GDPR · Spanish LOPDGDD
Privacy policy
How we handle the personal data of FastBite visitors and of the restaurants that use it. This is a translation: the Spanish version prevails.
1. Controller
BRASATECH DIGITAL SOLUTIONS S.L., tax ID B09767898, Calle Ganaderos, 24, 03130 Santa Pola (Alicante), España. Privacy contact: info@brasatech.es. We have not appointed a data protection officer because we are not required to; that address handles any request.
2. Two different roles
This policy covers the data we handle on our own account: that of website visitors and of our restaurant customers and their representatives.
The data of each restaurant's guests (their orders, their name to collect an order, their details for an invoice) and of its staff is decided by the restaurant, which is the controller. We handle it only on the restaurant's behalf, as a processor, under the Data processing agreement. Each restaurant informs its guests on its own privacy page, linked from its menu.
3. What data we use, why, and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Owner account: username, full name, password (stored with irreversible hashing) | Create and manage the account and its locations; sign-in | Performance of the contract (Art. 6(1)(b) GDPR) |
| Each location's tax details: legal name, tax ID, address, phone, email | Issue the restaurant's invoices and send VERI*FACTU records to the Spanish Tax Agency on its behalf | Performance of the contract; the restaurant's legal obligations (Art. 6(1)(c)) |
| Service subscription and billing: plan, status, Stripe customer and subscription IDs | Charge the subscription and issue our invoices | Performance of the contract; tax and accounting obligations (Art. 6(1)(c)) |
| Multi-location pricing requests: email and number of locations | Answer the request and prepare an offer | Pre-contractual steps at the person's request (Art. 6(1)(b)) |
| Support communications | Answer questions and fix problems | Performance of the contract; legitimate interest in good service (Art. 6(1)(f)) |
| Technical data: IP address, date and time, pages requested, session cookie | Run the service securely, prevent abuse and fix errors | Legitimate interest in the security of the service (Art. 6(1)(f)) |
We make no automated decisions with legal effects on anyone and build no marketing profiles. We do not sell personal data.
4. How long we keep it
- Account and location data: for as long as the contract lasts. When it ends, the restaurant can export its data for 30 days; it is then deleted, except what the law requires us to keep.
- Invoices and accounting records: six years (Spanish Commercial Code, Art. 30) and, for tax purposes, while they can be audited (four years under the General Tax Law).
- Pricing requests that did not lead to a contract: one year.
- Technical security logs: up to 90 days, unless needed to investigate an incident.
5. Recipients and providers
We use providers that handle data on our behalf, under a data processing agreement and with appropriate safeguards:
- Google Cloud and Firebase (Google Ireland Ltd.): hosting of the application, database and files, in European Union data centres (Madrid).
- Microsoft 365 (Microsoft Ireland Operations Ltd.): service emails, such as setting a password.
Other recipients, acting on their own account:
- Stripe (Stripe Payments Europe Ltd.): processes subscription payments and, if the restaurant turns them on, its guests' payments. Card details are entered on Stripe's pages; we never see or store them.
- Spanish Tax Agency (AEAT): receives the VERI*FACTU billing records the law requires of the restaurant.
- Authorities and courts, when a law requires it.
The fonts, icons and libraries of our pages are served from our own servers: visiting them does not connect your browser to third-party services.
6. International transfers
We host data in the European Union. If a provider accesses it from outside the European Economic Area, it does so with GDPR safeguards: an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
7. Security
We apply appropriate technical and organisational measures: encrypted connections, passwords stored with irreversible hashing, each restaurant's data kept apart from the rest, role-based access, backups and logging of relevant activity.
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw any consent you gave at any time, by writing to info@brasatech.es. If you are not satisfied, you can complain to the Spanish Data Protection Agency (www.aepd.es).
If you are a restaurant's guest, please contact the restaurant first: it decides about your data. We will help it answer you.
9. Changes
We may update this policy. When a change matters, we will announce it in the service or by email to account holders.