Personal Data Processing Notice

For the restaurateur's account data, Carteia is the Data Controller.

1.1 Categories of data processed

• Identification and contact data of the business and its representative: company name, VAT/tax code, address, certified email (PEC), email, phone;
• Legal representative's data: first and last name, date of birth, tax code, email (for business verification and legal formalities during onboarding);
• Credentials and account data: login email, authentication data, roles and permissions of collaborators;
• Billing and payment data: subscribed plan, amounts, payment data (handled through the payment provider — Carteia does not store card numbers);
• Electronic signature data: evidence of acceptance of the Terms of Service (signature image, timestamp, IP address, user agent, tamper-proof SHA-256 hash);
• Technical logs and usage data: IP addresses, access events, error diagnostics, service usage statistics.

1.2 Purposes and legal bases

1.3 Nature of the provision

Providing identification, billing and legal-representative data is necessary to activate and deliver the service: refusal makes it impossible to enter into the contract. Data for marketing purposes is optional.

1.4 Retention periods

• Account and contract data: for the duration of the relationship and 30 days after termination (then deletion/anonymisation);
• Accounting/tax data and documents (invoices): 10 years (Art. 2220 of the Italian Civil Code);
• Evidence of ToS acceptance and consents: for the duration of the relationship + the applicable limitation period;
• Technical/security logs: 6 months.

For end-customer data collected through the platform, the restaurant is the Controller and Carteia acts as Processor on its behalf, under the DPA. Purposes and legal bases are determined by each restaurant; the following describes the processing carried out by Carteia on its behalf.

2.1 Categories of data processed

• Booking data: name, phone, optional email, date/time, number of guests, notes;
• Waitlist data: name, contact, requested time;
• Table-ordering data (where the add-on is enabled): items ordered, table, amounts;
• Loyalty data: loyalty account, points balance, transactions, rewards;
• Consents: recording of date, time and version of the notice accepted, for evidentiary purposes;
• Menu visit statistics: collected in aggregated and anonymous form.

2.3 Recipients

End-customer data is accessible to the restaurant Controller and its authorised collaborators, as well as to Carteia (Processor) and its technical sub-processors (Section 3).

2.4 Exercising rights

Requests concerning end-customer data must be addressed to the restaurant as Controller. Carteia, as Processor, assists the restaurant in handling requests (Art. 28.3.e and 28.3.f GDPR), but does not independently decide on the purposes of the processing.

Carteia relies on providers acting as processors under Art. 28 GDPR, bound by agreement:

Only with prior consent (cookies/analytics and marketing tools): Google (Google Analytics 4) and Meta (Meta/Facebook Pixel) may receive browsing data.

Some providers may process data outside the European Economic Area. Such transfers are covered by Standard Contractual Clauses (SCC) under Implementing Decision (EU) 2021/914 and/or by adequacy decisions of the European Commission, with supplementary measures where necessary.

Carteia uses AI tools (Anthropic, OpenAI, Meta AI) as support for activities such as menu import and structuring. No solely automated decisions are made that produce legal effects or similarly significantly affect data subjects within the meaning of Art. 22 GDPR. End-customer data is not used to train AI models.

Within the limits of Art. 15–22 GDPR, you have the right to: access, rectification, erasure ("right to be forgotten"), restriction, objection, portability and, where processing is based on consent, withdrawal of consent at any time (without prejudice to processing already carried out).

• For data processed by Carteia as Controller (Level 1): privacy@carteia.app.
• For end-customer data (Level 2): contact the restaurant as Controller; Carteia will assist it.

You also have the right to lodge a complaint with the supervisory authority — in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

The site uses necessary cookies for operation (always active) and, only with prior consent, analytics, marketing and preference cookies. The choice is collected via the banner and is revocable at any time through the «Cookie» button. Each consent is recorded (date, time, notice version) for evidentiary purposes. For details, see the Cookie Policy.

Carteia may update this notice. Material changes are communicated through the service and/or by email. The date at the top indicates the latest revision.

For any request regarding data processed by Carteia: privacy@carteia.app.