1. Data controller
The controller of the personal data collected through this website is {{TITOLARE_RAGIONE_SOCIALE}} ({{TITOLARE_FORMA_GIURIDICA}}), with registered office at {{TITOLARE_SEDE_LEGALE}}, VAT number {{TITOLARE_PIVA}}.
For any matter concerning your personal data you may write to {{TITOLARE_EMAIL_PRIVACY}}.
Data protection officer (DPO): {{TITOLARE_DPO}}.
Representative in the European Union pursuant to Art. 27 GDPR: {{TITOLARE_RAPPRESENTANTE_UE}}.
2. What this notice covers
This notice concerns the public mayo website, available at mayoeasyorder.com in all its language versions.
It does not cover the mayo application, which is hosted at a different address (app.mayoeasyorder.com) and has its own privacy notice. If you move from the website to the application — for example to sign up — that notice applies from that moment on, not this one.
The public website has no user account area, no contact forms and does not collect your name, your e-mail address or any other data you provide to us directly. Everything described below concerns measurement: understanding how many people visit the website, how it performs technically and — if you consent — which advertising campaign brought you here.
3. Two different regimes, kept apart
Two groups of measurement tools coexist on this website. They follow opposite rules, and this notice deliberately keeps them apart, because that difference is the most important thing for you to know.
| Layer 1 | Layer 2 | |
|---|---|---|
| Tools | Vercel Web Analytics, Vercel Speed Insights | Google Analytics 4, Meta pixel |
| Consent | Not required: always active | Required: nothing runs before it |
| Cookies or storage on your device | None | Yes, after consent |
| Where it is described | Section 4 | Section 5 |
The two sections that follow describe each layer in full. They are not summaries: they are the complete description.
4. Layer 1 — always-on measurement, without cookies
Regime of this section: these tools operate on every visit, from the very first moment, without asking for your consent and without writing anything to your device.
4.1 Which tools these are
They are two components provided by Vercel Inc., the supplier that hosts and delivers this website: @vercel/analytics (Vercel Web Analytics) and @vercel/speed-insights (Vercel Speed Insights). The first counts page views; the second measures how fast pages load in your browser.
4.2 Why they run without consent, and how we reached that choice
We tell you openly how matters stand, because on this layer it is that transparency — not a button — that is the safeguard we offer you.
The European rules on cookies (Art. 5(3) of the ePrivacy Directive and the national laws implementing it) provide, in some Member States, for an exemption from consent for audience measurement statistics alone, where such measurement is limited in scope, is not used to profile anyone and is not shared with third parties for other purposes.
Before publishing the website we assessed whether these two tools fall within that exemption in the five markets in which we operate (Italy, France, Germany, Spain and the rest of the European Union). The assessment did not produce a single, settled answer: the positions taken by the national supervisory authorities do not coincide, and none of them has ruled on these specific tools.
Faced with an unsettled outcome we chose to keep them active — because they measure the technical quality of the website across all visitors, not across a sample — and to state that here explicitly and in full, rather than present to you as settled a question that is not. This section is precisely that choice.
We do not rely on legitimate interests as the legal basis for this processing: the position we take is the one described above, namely that this is audience measurement exempt from consent, and we state it for what it is — a reasoned position, not a certainty. The decision, with the full reasoning, is recorded in our internal documentation (ADR-20260731-site-measurement-consent-posture).
If you consider that this processing should not concern you, write to us at {{TITOLARE_EMAIL_PRIVACY}}: we will assess your request.
4.4 Which data are collected
The two tables below set out the information which, according to the Vercel documentation cited above, accompanies each measurement.
Vercel Web Analytics:
| Data point | Example |
|---|---|
| Time of the event | 2020-10-29 09:06:30 |
| Page URL | /blog/nextjs-10 |
| Dynamic route | /blog/[slug] |
| Referring page (referrer) | https://news.ycombinator.com/ |
| Query parameters (filtered) | ?ref=hackernews |
| Geolocation | US, California, San Francisco |
| Operating system and version | Android 10 |
| Browser and version | Chrome 86 (Blink) |
| Device type | Mobile (or Desktop/Tablet) |
| Version of the measurement script | 1.0.0 |
Vercel Speed Insights:
| Data point | Example |
|---|---|
| Route | /blog/[slug] |
| Page URL | /blog/nextjs-10 |
| Network speed | 4g (or slow-2g, 2g, 3g) |
| Browser | Chrome 86 (Blink) |
| Device type | Mobile (or Desktop/Tablet) |
| Operating system | Android 10 |
| Country (ISO 3166-1 alpha-2) | US |
| Performance indicator (Web Vital) | FCP 1.0s |
| Element the indicator refers to | html>body img.header |
| Package version | @vercel/speed-insights 0.1.0 |
| Time of receipt on the server | 2023-10-29 09:06:30 |
We do not use the custom events feature and we do not transmit to Vercel any e-mail addresses, names, user identifiers or other data relating to you personally.
4.5 Who processes these data, and where
Vercel Inc. is a supplier established in the United States, acting as a processor on our behalf (Art. 28 GDPR) and in turn relying on its own sub-processors.
The relationship is governed by Vercel's Data Processing Addendum (https://vercel.com/legal/dpa), which states: «Vercel's primary processing facilities are in the United States» and that, for transfers from the European Economic Area, «the Standard Contractual Clauses will apply». The transfer to the United States therefore takes place on the basis of the Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR), incorporated into that addendum.
4.6 For how long
The derived code identifying a visit session is automatically discarded after 24 hours, as stated by Vercel in the passage quoted under point 4.3. The resulting statistics are retained in aggregate form and do not allow any individual person to be identified.
5. Layer 2 — measurement and marketing subject to your consent
Regime of this section: none of these tools is loaded, contacted or executed before you have given consent to the corresponding category. If you do not consent, not even a single network request goes out to these providers.
5.1 Which tools these are, and which consent governs them
Two consent categories, independent of each other: accepting one never activates the other.
| Category | Tool it governs | Purpose |
|---|---|---|
analytics | Google Analytics 4 | Browsing statistics: which pages are viewed, which buttons are used, in which language |
marketing | Meta pixel and Conversions API (Facebook and Instagram) | Measuring the performance of our advertising campaigns and attributing a sign-up to the ad that generated it |
The marketing category also governs advertising click identifiers (gclid, fbclid, msclkid): when you reach the website from an ad, your address may contain one of these codes. It is passed on to the application only if you have granted marketing consent; without consent it is stripped and goes no further.
5.2 How the block works technically
When any page opens, the first script in the document declares all consent signals as denied: analytics_storage, ad_storage, ad_user_data, ad_personalization. From that moment nothing can activate until you express a choice.
The Google and Meta scripts are not present in the page and are not downloaded: they are requested only at the moment you grant consent, and only the one belonging to the category granted. These are not tools that are loaded and then muted: before consent they do not exist in the page.
5.3 How you give, change and withdraw consent
You express your choice through the banner shown on your first visit. You can accept everything, refuse everything, or choose category by category.
You can change your mind at any time through the permanent link “Manage cookie preferences”, present in the footer of every page of the website: it reopens the same panel and the new choice replaces the previous one. Withdrawing is as easy as consenting.
Withdrawal takes effect for the future: it stops any further data being sent, but does not affect the lawfulness of processing already carried out on the basis of consent given previously (Art. 7(3) GDPR).
Information on how your choice is stored, and on the cookies set after consent, is in the Cookie Policy.
5.4 Legal basis
Your consent, pursuant to Art. 6(1)(a) GDPR and Art. 5(3) of the ePrivacy Directive as implemented in your country. Consent is collected per category and retained together with proof of when it was given and against which version of the banner it was expressed.
5.5 Who processes these data, and where
Google. Google Analytics 4 is provided by Google, which acts as a processor on our behalf under the Google Ads Data Processing Terms (https://business.safety.google/adsprocessorterms/), which expressly list «Google Analytics» among the Processor Services and incorporate the Standard Contractual Clauses for transfers to third countries.
Meta. The pixel is provided by Meta Platforms Ireland Limited. For the data collected through Meta's Business Tools, we and Meta act as joint controllers within the meaning of Art. 26 GDPR, under the Controller Addendum incorporated into the Meta Business Tools Terms (https://www.facebook.com/legal/controller_addendum). Joint controllership covers the collection of the data on the website and their transmission to Meta; the processing Meta subsequently carries out for its own purposes is governed by Meta's own privacy notice and falls under its sole responsibility.
Both providers may also process the data outside the European Economic Area: see section 8.
5.6 For how long
The retention periods for the data collected through Google Analytics 4 and through the Meta pixel are determined by the settings and terms of the respective providers. The storage of your consent choice on your device is described in the Cookie Policy.
6. From the website to the application
When you move from the website to the application (app.mayoeasyorder.com) — for example by pressing a sign-up button — we pass on to the destination address:
- the aggregate campaign parameters that may be present in your address (
utm_source,utm_medium,utm_campaign,utm_content,utm_term): they do not identify a person and are passed on in every case; - the advertising click identifiers (
gclid,fbclid,msclkid) only if you have grantedmarketingconsent; - your consent state, expressed as one of the five words
unset,denied,analytics,marketing,granted. It is a status indication and never a code that identifies you: it tells the application what it is allowed to do.
None of this is saved on your device so as to survive your browsing session: the parameters are read from the address of the current page and nothing more.
7. Hosting and delivery of the pages
The website is hosted and delivered by Vercel Inc. (United States), which acts as a processor on our behalf. Like any web infrastructure provider, it processes the technical data necessary to deliver the pages to you and to keep the service secure, including your IP address. The relationship is governed by the Data Processing Addendum cited under point 4.5.
8. Transfers outside the European Economic Area
| Provider | Country | Transfer mechanism |
|---|---|---|
| Vercel Inc. | United States | Standard Contractual Clauses incorporated into Vercel's DPA (https://vercel.com/legal/dpa) |
| United States and other countries | Standard Contractual Clauses incorporated into the Google Ads Data Processing Terms | |
| Meta Platforms Ireland Limited | Ireland, with transfers to the United States | Mechanisms provided for by the Meta Business Tools Terms and the related European data transfer addendum |
You may ask us for a copy of the applicable safeguards by writing to {{TITOLARE_EMAIL_PRIVACY}}.
9. Your rights
Within the limits laid down by Arts. 15-22 GDPR you have the right to:
- access the data concerning you and obtain a copy of them;
- request their rectification where they are inaccurate;
- request their erasure;
- request the restriction of processing;
- receive the data in a structured format and transmit them to another controller (portability), where processing is based on consent;
- withdraw your consent at any time, in the manner described under point 5.3, without affecting the lawfulness of processing carried out before withdrawal.
One honest clarification: the data described in section 4 are collected in aggregate form and do not allow us to trace them back to you. In those cases, if you do not provide us with information enabling us to identify you, we are materially unable to isolate "your" data in order to act on your request (Art. 11 GDPR) — and we will not ask you for additional data for the sole purpose of making that search possible.
To exercise your rights, write to {{TITOLARE_EMAIL_PRIVACY}}. We reply within one month of the request.
10. Complaint to a supervisory authority
If you consider that the processing of your data infringes data protection law, you may lodge a complaint with the supervisory authority of the Member State of your residence, place of work or of the place of the alleged infringement (Art. 77 GDPR). The list of the national supervisory authorities of the European Union is published by the European Data Protection Board (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en).
11. Minors
The website is addressed to professionals and businesses in the food service sector and is not directed at minors. We do not knowingly collect data relating to minors.
12. Changes to this notice
If the tools described above change, or the purposes for which we use them change, we update this notice and, where the change concerns the tools subject to consent, we ask you to make your choice again by presenting the banner anew.
Last updated: {{DATA_ULTIMO_AGGIORNAMENTO}}.