Privacy notice

BORRADOR / DRAFT, pending review. This text is a draft under review and is not yet a final legal text. The Spanish version prevails.

Version: draft-1 (2026-10-24)

FIRST LAYER: the essentials

Who is responsible for your data: the restaurant you order from (its identity details are in the legal notice of this website). The platform that hosts this website, [LEGAL NAME], handles the data on behalf of the restaurant and only on its instructions.

What we use your data for: to prepare and deliver your order, take payment, tell you about its status, and meet the restaurant's invoicing and accounting duties. If you tick the box, the restaurant may also send you offers by email.

Your rights: you can ask for access, correction, erasure, objection, restriction and portability, and withdraw your marketing permission at any time. See section 9. If you disagree with the answer, you can complain to the Spanish Data Protection Agency (www.aepd.es).

SECOND LAYER: the detail

1. Controller

The controller is the restaurant that owns this website, identified in the legal notice (name or company name, tax ID, address and contact). For questions about your data, write to the contact shown there.

2. Processor

[LEGAL NAME], tax ID [NIF], address [REGISTERED ADDRESS], registry data [REGISTRY DATA], email [PRIVACY CONTACT EMAIL], phone [PHONE], data protection officer: [DPO: none / name]. It provides the ordering platform to the restaurant. It does not use your data for its own purposes.

3. What data we handle

Contact details of the order: name, email and phone. Order data: what you order, the pickup or delivery time, the address and delivery notes, your notes for the kitchen, and the tip if you give one. Payment status. Your marketing permissions (accepted wording, date and where you gave them).

We do not store your card details: Stripe handles the payment. We do not build profiles and we take no automated decisions about you. If you create an account or sign in to an existing one, that data is governed by the account privacy information, not by this text.

4. Why, and on what legal basis

- To prepare and deliver your order, handle payment and send the confirmation and order updates. Basis: performance of the contract (art. 6.1.b GDPR).

- To keep order records for tax and accounting duties for 6 years. Basis: legal obligation (art. 6.1.c GDPR).

- To defend the restaurant against claims, including payment disputes: order evidence is sent to Stripe and the card issuer. Basis: the restaurant's legitimate interest in defending a payment (art. 6.1.f GDPR). [TO DECIDE: confirm this sentence, see the research, A2.]

- To send you offers by email on behalf of the restaurant. Basis: your consent (art. 6.1.a GDPR). The box is never pre-ticked, it is separate from everything else, and you can withdraw it whenever you like.

- To detect whether this is your first order, for first-order promotions. [TO DECIDE: legal basis and what is compared (email or phone), see the research, A2.]

- Security and abuse limits: your IP address is used in memory only to limit requests and is not stored.

- To count visits anonymously: page views are counted per day and page type, with no cookies, no IP address and no identification of anyone. [TO DECIDE: Q-210(a), audience-measurement exemption; see the research, A3.]

5. If you do not give the data

To order we need your name, email and phone. Without them we cannot process the order. Marketing is always optional and does not affect your order.

6. Who receives your data

The restaurant and its staff (the kitchen sees only your first name, the time and the order notes). The platform, as processor. And providers working for the platform: Stripe (payments), Brevo (order emails), Vercel and Supabase (hosting and database), Sentry (error reports, identifiers and codes only) and, if you sign in with Google, Google. We do not sell your data or pass it to partners.

7. Transfers outside the European Economic Area

Some providers are US companies. [TO VERIFY PER VENDOR: transfer mechanism (standard contractual clauses or Data Privacy Framework) and region of each provider; see the research, section 0.2.]

8. How long we keep data

- Orders, payments and tax records: 6 years from the end of the year.

- Guest contact details: kept while your marketing permission is active. Without a permission they are blocked 2 years after your last order and deleted after 5 years. Blocked means nobody at the restaurant or the platform can use them and they are kept only to defend against claims. The restaurant may choose to delete them directly instead of blocking them.

- Proof of your marketing permission: while it is active and for 3 years after.

- Data rights requests: 3 years.

- Log of emails sent: 1 year.

9. How to use your rights

Write to the restaurant (contact in the legal notice) or to [PRIVACY CONTACT EMAIL]. If you write to the platform, it forwards your request to the restaurant within 2 working days. The restaurant answers within one month at most. You can withdraw your marketing permission with the unsubscribe link in each email. Withdrawing does not affect what was already done.

10. Complaints

You can complain to the Spanish Data Protection Agency (www.aepd.es).

11. Changes to this text

Each version has a number and an effective date, shown below.