Privacy Policy and Cookie Policy
Last updated: 25 May 2026
This notice applies to the websites and online services related to Cactus Milano, including:
- https://www.cactusmilano.it
- https://cactusmilano.it
- https://landing.cactusmilano.it
- landing pages, advertising campaign pages and promotional pages connected to the domains listed above.
This notice explains how personal data is processed when users visit the website, use the landing pages, click booking links, subscribe to the newsletter, interact with social channels or contact Cactus Milano.
Privacy Policy
1. Data Controller
The Data Controller is:
FRESH START S.R.L.
Registered office: Via Varese 4, 20121 Milan, Italy
VAT number: 12137260969
Email: info@cactusmilano.it
Website: https://www.cactusmilano.it
In this document, “Cactus Milano”, “we”, “us”, “our” or “Data Controller” refers to FRESH START S.R.L.
2. Privacy contact
For any request regarding the processing of personal data or to exercise your rights under privacy law, you may contact us at:
Suggested subject line: “Privacy request”.
3. Data Protection Officer
The Data Controller has not appointed a Data Protection Officer, as at the date of the latest update of this notice such appointment is not mandatory under EU Regulation 2016/679, known as the GDPR.
If a Data Protection Officer is appointed in the future, the relevant contact details will be published on this page.
4. Scope of this notice
This notice applies to processing activities carried out through:
- the main website www.cactusmilano.it;
- the domain cactusmilano.it;
- the subdomain landing.cactusmilano.it, used for landing pages and advertising campaigns;
- any temporary or promotional pages connected to online campaigns;
- links to booking platforms, newsletter services, social networks, maps, review platforms and third party services.
This notice does not directly govern third party websites, apps or platforms, which remain subject to their own privacy notices.
5. Categories of personal data processed
5.1 Browsing data
When users visit Cactus Milano websites and landing pages, IT systems may process technical data necessary for browsing, including:
- IP address;
- date and time of the visit;
- pages visited;
- referrer URL;
- browser type;
- operating system;
- device used;
- browser language;
- technical data relating to the operation and security of the website;
- system logs.
This data is necessary to allow browsing, keep the website secure, prevent misuse and obtain technical information on the proper functioning of the pages.
5.2 Data collected through landing pages and advertising campaigns
The subdomain landing.cactusmilano.it may be used for advertising campaigns, promotions, online ads, sponsored content and landing pages.
When a user reaches a landing page through an advertising campaign, the following data may be processed:
- referring page;
- campaign source;
- URL parameters, such as utm_source, utm_medium, utm_campaign, utm_content, utm_term;
- advertising click identifiers, such as gclid, fbclid, msclkid or similar identifiers, when present in the URL;
- interactions with the landing page;
- clicks on buttons, menus, booking links, telephone links, WhatsApp links or other calls to action;
- statistical data relating to conversions, where analytics or advertising tools are active and the user has given consent where required.
Campaign parameters are used to understand which ad or channel the user came from and to measure campaign performance. The use of non technical cookies, pixels or tracking tools takes place only after the user has given consent.
5.3 Data voluntarily provided by the user
When a user contacts Cactus Milano by email, telephone, WhatsApp, form, social network or other channels, the following data may be processed:
- first name and last name;
- email address;
- telephone number;
- message content;
- any information voluntarily provided by the user;
- data contained in attachments or spontaneous communications.
5.4 Booking data
To manage bookings, including through third party platforms such as SevenRooms, the following data may be processed:
- first name and last name;
- email address;
- telephone number;
- booking date and time;
- number of guests;
- table or service preferences;
- special requests;
- booking history, where managed by the platform;
- any communications relating to the booking.
If the user voluntarily enters information about allergies, intolerances, dietary requirements, health conditions, religious beliefs or ethical preferences, such information may reveal special categories of personal data. This data should be provided only where necessary to manage the booking or the requested service.
5.5 Newsletter and promotional communication data
If the user subscribes to the newsletter or agrees to receive promotional communications, the following data may be processed:
- email address;
- first name;
- last name;
- date of birth, if provided;
- date and time of subscription;
- IP address used at the time of subscription, if recorded by the system;
- proof of consent;
- communication preferences;
- unsubscribe data;
- data relating to email opens, clicks and interactions, where such features are active and the user has given consent where required.
Newsletter subscription is optional. The user may withdraw consent at any time by using the unsubscribe link included in the communications or by writing to info@cactusmilano.it.
5.6 Data processed through WhatsApp, telephone, email and social networks
If the user contacts Cactus Milano through WhatsApp, telephone, email, Instagram, Tripadvisor or other external platforms, the data necessary to respond and manage the communication will be processed.
External platforms also process data according to their own privacy notices, over which Cactus Milano has no direct control.
5.7 Data relating to events, business requests, press and collaborations
In the case of requests relating to events, corporate dinners, brunches, aperitifs, collaborations, press activities, shootings, partnerships or promotional initiatives, the following data may be processed:
- identification data;
- contact details;
- company or organization;
- role or position;
- organizational information;
- event preferences;
- administrative and tax data, where necessary;
- content of communications.
5.8 Administrative, accounting and tax data
If services, events, experiences, products, gift cards or other paid services are purchased, data necessary for administrative, accounting, tax and contractual purposes may be processed.
Complete payment card data, where payment is managed by external providers, is processed directly by the relevant payment providers according to their own privacy notices.
6. Purposes, legal bases and retention periods
| Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|
| Allow browsing of the website and landing pages | Browsing data, technical logs, technical cookies | Legitimate interest of the Data Controller and technical necessity of the service | For the time necessary for the technical operation of the website. Technical logs are kept for limited periods compatible with security and maintenance needs. |
| IT security and prevention of misuse | IP address, logs, technical data, security events | Legitimate interest of the Data Controller | For the time necessary for security, fraud prevention or investigation of possible unlawful conduct. |
| Respond to requests received by email, telephone, WhatsApp, social networks or other channels | Contact details and content of the request | Performance of pre contractual or contractual measures requested by the user | For the time necessary to handle the request and, as a rule, up to 12 months after closure of the request, unless legal obligations or protection of rights require otherwise. |
| Manage bookings and restaurant related requests | Identification data, contact details, booking data, notes | Performance of pre contractual or contractual measures | For the time necessary to manage the booking and subsequently for administrative needs, internal statistics, protection of rights or legal obligations. |
| Manage allergies, intolerances or dietary requirements voluntarily communicated | Any special categories of data entered by the user | Explicit consent of the user and need to manage the requested service | Only for the time necessary to manage the booking or service, unless disputes, legal obligations or protection of rights require otherwise. |
| Manage landing pages and advertising campaigns | URL parameters, campaign source, interaction data, click identifiers | Legitimate interest for technical data and consent for non technical tracking tools | Technical data is kept for limited periods. Data processed through analytics or advertising tools follows the settings of the relevant tools and the user’s consent. |
| Measure website and landing page performance | Analytics data, events, conversions, interactions | Consent, unless analytics are configured as technical according to applicable law | According to the duration of the tools used and in compliance with the principle of data minimization. |
| Measure and optimize online advertising campaigns | Conversion events, clicks, advertising identifiers, aggregated campaign data | User consent for cookies, pixels and non technical tools | According to the settings of the advertising platforms and until consent is withdrawn. |
| Send newsletters, offers, event invitations and promotional communications | Email, first name, last name, preferences, proof of consent | User consent | Until consent is withdrawn or the user unsubscribes. Proof of consent may be retained to protect the Data Controller. |
| Measure newsletter opens, clicks and interactions | Email interaction data and technical identifiers | User consent where required | Until consent is withdrawn or the user unsubscribes, subject to retention of data necessary to prove the lawfulness of processing. |
| Manage events, business requests, press and collaborations | Identification data, contact details, organizational information | Pre contractual measures, contract or legitimate interest | For the time necessary to manage the request and, as a rule, up to 24 months, unless obligations or protection of rights require otherwise. |
| Comply with administrative, accounting and tax obligations | Personal, tax, contractual and transactional data | Legal obligation | For the periods required by civil and tax law, as a rule up to 10 years. |
| Establish, exercise or defend legal claims | Data necessary to manage the dispute | Legitimate interest of the Data Controller | For the time necessary to protect the right and according to applicable limitation periods. |
7. Nature of data provision
Providing technical data necessary for browsing is essential to use the website and landing pages.
Providing data required for bookings, contact requests, events or services is necessary to handle the user’s request. Without such data, Cactus Milano may be unable to respond or provide the requested service.
Providing data for newsletters, marketing, non technical analytics, advertising and non necessary cookies is optional. Refusing consent does not prevent browsing of the website or use of essential services.
8. Processing methods
Personal data is processed using electronic, IT and, where necessary, paper based tools, in accordance with the principles of lawfulness, fairness, transparency, minimization, accuracy, integrity, confidentiality and storage limitation.
The Data Controller adopts appropriate technical and organizational measures to protect personal data against loss, unauthorized access, misuse, disclosure, alteration or destruction.
9. Recipients of personal data
Personal data may be processed by:
- staff and collaborators authorized by Cactus Milano;
- hosting, technical maintenance and security providers;
- providers managing the website, landing pages and consent tracking systems;
- marketing agencies, web agencies and digital consultants engaged for technical or advertising management;
- booking platforms, including SevenRooms;
- newsletter and marketing automation platforms, including Mailchimp;
- analytics and advertising providers, including Google, Meta or other providers used for online campaigns, only within the limits of the active settings and the user’s consent where required;
- email, cloud, backup, CRM, security and management tool providers;
- tax, accounting, legal and administrative consultants;
- public authorities, bodies or legitimate recipients, where required by law;
- social platforms, messaging systems and third party websites when the user voluntarily chooses to interact with such services.
Where a provider processes data on behalf of the Data Controller, it is appointed as data processor under Article 28 GDPR, where required. The updated list of processors may be requested by writing to info@cactusmilano.it.
10. Third party services
10.1 SevenRooms
Cactus Milano uses or may use SevenRooms to manage online bookings. When the user clicks booking buttons or completes a booking through SevenRooms, the data necessary for the booking may be processed by SevenRooms and shared with Cactus Milano to manage the requested service.
SevenRooms may process data such as first name, last name, email, telephone number, booking date and time, number of guests, preferences and notes entered by the user.
SevenRooms Privacy Policy:
https://sevenrooms.com/privacy-policy/
10.2 Mailchimp
Cactus Milano uses or may use Mailchimp to manage newsletters, contact lists, promotional communications and online subscriptions.
Mailchimp may process data such as email, first name, last name, preferences, date and time of subscription, proof of consent and interaction data with communications, such as opens and clicks, where such features are active.
Intuit Mailchimp Privacy Statement:
https://www.intuit.com/privacy/statement/
Mailchimp Data Processing Addendum:
https://mailchimp.com/legal/data-processing-addendum/
10.3 Google Analytics
Cactus Milano uses or may use Google Analytics to measure visits, page views, events, interactions and performance of the website and landing pages.
If Google Analytics is configured with cookies or identifiers that are not strictly technical, it is activated only after the user has given consent through the cookie banner.
10.4 Google Ads and conversion measurement tools
For advertising campaigns, including the promotion of landing pages such as landing.cactusmilano.it, Cactus Milano may use Google Ads and related conversion measurement tools.
These tools may process data relating to ad clicks, campaign parameters, advertising identifiers, landing page visits, button interactions and conversions, such as clicks on “Book”, telephone links, menu links or other calls to action.
Advertising cookies, tags or non technical tracking tools are loaded only after the user has given consent.
10.5 Meta, Instagram and social advertising tools
Cactus Milano may use Meta, Instagram or related tools for social content, advertising campaigns, conversion measurement and remarketing.
If pixels, events or similar tools are active, they are loaded only after the user has given consent, where required by law.
10.6 Google Fonts
The website may use Google Fonts to display typefaces. When fonts are loaded from Google servers, the user’s browser may send technical data necessary for loading, including the IP address, to Google.
To reduce the privacy impact, Cactus Milano may choose to host fonts locally on its own server or through controlled infrastructure.
10.7 Google Search Console
Google Search Console may be used by the Data Controller to monitor the website’s presence in Google search results. It is a tool used on the website administrator side and, as a rule, does not require cookies to be installed in the user’s browser.
10.8 WhatsApp, Instagram, Tripadvisor and external links
The website and landing pages may contain links to WhatsApp, Instagram, Tripadvisor and other external platforms.
When the user clicks such links, the user accesses services managed by third parties. From that moment, data processing is also governed by the privacy notices of the relevant platforms.
11. Transfers of data outside the European Economic Area
Some providers used by Cactus Milano may process personal data in countries located outside the European Economic Area, including the United States.
In such cases, the transfer takes place on the basis of safeguards provided for by the GDPR, such as:
- adequacy decisions of the European Commission;
- Data Privacy Framework, where applicable;
- standard contractual clauses approved by the European Commission;
- supplementary technical, contractual and organizational measures;
- other transfer conditions provided for by applicable law.
The user may request further information on transfers by writing to info@cactusmilano.it.
12. Minors
Cactus Milano’s website and landing pages are not specifically intended for children under the age of 14. We do not knowingly collect personal data from minors for marketing purposes without the consent of the holder of parental responsibility, where required by law.
If a parent or guardian believes that a minor has provided personal data without authorization, they may contact us at info@cactusmilano.it to request deletion.
13. Automated decision making and profiling
Cactus Milano does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the user.
Marketing segmentation or measurement activities may be used, for example to distinguish users coming from different campaigns, measure conversions or send more relevant communications to newsletter subscribers. Such activities are carried out in compliance with applicable law and, where required, only after the user has given consent.
14. Rights of the data subject
The user may exercise, where provided for by the GDPR, the following rights:
- right of access to personal data;
- right to rectification of inaccurate data;
- right to erasure;
- right to restriction of processing;
- right to object;
- right to data portability;
- right to withdraw consent at any time;
- right to lodge a complaint with the Italian Data Protection Authority.
To exercise these rights, the user may write to:
The Data Controller will respond within the time limits provided for by applicable law. Before handling the request, the Data Controller may ask for information necessary to verify the identity of the requester.
15. Complaint to the Supervisory Authority
If the user believes that the processing of personal data violates applicable law, they may lodge a complaint with the Italian Data Protection Authority.
Website of the Italian Data Protection Authority:
https://www.garanteprivacy.it
16. Changes to the Privacy Policy
The Data Controller may update this notice to reflect legal, technical, organizational or service related changes.
The updated version will be published on this page with the date of the latest update.
Cookie Policy
1. What cookies are
Cookies are small text files that websites visited by the user send to the device used for browsing, where they are stored and then sent back to the same websites on the next visit.
Technologies similar to cookies may include pixels, tags, online identifiers, local storage, session storage, SDKs, fingerprinting and other tools that allow information to be stored on or read from the user’s device, or that allow user behavior to be monitored.
In this document, the term “cookies” also includes similar technologies, where applicable.
2. Where cookies and similar tools are used
This Cookie Policy applies to:
- www.cactusmilano.it;
- cactusmilano.it;
- landing.cactusmilano.it;
- landing pages and promotional pages connected to Cactus Milano advertising campaigns.
3. Types of cookies used
3.1 Strictly necessary technical cookies
These cookies are essential to allow browsing, ensure website security, remember privacy preferences, manage sessions and provide essential functions.
These cookies do not require the user’s consent, but they are described in this notice.
3.2 Preference cookies
These cookies allow the website to remember certain user choices, such as language, display settings or browsing preferences.
When they are not strictly necessary, they are used only after consent.
3.3 Analytics cookies
Analytics cookies are used to collect statistical information on the use of the website and landing pages, such as number of visitors, page views, traffic sources, interactions and conversions.
Third party analytics tools are used without consent only when configured in a way that meets the legal requirements for being treated as technical cookies. In all other cases, they are activated only after the user has given consent.
3.4 Marketing, advertising and profiling cookies
These cookies are used to measure advertising campaigns, create custom audiences, perform remarketing, attribute conversions, show relevant ads or track users across different websites and platforms.
These cookies and similar tools are used only after the user has given consent.
3.5 Third party services
The website and landing pages may include links, fonts, booking systems, newsletters, social networks, reviews, analytics tools, advertising tools and other services provided by third parties.
When such services involve cookies or non technical tracking tools, they are activated only after consent.
4. Consent management
On the first visit, the user must be able to freely and knowingly choose whether to accept, reject or customize non necessary cookies.
The cookie banner must include at least:
- an “Accept all” button;
- a “Reject all” button;
- a “Customize” button;
- a link to the Privacy Policy and Cookie Policy;
- a short explanation of the purposes.
Simply continuing to browse, scrolling the page or closing the banner without a positive choice does not constitute consent to the use of non technical analytics, marketing or profiling cookies.
The user may change or withdraw consent at any time through the “Change cookie preferences” link or button available in the website footer or on this page.
5. Duration of stored preferences
The user’s cookie preferences are stored to avoid showing the banner at every visit.
The banner may be shown again when:
- at least 6 months have passed since the previous choice;
- the processing conditions change significantly;
- new tools or new purposes are introduced;
- the user deletes cookies from the browser;
- it is technically impossible to recognize the previous choice.
6. Table of cookies and tools used
The following table describes the categories of cookies and tools that Cactus Milano uses or may use on its websites, including advertising landing pages. The actual loading of non technical tools depends on the active website settings and on the consent given by the user.
| Category | Tool or service | Provider | Purpose | Legal basis | Indicative duration |
|---|---|---|---|---|---|
| Strictly necessary technical cookies | Session cookies, security, website operation, consent management | Cactus Milano, hosting provider, CMP provider | Allow browsing, security, storage of privacy preferences | Technical necessity and legitimate interest | Session or up to 6 months for the cookie choice |
| Strictly necessary technical cookies | Technical server logs | Hosting and technical providers | Security, maintenance, error diagnosis, prevention of misuse | Legitimate interest | For limited periods compatible with security and maintenance |
| Preferences | Language preference or browsing settings | Cactus Milano or technical provider | Remember user choices | Technical necessity or consent, depending on function | Session or limited period |
| Analytics | Google Analytics | Google Ireland Limited and Google group companies | Measure visits, interactions, traffic sources, page and landing performance | Consent, unless technically compliant configuration applies | According to Google Analytics configuration, normally up to 14 months or according to active settings |
| Advertising | Google Ads, conversion tracking, advertising tags | Google Ireland Limited and Google group companies | Measure campaigns, attribute conversions, optimize ads, remarketing | Consent | According to Google settings and applicable advertising cookie duration |
| Advertising and social | Meta Pixel, Instagram, Facebook Ads or similar tools | Meta Platforms Ireland Limited and Meta group companies | Social campaign measurement, remarketing, custom audiences, conversions | Consent | According to Meta settings and applicable advertising cookie duration |
| Campaigns and landing pages | UTM parameters, gclid, fbclid, msclkid and similar identifiers present in URLs | Cactus Milano, Google, Meta, Microsoft or other advertising channels | Understand where the user comes from and measure campaign effectiveness | Legitimate interest for technical reading of the parameter, consent for connected non technical tracking | Variable depending on the tool and configuration |
| Newsletter | Mailchimp | Intuit Mailchimp | Manage subscriptions, send emails, handle unsubscribes, store proof of consent, communication statistics | Consent | Until unsubscribe or withdrawal of consent, subject to retention of proof of consent |
| Bookings | SevenRooms | SevenRooms LLC | Manage bookings, availability, confirmations, notes and table requests | Pre contractual measures, contract and, for voluntarily provided special data, explicit consent | According to booking needs, customer management and applicable obligations |
| Fonts and graphic resources | Google Fonts | Google Ireland Limited and Google group companies | Display website fonts, if loaded from Google servers | Legitimate interest or consent depending on technical configuration | Technical data processed at the time of loading |
| External links | WhatsApp, Instagram, Tripadvisor and other links | Meta, Tripadvisor and other third party providers | Allow the user to contact Cactus Milano or visit external profiles | Voluntary action of the user | According to the privacy notices of the third party platforms |
7. Analytics cookies
Cactus Milano may use analytics tools to understand how users use the main website and landing pages, including landing.cactusmilano.it.
When analytics tools are configured to collect online identifiers, non aggregated data or information that can be used for further purposes, they are loaded only after consent.
8. Advertising cookies and ad campaigns
Landing pages, including landing.cactusmilano.it, may be used for Google Ads, Meta Ads, Instagram Ads or other digital campaigns.
Advertising tools may be used to:
- measure how many people reach the landing page from a campaign;
- understand which ads generate clicks or bookings;
- measure conversions such as clicks on “Book now”, telephone links, WhatsApp links or menu opening;
- create remarketing audiences;
- optimize advertising campaigns;
- avoid showing irrelevant ads.
Cookies, pixels, tags and similar tools used for advertising or remarketing are loaded only after the user has given consent.
9. Connected external services
9.1 SevenRooms
Booking links may direct the user to the SevenRooms platform. Once the user clicks the link or completes the booking, processing also takes place according to SevenRooms’ privacy policy.
SevenRooms Privacy Policy:
https://sevenrooms.com/privacy-policy/
9.2 Mailchimp
Newsletter subscription may be managed through Mailchimp. Mailchimp processes data on behalf of the Data Controller and, in some cases, according to its own responsibilities set out in its notices.
Intuit Mailchimp Privacy Statement:
https://www.intuit.com/privacy/statement/
Mailchimp Data Processing Addendum:
https://mailchimp.com/legal/data-processing-addendum/
9.3 Google
Google may provide analytics, advertising, font, search and measurement services. The use of Google tools involving non technical cookies or tracking takes place after consent.
Google Privacy Policy:
https://policies.google.com/privacy
9.4 Meta
Meta may provide social and advertising services through Facebook, Instagram, Meta Pixel and related tools. The use of Meta tools involving non technical cookies or tracking takes place after consent.
Meta Privacy Policy:
https://www.facebook.com/privacy/policy/
10. How to change cookie preferences
The user may change or withdraw consent at any time by clicking the “Change cookie preferences” link in the website footer.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
11. Managing cookies through the browser
The user may also manage, block or delete cookies through the browser settings.
Disabling technical cookies may affect the operation of the website or some of its features.
Useful links:
- Google Chrome: https://support.google.com/chrome/answer/95647
- Mozilla Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
- Apple Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac
- Microsoft Edge: https://support.microsoft.com/microsoft-edge
12. Updates to the Cookie Policy
This Cookie Policy may be updated in case of technical changes, introduction of new tools, changes in providers or legal updates.
When changes require new consent, the website may display the cookie banner again.