How MenuSmart processes guest data for each restaurant

The customer that accepts the terms of service is the controller. MenuSmart, run by Edgar Hugo Cheverier Aguilar, is the processor. Both accept this agreement by accepting the terms of service, and it lasts as long as the contract, plus the export and deletion periods below.

Read the terms of service.

MenuSmart processes guest data only to provide the features the customer uses: the public booking page and booking management, the booking emails, review requests and reviews, table service, and the dashboard AI assistant when the customer’s staff ask it about bookings. Processing consists of collecting, recording, storing, consulting, updating, sending, and erasing the data.

• Data subjects: the guests who book or leave a review with the customer’s establishment.
• Data: name, email address, phone number, party size, date and time, area and tables, language, booking status, and, for reviews, the rating, comment, and visit details.
• Special categories of data are not needed, and the customer must not ask for them. If a guest writes them in a review, they are processed only as part of that review.

MenuSmart processes the data only on the customer’s documented instructions: the terms of service, this agreement, the settings the customer chooses in the dashboard, and the written instructions it sends to support@menusmart.dev. This includes transfers outside the European Economic Area, unless EU or Spanish law requires otherwise, in which case MenuSmart informs the customer first unless that law forbids it.

MenuSmart informs the customer immediately if, in its opinion, an instruction infringes data protection law.

By default, the customer instructs MenuSmart to keep the data for these periods:

• unconfirmed bookings: deleted 30 to 40 minutes after they are made;
• other bookings: deleted 30 days after the booking date;
• booking email sending records: 30 days; cancellation receipts: 7 days; table service status: 3 days;
• review requests: sent by email after each visit marked as attended, unless the guest refuses them or opts out, or the customer turns them off; unanswered requests deleted after 30 days; submitted reviews kept while the account exists, without the guest’s email address or phone number, and without their name after 24 months; the customer can delete them from the dashboard; opt-outs kept as a pseudonymous code while the establishment exists.

MenuSmart keeps the data confidential, and anyone it authorizes to process the data is bound by a duty of confidentiality.

MenuSmart applies the technical and organizational measures of Article 32 GDPR appropriate to the risk, including:

• data stored in the European Union (Google Cloud), encrypted in transit and at rest;
• access limited to the customer’s account and the collaborators it invites, enforced by authentication and database security rules;
• protection of the booking pages with App Check and usage limits against automated abuse;
• booking links that work only with a code sent to the guest;
• access by MenuSmart to the data only when needed to provide support, fix errors, or comply with the law;
• regular review of these measures and of the sub-processors.

The customer gives MenuSmart general authorization to use sub-processors. The current list, with what each one does and where, is on the sub-processor page.

MenuSmart tells the customer by email at least 30 days before adding or replacing a sub-processor. The customer can object on reasonable data protection grounds within that period by writing to support@menusmart.dev; if we cannot resolve the objection, the customer can end the contract before the change applies and export its data.

MenuSmart imposes on each sub-processor data protection obligations equivalent to those in this agreement and remains liable to the customer for their performance.

See the sub-processor list.

Some sub-processors process data in the United States. Those transfers rely on the EU–US Data Privacy Framework where the sub-processor is certified, or on the standard contractual clauses approved by the European Commission.

The customer can view and cancel bookings from the dashboard and, to answer guests’ requests, find one guest’s bookings and reviews by email or phone, download them as JSON, and delete them; those searches and deletions are logged for 3 years without the guest’s data. If a guest sends a data protection request to MenuSmart, MenuSmart forwards it to the customer without undue delay, and at the latest within 5 working days, and helps the customer answer it.

MenuSmart helps the customer, taking into account the information available to it, with security, breach notifications, data protection impact assessments, and prior consultations (Articles 32 to 36 GDPR).

MenuSmart notifies the customer without undue delay, and at the latest within 48 hours of becoming aware of a breach affecting the customer’s data, by email to the account address. The notice describes the breach, the data and people affected, the likely consequences, and the measures taken or proposed, and MenuSmart sends further information as it becomes available.

When the contract ends, the customer can export its data as the terms of service describe. MenuSmart then deletes the guest data and any copies, unless EU or Spanish law requires it to keep them. If the customer deletes its account itself, the data is deleted at once.

MenuSmart makes available to the customer the information needed to demonstrate compliance with Article 28 GDPR, such as this agreement, its records of processing activities, and the sub-processors’ terms, and answers reasonable questionnaires. If that information is not enough, the customer, or an auditor it appoints who is bound by confidentiality, can carry out an audit with at least 30 days’ notice, at most once a year unless there has been a breach, at the customer’s cost and without disrupting the service.

Liability under this agreement follows the terms of service and Article 82 GDPR. This agreement is governed by Spanish law and prevails over the terms of service on data protection matters.