Privacy policy

The platform is operated by BookNDish, registered under number available on request, with its registered office at available on request. For the accounts of restaurant teams and for visitors to this site, we decide how and why personal data is used, which makes us the data controller. For the data of guests who order or book at a restaurant, the restaurant is the controller and we process that data on its behalf under our data processing agreement. You can reach us about privacy at the contact page.

When you order or book at a restaurant that uses the platform, we store what is needed to do that: your name, your phone number, your email address if you give one, the table or room you ordered from, what you ordered, and the date, time and party size of a booking. If the restaurant runs a loyalty programme you join, we keep your points balance. We also keep technical logs (IP address, browser type, timestamps) for security and to keep the service running.

To open a restaurant account we ask for the owner’s name, email address and password, the restaurant’s name and address, and the names and emails of the team members the owner invites. For paid plans we keep billing details: the legal name and address to put on invoices, and the references returned by the payment provider. We never store full card numbers. When the AI features are used, we keep a record of how much they were used, for billing and to enforce spending limits.

We use guest data to pass an order to the kitchen, seat a booking and tell the guest what is happening with it, on the restaurant’s instructions. We use team data to sign people in, bill subscriptions, answer support requests and keep the platform secure: that is necessary to perform our contract with the restaurant, and keeping the platform secure is also our legitimate interest. We keep accounting records because the law requires it. We do not sell personal data and we do not use it to advertise to guests.

Your data is seen by the restaurant you ordered from and by the service providers that run parts of the platform for us: hosting and database, file storage, payments, email, text and WhatsApp messages, the AI features when a restaurant uses them, and error tracking. Each is bound by a contract to use the data only to provide its service. The current list, with what each provider does and where, is in the sub-processor section of our data processing agreement. Card details go straight from your device to the payment provider and never pass through our servers. We disclose data to authorities only when the law obliges us to.

The platform is hosted in Frankfurt, Germany (European Union), with the database in London, United Kingdom. Some providers process data in other countries, the United States in particular. Where data about people in the European Economic Area, the United Kingdom or Switzerland leaves those areas, we rely on an adequacy decision or on the European Commission’s standard contractual clauses (with the UK addendum where it applies), together with the measures described on our security page.

Order and booking records are kept for as long as the restaurant needs them for its service and its accounting obligations, and are deleted or anonymised when the restaurant deletes them or closes its account. A restaurant can export or erase a guest’s record at any time. Team accounts are kept while the account is open and removed after it is closed, except what accounting law requires us to retain. Technical logs are kept for at most 90 days. Backups roll over within five weeks, so deleted data leaves them within that time.

Depending on where you live (under the GDPR in Europe, the UK GDPR, the California Consumer Privacy Act, Tunisia’s Organic Law 2004-63 or another local law), you can ask to see the data held about you, correct it, delete it, receive a copy, or object to or restrict how it is used. If you are a guest, the restaurant you ordered from is the first place to ask, and we will help it answer; you can also write to us at the contact page. We answer within one month. You also have the right to complain to your data protection authority.

The platform uses only the cookies it needs to work: one that keeps you signed in, one that protects forms against forgery, and one that remembers your language. We do not use advertising or tracking cookies. If we change this policy in a way that matters, we will post the new version here, update the date at the top and tell restaurant owners by email.