Ospitera privacy policy

1. Who we are

Ospitera ("Ospitera", "we") decides how and why the personal data described here is used: we are its controller. Version 2026-11-05.

Privacy questions and requests: support@ospitera.com.

We have not appointed a data protection officer under the GDPR, as it does not require one for our activities; the contact above reaches the person responsible for privacy at Ospitera. Where a country's law requires a named officer (for example a data protection officer in the Philippines, a privacy officer in New Zealand, or the person in charge in Quebec), that person holds the role. Where a country requires a local representative, Part 2 says how we meet it.

2. What this policy covers

People who visit ospitera.com and its country sites; people who apply to open a venue or send us a question; venue owners, their staff and contact persons, as users of the admin and kitchen board and as our customers; people we contact to offer our service (business outreach); and anyone who writes to us.

Not covered: guests who order on a venue's storefront. The venue is responsible for that data and explains it in its own privacy notice, linked from its storefront; we process it for the venue under our data processing agreement.

3.1 Visiting our website

Data: IP address, browser and device type, pages requested and time; the country your IP address belongs to; the language you chose.

Why: to show the website and keep it secure; to show you your own country's site, without ever blocking another one: outside the EU/EEA, ospitera.com opens it on your first visit, and inside it a bar suggests it (we read your country from your IP address on each visit and don't keep that lookup as a profile; the site that matches it is kept in a cookie so other sites can suggest it); and to remember the site and language you chose (cookies, section 11).

Basis: our legitimate interest in running a secure website and showing visitors their own country's site (GDPR art. 6(1)(f)). The site cookies are needed for functions you use.

Kept: our hosting provider's server logs for up to 30 days; rate-limit records hold only a keyed hash of the IP address and expire within 24 hours; the site cookies for 1 year. We use no advertising cookies, no third-party analytics or tracking, and no social media pixels.

3.2 Applying to open a venue

Data: venue name, address and country; contact person's name, email and phone; the venue's public phone and email; preferred language, brand colour, notes, and photos or a logo you upload; the username you choose. The password and staff PIN you choose are never stored in readable form, only as a one-way hash.

Why: to review your application, set up your ordering site, and contact you about it. Basis: steps you asked for before a contract where you apply for yourself (art. 6(1)(b)); where you apply for a company, our legitimate interest in setting up the business relationship (art. 6(1)(f)).

Kept: a sign-up link that is never submitted stops working after 30 days and is deleted 30 days later; an application that does not lead to a venue is deleted 12 months after it was submitted; if your venue opens, the data becomes account data (3.4).

3.3 Asking us a question

Data: your name, email (or phone number on WhatsApp), your message, and the language of the page.

Why: to answer you. Questions are emailed to our support team and may be stored in our support inbox, where an AI service may draft a reply that one of us reads, edits and decides whether to send; nothing is sent automatically. Basis: our legitimate interest in answering questions about our service, or steps before a contract (art. 6(1)(f) or (b)).

Kept: 24 months after the last message, unless the conversation becomes part of a customer relationship. WhatsApp is run by Meta under its own terms and privacy policy; use email if you prefer not to use it.

3.4 Venue accounts: owners and staff

Data: usernames; password and PIN hashes; sign-in sessions and known-device cookies; short-lived sign-in counters keyed by a hash of the IP address; the history of order status changes; and your acceptance of our terms (version, username, time, keyed hash of the IP address).

Why: to give you and your staff access, keep accounts secure (rate limits, new-device checks), show what happened to each order, and prove which terms were accepted. Basis: performing our contract where you contract with us yourself (art. 6(1)(b)); where you act for a company or work for the venue, our legitimate interest in running and securing the business relationship (art. 6(1)(f)); and our legitimate interest in security and in proving the contract (art. 6(1)(f)).

Kept: while the venue uses Ospitera. After the end, account data and order history are deleted on day 30, as the terms say (7.4); terms acceptances may be kept for up to 5 years as evidence in case of a dispute.

3.5 Billing

Data: business name, address, country and VAT or tax number; billing email and contact person; plan, price, invoices and payment status. Card and bank details are held by Stripe; we only see the type, last digits and expiry.

Why: to invoice and collect our fee, apply the right tax and keep accounting records. Basis: our contract (art. 6(1)(b)) or, for a contact person acting for a company, our legitimate interest in administering the relationship (art. 6(1)(f)); and our legal obligations under accounting and tax law (art. 6(1)(c)).

Kept: invoices, credit notes and the records that support them for 10 years from 1 January after the year each document was issued, as Belgian accounting and VAT law requires, or longer where a legal hold applies; other billing data while the venue uses Ospitera.

3.6 Running the service

Data: messages we exchange with you, support requests, and service emails (sign-in links, invoices, notices of changes). Why: to provide and support the service and tell you about changes, as the terms require. Basis: our contract (art. 6(1)(b)). Kept: while the venue uses Ospitera, and questions as in 3.3.

3.7 Business outreach

Data: a venue's name, address, public phone number and website, and a business email address the venue publishes (for example info@… or the address on its website or listing), including a name only where it is part of that published address.

From: public sources — the venue's own website, public business listings and maps, and public business registers. We don't buy lists of people.

Why: to send the venue a short email offering our service, and to avoid contacting it again if it says no. Basis: our legitimate interest in offering a service relevant to the business's activity (art. 6(1)(f)). We send a promotional email only where we have documented consent or a verified exception under the email-marketing rules that apply to that message; an address being public does not by itself allow marketing. Before each campaign we record the source, the kind of recipient and the permission we rely on (Part 2).

Every outreach email says who we are, where we found the address, and how to stop further emails in one step; you may object at any time and we stop. Kept: 12 months after our last email if you don't reply. If you ask us to stop, we keep only the email address, or a hash of it, on a do-not-contact list so that we never email you again.

3.8 Security, errors and legal claims

Technical error reports (Sentry) are configured not to collect contact data, cookies or form contents, and are kept for 90 days. Rate limits and logs hold keyed hashes of IP addresses. Basis: our legitimate interest in a secure, working service (art. 6(1)(f)).

Where needed we use the data above to establish, exercise or defend legal claims and to answer lawful requests from authorities (art. 6(1)(c) or (f)), for as long as the matter requires.

4. What we don't do

We don't sell personal data, share it for other companies' advertising, or build profiles of you.

We make no decisions about you by automated means that have legal or similarly significant effects (rate limits may briefly block repeated sign-in attempts; contact us if you are affected).

Our tools for reading and translating menus send the text and images you submit to an AI provider for that purpose. A menu or photo can itself contain business contact details or other personal data, so don't submit guest data or personal data you don't need to. The provider is listed at /legal/subprocessors.

5. Who we share data with

Service providers who process it for us under contracts that bind them to our instructions and to confidentiality (Stripe also acts as a separate controller for its own legal duties, such as fraud prevention and anti-money-laundering checks, and so does Meta for WhatsApp): Netlify (hosting, US), Neon (database, EU region), Stripe (billing, Ireland and US), Resend (sending emails, US), Anthropic (drafting replies to emails sent to us, and reading and translating menus; US), Sentry (error monitoring, EU region), the OpenStreetMap Foundation (map tiles in the admin, which receives your IP address; UK), and Meta only if you contact us on WhatsApp. The list for venue data is at /legal/subprocessors.

Professional advisers (accountants, lawyers) under confidentiality; authorities and courts where the law requires it or to protect our rights; and a buyer or successor of our business, who would continue under this policy, after we tell you.

6. Transfers outside your country

We are based in Belgium (EU). Some providers process data in other countries, notably the United States. For data from the EU/EEA these transfers rely on an adequacy decision (including the EU–US Data Privacy Framework for certified providers) or on the European Commission's standard contractual clauses with extra safeguards where needed; for the UK and Switzerland, on their equivalents. You can ask us for a copy of the safeguards. Where the law of your country has its own rules for sending data abroad, Part 2 says how we meet them.

7. How long we keep data

Your country from your IP address: looked up on each visit and not kept; your country's site is kept in a cookie (1 year). Site and language cookie: 1 year. Server logs: up to 30 days. Unsubmitted sign-up link: closes after 30 days, deleted 30 days later. Application without a venue: 12 months. Questions: 24 months after the last message. Account data and order history: while the venue uses Ospitera, deleted on day 30 after the end. Terms acceptances: up to 5 years after the end. Invoices and accounting records: up to 10 years. Outreach without reply: 12 months after the last email. Do-not-contact list: for as long as we do outreach (address or hash only). Error reports: 90 days. When a period ends we delete or anonymise the data.

8. Your rights

Depending on the law of your country (see Part 2), you can ask for access to your data and a copy of it; correction; deletion; restriction; object to our use of it based on legitimate interest (you can always object to outreach, and we stop); receive the data you gave us in a portable format; and withdraw consent where we rely on it, without affecting what was done before.

Write to support@ospitera.com. We may ask you to confirm your identity. We answer within one month (or the shorter period your law sets), and may extend this for complex requests where the law allows, telling you why. Requests are free unless clearly unfounded or excessive.

You may complain to the data protection authority of your country. Our lead authority in the EU is the Belgian Autorité de protection des données / Gegevensbeschermingsautoriteit (dataprotectionauthority.be); Part 2 names others. We would like the chance to resolve your concern first.

9. Security

We protect data with encryption in transit, encryption at rest of sensitive data, one-way hashes for passwords, PINs and IP addresses, strict separation between venues, rate limits, logging of sensitive actions, automatic deletion and backups. If a breach puts your rights at risk, we tell you and the authority as the law requires.

10. Age

Our service is for businesses and not meant for anyone under 16, or the age of majority where your law sets it higher. We don't knowingly collect data from children.

11. Cookies and similar technology

We use only what is needed for our website and admin to work, so we don't ask for consent; if we ever add analytics or other optional cookies, we will ask first.

os_site: remembers the country site and language you chose in the switcher or the suggestion bar (1 year). os_home: the country site that matches your location, so other sites can suggest it (1 year). os_suggest_off: you closed that suggestion (1 year). Owner and staff session cookies (per venue): keep you signed in until you sign out or the session expires. Known-device cookie: recognises a device you signed in on before, for security (90 days). Platform and franchise session cookies: sign-in for our team and for franchise consoles. Browser storage (for example the admin's setup guide, the kitchen board's sound and print settings, the chosen language): settings kept on your device and never sent to us, until you clear them.

The full list is also at /legal/cookies.

12. Changes

We may update this policy when our services or the law change; the version date is at the top. Where a change materially affects you, we tell you beforehand in your admin or by email.

Part 2. What particular countries add

In each section, "the law" means the data protection law named in it. Where it gives you more rights than Part 1, you have those rights.

European Union and EEA

The GDPR applies as described in Part 1. You may complain to the authority where you live or work, or where the issue arose; the European Data Protection Board lists them all (edpb.europa.eu).

United Kingdom

UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025. Until a UK representative under UK GDPR article 27 is named here, contact us at support@ospitera.com. Authority: Information Commissioner's Office (ico.org.uk). Outreach to corporate subscribers is sent with a clear opt-out (PECR); to sole traders and partnerships only with consent.

Switzerland

Federal Act on Data Protection (FADP). Authority: Federal Data Protection and Information Commissioner (edoeb.admin.ch). We send data only to countries on the Federal Council's adequacy list or under the standard contractual clauses as recognised for Switzerland. We don't send outreach emails to Swiss venues without consent.

United States

We collect the categories described in section 3 (identifiers, commercial information, internet activity, approximate location by country, used to suggest a site and kept only as that site in a cookie, professional information) for the purposes, from the sources and for the periods stated there. We do not sell or share personal information for cross-context behavioural advertising, and use no sensitive personal information. Where a state privacy law applies to us (for example California, Colorado or Virginia), you may exercise its rights without discrimination by writing to support@ospitera.com, also through an authorised agent; if we refuse a request, you may appeal by replying to our answer. Outreach follows CAN-SPAM: each email identifies us, has our postal address and a working opt-out, honoured within 10 business days.

Canada

PIPEDA and, in Quebec, the Act respecting the protection of personal information in the private sector (Law 25). The person in charge of the protection of personal information is the person responsible for privacy at Ospitera, reachable at support@ospitera.com. We assess the protection data receives before it leaves Quebec or Canada. Authority: the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec. Outreach follows CASL: we email only addresses a business has itself published (not ones republished by others) without a statement refusing unsolicited messages, about matters relevant to its business, or with consent, and every email has an unsubscribe honoured within 10 business days.

Australia

Privacy Act 1988 and the Australian Privacy Principles. We disclose personal information to the providers and countries in sections 5–6, mainly the EU and the US, and take reasonable steps so they handle it consistently with the APPs. Complaints: contact us first and we answer within 30 days; if you are not satisfied, contact the Office of the Australian Information Commissioner (oaic.gov.au). Outreach follows the Spam Act 2003: only with consent, express or inferred where the Act allows (a published address is not consent by itself), never to harvested address lists, and every email identifies us and has an unsubscribe.

New Zealand

Privacy Act 2020; information sent overseas is protected as Information Privacy Principle 12 requires. Authority: Office of the Privacy Commissioner (privacy.org.nz). Our privacy officer is the person responsible for privacy at Ospitera. Outreach follows the Unsolicited Electronic Messages Act 2007: only with consent, including deemed consent where the address was published for that purpose without a statement refusing messages.

Mexico

Federal Law on the Protection of Personal Data Held by Private Parties (2025). This policy is our comprehensive privacy notice (aviso de privacidad integral); we use your data only for the purposes in section 3. You may exercise your ARCO rights (access, rectification, cancellation, opposition) and withdraw consent by writing to support@ospitera.com with your name, a way to reply and a description of your request. Transfers to the providers in section 5 need no consent because they process data for us.

Brazil

LGPD. Your rights under article 18: confirmation, access, correction, anonymisation, blocking or deletion, portability, information about sharing, and review of automated decisions. Contact for data subjects (encarregado): support@ospitera.com. Transfers to the EU rely on the ANPD's adequacy decision for the European Union; other transfers use the ANPD standard contractual clauses (Resolution CD/ANPD 19/2024) or other mechanisms the law allows. Authority: ANPD (gov.br/anpd).

Argentina

Law 25.326. You may access your data free of charge every six months, unless you show a legitimate interest for more frequent access (article 14(3)). La AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N.º 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales.

Chile

Law 19.628 and, from 1 December 2026, Law 21.719, which adds the rights to portability and to object and the Agencia de Protección de Datos Personales as authority.

Colombia

Law 1581 of 2012 and Decree 1377 of 2013; this policy is our data processing policy. You may know, update and correct your data, request proof of authorisation where we rely on it, be informed of its use, complain to the Superintendencia de Industria y Comercio (sic.gov.co), and revoke authorisation or ask for deletion. We answer queries within 10 business days and claims within 15.

Peru

Law 29733 and its regulation. You may exercise your ARCO rights by writing to us and complain to the Autoridad Nacional de Protección de Datos Personales.

Rest of Latin America and the Caribbean

We apply this policy and the data protection law of your country where one exists (for example Ecuador's LOPDP, Uruguay's Law 18.331, Costa Rica's Law 8968, Panama's Law 81, the Dominican Republic's Law 172-13, the Barbados Data Protection Act 2019, the Jamaica Data Protection Act 2020, the Bahamas Data Protection (Privacy of Personal Information) Act 2003 and the Trinidad and Tobago Data Protection Act 2011). You may exercise its rights by writing to us and complain to its authority.

Philippines

Data Privacy Act of 2012. Our data protection officer is the person responsible for privacy at Ospitera, reachable at support@ospitera.com. You have the rights to be informed, to object, to access, to rectify, to erasure or blocking, to damages and to data portability, and may complain to the National Privacy Commission (privacy.gov.ph).

Turkey

Law No. 6698 (KVKK). This section and Part 1 are our information notice under article 10. Data is processed on the grounds in article 5(2): performance of a contract, legal obligation and legitimate interest. Transfers abroad (article 9) use the Board's standard contract, notified to the Personal Data Protection Authority, or another mechanism the law allows. For your rights under article 11, apply to us in writing or by registered email, in Turkish or English; we answer within 30 days, after which you may complain to the Personal Data Protection Board (kvkk.gov.tr).

Balkans, Moldova, Ukraine and the Caucasus

We apply this policy and the data protection law of your country (largely modelled on the GDPR; in Moldova Law 195/2024 from 23 August 2026). Where that law requires a local representative for us, we appoint one before we serve venues there. You may exercise its rights by writing to us and complain to its national authority.

Monaco, San Marino and Andorra

We apply this policy and your country's data protection law (Monaco Law 1.565; San Marino Law 171/2018; Andorra Law 29/2021); each has an authority you may complain to.

United Arab Emirates

Federal Decree-Law No. 45 of 2021 on the protection of personal data, or the DIFC Data Protection Law 2020 or the ADGM Data Protection Regulations 2021 where they apply. You may ask for access, correction, deletion, restriction and a copy of your data, and object; you may complain to the UAE Data Office or, in the DIFC or ADGM, to its data protection commissioner.

India

Digital Personal Data Protection Act 2023 and its rules as they come into force. You may ask for a summary of your data and how we use it, have it corrected, completed or erased, and nominate someone to act for you. Write to us first to resolve a grievance; you may then complain to the Data Protection Board of India.

Singapore

Personal Data Protection Act 2012. Our data protection officer is the person responsible for privacy at Ospitera, reachable at support@ospitera.com. You may ask for access and correction and withdraw consent, and may complain to the Personal Data Protection Commission (pdpc.gov.sg).

Malaysia

Personal Data Protection Act 2010, as amended in 2024. You may ask for access and correction, withdraw consent and ask us to stop direct marketing, and may complain to the Personal Data Protection Commissioner. The Act requires this notice in Malay as well as English; we provide the Malay version before we serve venues in Malaysia.

Kenya

Data Protection Act 2019. You have the rights to be informed, to access, to object, to correction and deletion, and to data portability, and may complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Nigeria

Nigeria Data Protection Act 2023. You may ask for access, correction, erasure, restriction and a copy of your data, and object, and may complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

South Africa

Protection of Personal Information Act 2013 (POPIA). Our information officer is the person responsible for privacy at Ospitera, reachable at support@ospitera.com. You may ask for access, correction and deletion, and object, and may complain to the Information Regulator (inforegulator.org.za). We send direct marketing by email only with consent (section 69).

Jersey, Guernsey and the Isle of Man

Data Protection (Jersey) Law 2018, Data Protection (Bailiwick of Guernsey) Law 2017 and the Isle of Man Data Protection Act 2018, which give rights like those in section 8. Each has an EU adequacy decision. You may complain to the Jersey Office of the Information Commissioner (jerseyoic.org), the Office of the Data Protection Authority in Guernsey (odpa.gg) or the Isle of Man Information Commissioner (inforights.im).

Gibraltar

The Gibraltar GDPR and the Data Protection Act 2004, which give rights like those in section 8. You may complain to the Gibraltar Regulatory Authority (gra.gi).

Faroe Islands

The Faroese data protection act, which gives rights like those in section 8; the Faroe Islands have an EU adequacy decision. You may complain to the Faroese Data Protection Authority (Dátueftirlitið, dat.fo).

Bermuda

Personal Information Protection Act 2016 (PIPA), in force since 1 January 2025. You may ask for access and correction, and for your data to be blocked or erased, and may complain to the Privacy Commissioner (privacy.bm).

Business outreach by country

We email a business only with documented consent or a verified exception under the rules that apply to the message, checked country by country before each campaign. Where we rely on an exception: Belgium (impersonal addresses of companies, not a named employee's address), France (an address relevant to the recipient's role, with information and a way to object), Ireland and the UK (corporate subscribers only, not sole traders or partnerships), the US (CAN-SPAM) and Canada (CASL, addresses the business published itself). Each email names us, says where we found the address and has a one-step opt-out.

Not sent without prior consent: Germany, Austria, Poland, Switzerland, Italy, the Netherlands, Spain, Denmark and South Africa, and any other country where we have not verified an exception.

Australia (Spam Act 2003) and New Zealand (Unsolicited Electronic Messages Act 2007): we rely on inferred consent only where the business published the address itself, did not say it does not want commercial messages, and the email relates to its business.

Singapore (Spam Control Act 2007): the subject starts with <ADV> and we act on an unsubscribe within 10 working days. Brazil (LGPD) and the Philippines (Data Privacy Act 2012): we rely on our legitimate interest after a documented assessment, only for addresses the business published itself. Mexico (LFPDPPP): our privacy notice is linked in the first email and we stop as soon as you object. Argentina (Ley 25.326): only addresses from public sources; each email is marked as advertising and explains how to have your data withdrawn or blocked.