Privacy Policy

Deskadora Europe SASU, trading as Deskadora, handles personal data with care and follows the EU GDPR and the UK GDPR. This policy explains what we collect, why we collect it, how long we keep it, who we share it with, and how you can exercise your rights.

This policy applies to deskadora.com, app.deskadora.com, partner.deskadora.com and all related services.

This policy does not cover employment or recruitment data, which are governed by separate internal policies.

Deskadora is established in France. For individuals in the United Kingdom, our representative under Article 27 of the UK GDPR is [TO CONFIRM: UK representative name and address].

---

1. Information We Collect

1.1 Information You Provide

• Account details: name, email, phone number, venue information
• Staff profiles added by venues
• Booking settings, table management entries, and guest records
• Guest records added by venues, including names, contact details and special requests, which may include dietary or accessibility needs and can reveal health or religious information
• Uploaded files such as images and documents
• Communications sent through our support channels

1.2 Information Collected Automatically

• Device details: IP address, browser version, operating system
• Usage logs: pages viewed, time spent, scroll activity
• Authentication information linked to cookies and session tokens
• Security logs such as failed logins or behaviour that suggests misuse

1.3 Information From Third Parties

• Stripe for subscription payment status. Card payment data is processed directly by Stripe and is never stored by Deskadora.
• Email, messaging and notification providers used to deliver communications
• Optional third-party integrations when a venue chooses to connect an external system

---

2. How We Use the Information

We process personal data to:

• Create and manage user and venue accounts
• Support venue operations including tables, bookings, menus and staff roles
• Manage subscription payments and issue invoices
• Send transactional and, with consent, marketing communications by email, SMS, WhatsApp and push notification
• Provide AI-assisted features such as menu translation, allergen detection, and staff guest briefings (see Section 6)
• Measure the performance of our advertising, with consent
• Respond to enquiries
• Maintain platform stability and protection
• Improve our service using aggregated and anonymised usage information
• Meet legal requirements

Marketing messages are sent only with consent. Every marketing email includes an unsubscribe link.

---

3. Legal Basis

We rely on the following legal grounds:

• Contract — when providing access to Deskadora
• Consent — analytics cookies, advertising cookies and advertising measurement, and marketing messages
• Legitimate interest — platform protection, fraud detection and maintaining stable operation
• Legal obligation — tax, accounting and regulatory requirements

Where we process special-category data, such as health-related dietary or accessibility information contained in guest special requests, we either rely on explicit consent or process it on behalf of the venue under the venue's own lawful basis as data controller.

---

4. Data Roles

Deskadora acts as:

• Data controller for platform account data and administrative information
• Data processor for venue-uploaded content, guest information and bookings, on behalf of the venue

When venues use Deskadora to manage guest data, the venue is the data controller for that data. Deskadora acts as data processor on their behalf. This relationship is governed by a Data Processing Agreement, which venues accept upon creating an account.

For guest deposits, the payment is charged on the venue's own connected Stripe account, where the venue is the merchant of record. Deskadora does not receive or hold deposit funds.

---

5. Cookies and Tracking

Cookies are used as described in our Cookies Policy, available at: https://deskadora.com/en/cookies

Consent for analytics and advertising cookies is collected on your first visit and can be changed at any time through the cookie settings tool in the footer.

---

6. Sharing Personal Data

We do not sell personal data.

We share data only with the following sub-processors, each bound by a Data Processing Agreement consistent with GDPR Article 28.

What we send to our AI provider

We use Anthropic's Claude AI to translate and tag menu content, detect allergens, translate and categorise guest special requests, and generate staff-facing guest and reservation briefings. Where guest data is involved, we send the free text of special requests and profile attributes such as dietary preferences, tags and visit history. We do not include the guest's name, email, phone number, or any account or reservation identifier. Anthropic processes this only on our instructions.

If we add or replace a sub-processor, we will update this list and notify users at least 30 days before the change takes effect.

---

7. International Transfers

When personal data is transferred outside the EU, we apply Standard Contractual Clauses (SCCs) as approved by the European Commission. AWS hosts data in Paris (eu-west-3) — no EU data is transferred outside the EU via AWS hosting. For personal data of individuals in the United Kingdom, we apply the UK Addendum to the SCCs in addition to the above safeguards.

---

8. Data Retention

---

9. Security

We apply strict controls to protect personal data, including encryption in transit (TLS 1.2+), encryption at rest, role-based access controls, monitoring and security logging, and routine security reviews.

---

10. Data Breach Procedure

If a personal data breach occurs: we investigate and contain the incident; notify the competent supervisory authority within 72 hours where required by GDPR Article 33; contact affected individuals without unnecessary delay where there is high risk; and document the incident and all actions taken.

---

11. Your Rights

You may request: Access, Correction, Deletion, Restriction, Data portability, Withdrawal of consent, and Objection to processing based on legitimate interest.

Send requests to: [email protected]. We reply within 30 days; complex requests may be extended to 90 days.

You may file a complaint with your local data protection authority, including the CNIL (France): https://www.cnil.fr, or the ICO (United Kingdom): https://ico.org.uk.

---

12. Automated Decision-Making

We use limited automated processing to operate the platform:

• Subscription downgrade on payment failure — if a subscription payment fails after several attempts, the account is automatically moved to the free plan.
• Subscription downgrade on cancellation — when a subscription is cancelled, the account is automatically moved to the free plan unless an active replacement is found.
• Account dissolution for inactivity — if an account is inactive for 90 days, and after two prior notices, the account is closed.

These decisions are necessary for the performance of our contract with you. You have the right to obtain human intervention, express your point of view, and contest any of these decisions by contacting [email protected].

We do not use guest data for automated decisions that produce legal or similarly significant effects.

---

13. Children's Data

Deskadora is a business tool and is not directed at children. Users must be at least 18 years old. We do not knowingly collect data from anyone under 18.

---

14. Third-Party Links

Our platform may contain links to external websites. We are not responsible for how those sites handle personal data. We recommend reviewing their privacy policies.

---

15. Changes to This Policy

We may update this document to reflect changes in our practices or legal requirements. We will post the updated version with a new effective date, and for significant changes notify you on the platform or by email before they take effect.

---

16. Contact

Deskadora Europe SASU
60 Rue François 1er, 75008 Paris, France
Email: [email protected]