Privacy Policy - restaurant dev2

1. Data controller

The data controller for personal data is:

restaurant dev2
Address: 4 Rue des Grandes Fontaines, 95100 Argenteuil
Phone: +33650407435
Email: benyaalaamir@gmail.com

Hereinafter referred to as "the Data Controller" or "We".

2. Personal data collected

In the course of using our site and services, we may collect the following personal data:

2.1 - Order data

Last name and first name
Email address
Phone number
Delivery address (where applicable)
Order details (products, amounts, dates)
Special order instructions and notes

2.2 - Payment data

Selected payment method
Transaction reference

Important: Complete banking data (card number, security code) is never collected or stored by us. It is processed exclusively by our approved payment provider, which ensures its security in compliance with PCI DSS standards.

2.3 - Browsing data

IP address
Browser type and operating system
Pages viewed and visit duration
Geolocation data (only with your consent, for delivery calculation)

2.4 - Account data (where applicable)

Login credentials
Order history
Saved addresses
Dietary preferences

3. Purposes of processing

Your personal data is collected and processed for the following purposes:

Order management: processing, preparation, delivery and tracking of your orders
Payment management: transaction processing and billing
Communication: sending order confirmations, status notifications and, where applicable, marketing communications (with your consent)
Service improvement: analysis of site usage to improve your experience
Customer service: processing your complaints and requests
Legal obligations: compliance with accounting, tax and legal obligations
Security: fraud prevention and transaction security

4. Legal basis for processing

The processing of your personal data relies on the following legal bases:

Contract performance: processing is necessary for the performance of your order (Article 6.1.b of GDPR)
Legitimate interest: service improvement, fraud prevention, statistics (Article 6.1.f of GDPR)
Consent: marketing communications and non-essential cookies (Article 6.1.a of GDPR)
Legal obligation: retention of billing data (Article 6.1.c of GDPR)

5. Data retention period

Your personal data is retained for the following periods:

Order data: 3 years from the last order
Billing data: 10 years (statutory accounting requirement)
Customer account data: 3 years from last activity
Browsing data (cookies): maximum 13 months
Geolocation data: for the duration of the order session only

After these periods, data is deleted or irreversibly anonymized.

6. Data recipients

Your personal data may be shared with the following recipients:

Authorized personnel: employees of restaurant dev2 authorized to process orders
Payment provider: for secure transaction processing
Delivery provider (Uber Eats / Uber Portier France SAS): for delivering your order by courier (name, address, phone)
Hosting provider: for secure data storage
Email service provider: for notifications and confirmations
Technical provider (NODETECH CONSULTING, SAS): acting as a processor within the meaning of Article 28 of GDPR, for the development, maintenance and operation of the "Smart Kitchen" online ordering platform

These recipients act as processors and are contractually required to respect the confidentiality and security of your data in accordance with GDPR. The relationship with each processor is governed by a data processing agreement in compliance with Article 28 of GDPR.

Your data is never sold, exchanged or rented to third parties for commercial purposes.

7. Data transfers outside the EU

Some of our technical solutions are hosted on servers located outside the European Union (notably AWS services). In such cases, appropriate safeguards are implemented in accordance with Chapter V of the GDPR:

European Commission Standard Contractual Clauses
European Commission adequacy decisions (where applicable)

8. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights regarding your personal data:

Right of access: obtain confirmation that your data is being processed and request a copy (Article 15 of GDPR)
Right to rectification: have inaccurate or incomplete data corrected (Article 16 of GDPR)
Right to erasure: request the deletion of your data in cases provided by law (Article 17 of GDPR)
Right to restriction: request the restriction of processing of your data (Article 18 of GDPR)
Right to data portability: receive your data in a structured, commonly used format (Article 20 of GDPR)
Right to object: object to the processing of your data on legitimate grounds (Article 21 of GDPR)
Right to withdraw consent: withdraw your consent at any time for processing based on consent
Post-mortem directives: define directives regarding the fate of your data after your death

To exercise these rights, contact us:

By email: benyaalaamir@gmail.com
By mail: restaurant dev2, 4 Rue des Grandes Fontaines, 95100 Argenteuil

We undertake to respond to your request within one month of receipt. This period may be extended by two months for complex requests.

If you believe your rights are not being respected, you may file a complaint with the French Data Protection Authority (CNIL):

Website: www.cnil.fr
Address: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

9. Cookies

9.1 - Strictly necessary cookies

The site uses technical cookies that are essential for the operation of the service:

Cart session: managing your shopping cart during your visit
Language preference: remembering your language choice (FR/EN)
Authentication session: maintaining your login

These cookies are exempt from consent in accordance with Article 82 of the French Data Protection Act as they are strictly necessary for the provision of the service.

9.2 - Cookie management

You can configure your browser to refuse cookies. However, refusing certain technical cookies may affect the proper functioning of the site, including the ability to place orders.

10. Data security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, modification, disclosure or destruction, including:

SSL/TLS encryption for all communications
Encryption of sensitive data at rest
Strict data access controls
Access monitoring and logging
Regular security system updates

11. Data Protection Officer (DPO)

Given the nature and scale of data processing carried out, the appointment of a Data Protection Officer is not mandatory under Article 37 of GDPR. However, for any questions regarding the protection of your personal data, you may contact our personal data representative using the contact details provided in the "Contact" section below.

12. Automated decision-making and profiling

In accordance with Article 22 of GDPR, we inform you that we do not carry out any automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. The automatic calculation of delivery fees based on distance is a simple technical operation and does not constitute profiling within the meaning of GDPR.

13. Protection of minors

The site and online ordering services are intended for persons aged 16 and over. In accordance with Article 8 of GDPR and Article 45 of the French Data Protection Act, we do not knowingly collect personal data from minors under 16 without the consent of their legal representative. If we discover that data from a minor under 16 has been collected without parental consent, we will delete it as soon as possible.

14. Data breach notification

In accordance with Articles 33 and 34 of GDPR, in the event of a personal data breach likely to result in a risk to your rights and freedoms, we commit to:

Notifying the CNIL within 72 hours of becoming aware of the breach
Informing you as soon as possible if the breach is likely to result in a high risk to your rights and freedoms
Documenting any data breach in accordance with Article 33.5 of GDPR

15. Policy changes

We reserve the right to modify this privacy policy at any time. In the event of a substantial change, we will inform you via a notification on the site or by email. The date of last update is indicated at the top of this page.

16. Contact

For any questions regarding this privacy policy or the protection of your personal data, you may contact us:

Address: restaurant dev2, 4 Rue des Grandes Fontaines, 95100 Argenteuil
Phone: +33650407435
Email: benyaalaamir@gmail.com
Website: https://restaurant-2.kichify.dev