Privacy Policy
Last updated: 2026-09-19
This policy explains how we process data on the Mamma Mia website: accounts, reservations, the waitlist, messages and privacy requests. This first release does not accept orders or payments.
Data controller
LA GASTRONOMIA ITALIANA S.A., corporate identification number 3-101-897637, operates Mamma Mia and is responsible for its customer and request databases. Address: Centro Comercial Vistana Oeste, frente a Starbucks. Lindora, Santa Ana, 10903 San José, Costa Rica.. You can exercise your rights using the form at the end of this page or submit a written request at the restaurant.
Data we collect
For an account, we use your email, the profile details you provide and verification and preference records. For reservations and the waitlist, we store your name, email, phone when requested, date, time, party size, seating area, reservation status and history, and any notes you send. Birthday day and month and notes are optional; your birth year is not needed. We also store your chosen language and marketing preference.
The contact form requests your name, email, phone and message. The privacy form requests your name, verified email, request type and description. We also record technical data needed for security and operation, such as IP address, date, browser, error codes and access logs. Do not include passwords, card numbers, identity documents or sensitive information in messages. Privacy requests include the signed PDF you upload, its signature and authentication details, and verification and receipt records. We retain the original document to review and document the request. The PDF includes the requester’s identity document type and number, to check when reviewing the signature. You can provide an optional contact phone number in the privacy form.
Purpose of processing
We use this data to verify account access; create, view and manage reservations and the waitlist; answer messages and requests; prevent abuse and investigate errors. We may link reservations to your profile using your verified contact details. Verification, confirmation, change and visit follow-up emails are service messages and do not depend on a marketing subscription.
Email news and promotions are optional. The signup checkbox is selected by default: you can clear it before finishing. We record your choice; it is not required to create an account or reserve a table. Withdraw permission using the unsubscribe link in each promotional email or the privacy form. We do not sell your data.
Legal basis and consent
We explain how data is used before requesting it. Required fields are needed to handle that service; without them we cannot process the request. Optional fields and marketing permission are not conditions of service. You can withdraw consent without affecting previous processing; we may retain records required by law. Browsing the site does not authorize promotions.
Access and processing locations
Authorized staff handling reservations, messages, privacy and support can access the data they need. We use hosting, database, email, abuse protection and technical monitoring providers, including Amazon Web Services, Neon, Cloudflare and Sentry when configured. They may process data outside Costa Rica to provide these services. We limit access to what is necessary and require protection and confidentiality. We may also disclose information when legally required.
Links to Uber Eats, maps or social networks lead to external services with their own policies. Displaying a link alone does not send them your profile or reservation.
Data retention
We keep data while needed to handle your account, reservation, message or request, comply with legal obligations or resolve claims. We review deletion requests and remove or anonymize data no longer needed; if some records must be kept, we will explain why. Consent and request records document what was handled. Restricted-access backups may retain earlier versions until rotation. Verification codes expire within the period stated in the email and work only once.
Cookies and security
We use cookies and browser storage for your session, language and site functions. Cloudflare Turnstile protects forms against automated abuse. With your permission, Google Analytics uses cookies to measure visits to public pages. You can reject analytics or withdraw permission through “Cookie preferences” in the footer. We do not use this information for advertising. Blocking necessary storage may prevent sign-in or other functions.
Your rights as a user
You can request access, correction, updating or deletion of your data and withdraw consent, free of charge. We will resolve the request as appropriate within five business days of receipt. We verify identity proportionately before disclosing or changing information; verifying an email alone does not establish ownership of every requested record. You can contact Costa Rica’s data protection authority, PRODHAB, if you believe your rights have been infringed.
Contact and request channel
Complete your details online and download the completed PDF. Sign it digitally or have your handwritten signature authenticated by a lawyer, upload it and confirm the code sent to your email. Only then do we record and relay the document to the responsible team. No account is required. We check the signature before disclosing or changing data; the code only confirms the email. If you cannot access the original email or use this process, you can submit a written request at the restaurant for identity review. Policy changes will appear here with an updated date.