by law.
Data is never sold or passed on to third parties for marketing purposes.
5. Transfers outside the EU
Some providers are based or host servers outside the European Economic Area. Transfers to the United States (Google LLC, Defiant Inc.) rely on the EU-U.S. Data Privacy Framework adequacy decision or on the Standard Contractual Clauses approved by the European Commission; transfers to Switzerland (Mason’s EU AG, website hosting) and to the United Kingdom are covered by the respective European Commission adequacy decisions. A copy of the safeguards can be requested at info@masonslobster.it.
6. Processing methods and security measures
Data is processed by electronic and paper means, with technical and organisational measures appropriate to the risk: encrypted connection (HTTPS), web application firewall and malware scanning, automatic platform updates, regular backups, administrator authentication and access restricted to authorised staff.
7. Your rights
Under Articles 15-22 GDPR you have the right to access your data, to have it rectified or erased, to restrict processing, to data portability, to object to processing based on legitimate interest and to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. You can write to info@masonslobster.it or by post to the controller’s registered office; we will reply within 30 days. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it) or with the supervisory authority of your country of residence.
8. Automated decision-making
We do not carry out profiling or decisions based solely on automated processing that produce legal effects concerning you.
9. Changes
This notice may be updated; the current version is always published on this page with the date of the last update.
