Eatz Privacy Notice

1. Who We Are and Contact Details

Eatz, Lda, operating under the Eatz brand, is the controller responsible for processing your personal data.

Data Controller: Eatz, Lda, tax number 519611152.

Privacy contact email: [email protected].

Telephone: +351 912937917.

Address: Rua Luis de Camões, 161 1esq - Maia, Portugal.

If you have questions about this Notice or the processing of your personal data, you can contact us using the details above.

2. Personal Data We Collect

We may collect the following categories of data:

• Identification data: name, tax number and date of birth (when necessary).
• Contact data: name, telephone, email, website and company, as well as delivery and/or billing address where applicable.
• Restaurant and business data: restaurant name, company tax number, registered and restaurant addresses, restaurant contact details and POS software.
• Courier application data: date of birth, IBAN, vehicle registration, preferred regions and the identity, driving, vehicle registration and insurance documents needed to assess an application.
• Payment data: processed securely through certified providers (e.g. Stripe, MBWay, EasyPay).
• Website usage data: cookies, IP address, login data, browsing history and language preferences.
• Preference and interaction data: product choices, delivery methods, order history and communications with Eatz.

3. Purposes and Legal Bases

We process personal data for the following purposes, on the legal bases set out in the GDPR:

• Pre-contractual steps or performance of a contract: responding to contact or demo requests, reviewing and following up on initial registration and courier applications, checking the information and documents provided, preparing restaurant setup, managing orders, processing payments, invoicing, deliveries and customer support.
• Compliance with legal obligations: issuing and retaining tax documents and reporting to the Tax Authority or other competent bodies.
• Consent: sending newsletters, promotional campaigns or personalised communications, and analysing website usage through Google Analytics 4, only where the user has given free, specific and informed consent.
• Legitimate interests: continuously improving our services, managing customer relationships, preventing fraud and monitoring platform security.

4. Sharing Data with Third Parties

We may share personal data with:

• Transport and logistics companies: to ensure delivery of orders.
• Payment service providers: to process transactions securely.
• Technology providers: website hosting, maintenance and security, contact, registration and courier application automation, secure document storage, and digital marketing services (where applicable).
• Public authorities: tax, regulatory or judicial authorities, where required by law.

We ensure that all providers comply with the GDPR and that data is shared only to the extent necessary to provide the services.

5. Retention Periods

• Billing data: 10 years (as required by law).
• Customer account data: while the account remains active; if inactive, it may be deleted after [period to be defined, e.g. 2 years].
• Courier application data: for as long as needed to review and follow up on the application, subject to applicable legal obligations.
• Data processed on the basis of consent (marketing): until the data subject withdraws consent.
• Browsing and security logs: for varying periods, in line with good security practices and legal obligations.

6. Data Subject Rights

Under the GDPR, you have the following rights:

• Access: to your personal data.
• Rectification: of inaccurate or outdated data.
• Erasure: of your data (the “right to be forgotten”), unless there is a legal obligation to retain it.
• Restriction or objection: to processing.
• Data portability: to another controller.
• Withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Lodge a complaint: with the Portuguese Data Protection Authority (CNPD) — www.cnpd.pt.

To exercise your rights, contact us at [email protected].

7. Cookies and Similar Technologies

Eatz uses cookies and equivalent technologies to:

• Improve the browsing experience.
• Personalise content and recommendations.
• Carry out statistical usage analysis through Google Analytics 4, only after analytics consent.
• Display relevant advertising (where applicable).

Google Analytics is not loaded before analytics cookies are accepted. You can accept, reject or change your choice using the cookie preferences in the website footer. If you withdraw consent, analytics collection is disabled and analytics cookies accessible on this domain are removed.

You can also configure your browser to reject cookies, although this may affect some features.

8. International Transfers

Whenever your data is processed outside the European Economic Area (e.g. by Google, Meta or Stripe), we ensure that the transfer relies on mechanisms recognised by the European Commission, such as:

• Standard Contractual Clauses.
• Adequacy decisions.
• Other equivalent protection mechanisms.

9. Data Security

We adopt appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit and at rest, where applicable.
• Restricted and controlled access for authorised employees and partners only.
• Regular monitoring of our systems to prevent intrusions and fraud.
• Internal security and confidentiality policies.

10. Changes to this Notice

We may update this Privacy Policy as necessary to reflect legal, technological or organisational changes.

We recommend that you consult this page regularly. If changes are significant, we will notify users through our usual communication channels.