Privacy policy.

1. Identity and scope

This notice covers listlanternstorypuls.online and its Roma Pasta Café journal. The displayed entity is Listlanternstorypuls Hospitality Ltd, company number 16842073, with the illustrative registered address 42 Bellflower Mews, London EC1R 0LT, United Kingdom. These details are generated and unverified; this website is a café concept, not evidence of an incorporated or operating restaurant.

The notice describes the supplied website’s behaviour. Before commercial operation, the actual operator must verify its controller identity, contact channels, hosting arrangements and retention practices. Do not send sensitive information to an unverified mailbox.

2. Information collection and purposes

There are no accounts, purchases, booking records, marketing sign-ups or advertising profiles. The contact form processes your name, email address, topic and message inside your browser to prepare an email link. Typing or selecting “Prepare email” does not send that information to this website. If you subsequently open your mail application and send the message, your chosen email service processes it and the recipient receives its contents and ordinary email metadata.

A deployed web host may receive IP addresses, requested URLs, timestamps, browser information and security events as part of delivering pages. Those infrastructure records are separate from this site’s JavaScript. Operational purposes may include responding to enquiries, protecting the service and meeting legal obligations; contact information must not be repurposed for unsolicited marketing.

The homepage photograph loads directly from images.unsplash.com. To deliver it, the image provider receives your IP address and ordinary request information, such as browser headers and the requested image URL. The image uses a no-referrer policy so the browser does not send this page’s address with that request. The photograph loads when you visit the homepage, independently of the optional cookie-category choices.

3. Legal bases and browser storage

Where UK GDPR or EU GDPR applies, responding to a requested enquiry may rely on legitimate interests, or steps requested before a contract where relevant. Security processing may rely on legitimate interests, subject to balancing individual rights. Statutory recordkeeping relies on legal obligation. Optional tracking would require valid consent before activation.

This build uses localStorage only to remember cookie preferences. It contains category choices, a policy version and a timestamp—not your form content. No optional analytics, advertising cookies or fingerprinting tools are installed. The cookie policy explains how to change or remove that record.

4. Processors and international transfers

No third-party scripts, remote fonts, embedded maps or payment processors are loaded by the supplied pages. The homepage uses Unsplash’s external image service to display a food photograph; see the Unsplash privacy policy for its data-handling practices. A live deployment will also use a hosting provider and may use an email provider. These providers can act as processors or independent controllers depending on their services. No particular hosting or email vendor or server country is represented as already appointed.

An operating controller must disclose relevant providers, use appropriate processing agreements and assess any international transfers, including those involved in external image delivery. Where required, safeguards may include adequacy decisions, the UK International Data Transfer Agreement or approved standard contractual clauses. We do not sell or share personal information for cross-context behavioural advertising.

5. Retention and security

Browser preferences are treated as expired after 180 days and removed when the site next reads them. Form values are not written to site storage, although your browser may independently offer autofill. A proposed operational schedule is to delete routine enquiries within 12 months after resolution and routine server logs within 30 days, unless a security incident or legal obligation justifies longer retention. These are deployment requirements, not verified provider settings.

Any live service should use HTTPS, limited staff access and protected email accounts. No internet transmission is completely risk-free. Please omit payment details, identity documents and health records from general enquiries.

6. Your rights and privacy contact

Depending on applicable law, you may request access, correction, deletion, restriction or portability, object to certain processing and withdraw consent without affecting earlier lawful processing. California residents may have CCPA/CPRA rights to know, correct and delete information, opt out of sale or sharing, limit qualifying sensitive-data use and receive non-discriminatory treatment. Applicability depends on the actual operator and statutory thresholds.

Address privacy or DPO enquiries to [email protected], marked “Privacy lead”. No statutory Data Protection Officer is currently designated for this concept. A verified operator should respond within applicable deadlines, normally one month under GDPR or 45 days under CCPA, subject to lawful extensions and proportionate identity checks. You may complain to the UK Information Commissioner or your local supervisory authority.