Privacy Policy

We operate under five strict data pledges designed to protect European dining establishments:

To comply with Article 28 of the GDPR, it is critical to distinguish between the two roles under which itpia operates:

• itpia as Data Controller: itpia acts as the Data Controller with respect to account details, billing records, and operational contacts provided by restaurant owners, chefs, and general managers who subscribe to our platform.
• itpia as Data Processor: For all dining guests who book tables through our embedded reservation engine, Google Reserve link, or WhatsApp reminder workflow, the Restaurant Partner is the Data Controller, and itpia acts solely as the Data Processor carrying out instructions on the restaurant's behalf.

When you register a restaurant venue or request a consultation, we collect:

• Contact details: Name, business email address, WhatsApp/mobile telephone number.
• Restaurant attributes: Business name, legal address, VAT identification number, seating capacity, service hours, and table pacing configurations.
• Payment details: Handled securely through PCI-DSS Level 1 compliant payment gateways (Stripe). We do not store full credit card numbers on our servers.
• Creative assets: Raw kitchen video clips and photography uploaded by you for editorial production.

When a guest books a table at your establishment through our engine, we collect:

• Full name of the party lead.
• Mobile telephone number (used for sending transactional WhatsApp/SMS confirmation and seat release links).
• Email address (for calendar invites and booking receipts).
• Reservation parameters: Date, arrival time, party size, indoor/terrace seating preferences, and special dietary requests or allergies entered voluntarily by the guest.

We process personal data only when lawful under Article 6 of the GDPR:

• Performance of a Contract (Art. 6(1)(b)): To execute dining reservations requested by guests and deliver the growth services agreed with restaurant partners.
• Legitimate Interests (Art. 6(1)(f)): To prevent fraudulent reservations, mitigate no-shows through automated confirmation timing, and ensure the security of our platform.
• Legal Obligation (Art. 6(1)(c)): To maintain accurate tax and accounting records for European fiscal authorities.
• Consent (Art. 6(1)(a)): For optional restaurant promotional newsletters or direct marketing where explicit opt-in is collected.

itpia utilizes the official WhatsApp Business API and certified European telecom gateways to transmit reservation updates.

Unlike consumer reservation aggregators who build cross-venue diner profiles to sell ads and recommend rival restaurants, itpia operates a walled-garden infrastructure:

• Your dining guests will never receive recommendations to dine at competing establishments.
• Diner contact details are never shared with third-party advertisers or data aggregators.
• If you leave itpia, your guest list and history belong entirely to your restaurant.

We adhere to rigorous industry security standards:

• EU Hosting: All primary databases, Redis caches, and media asset storage are physically located in ISO 27001 certified data centers in Frankfurt, Germany and Brussels, Belgium.
• Encryption in Transit: All communications between diners, restaurant staff, and our servers are encrypted with modern TLS 1.3 protocol.
• Encryption at Rest: All database stores and backups utilize AES-256 encryption.

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered:

• Guest reservation logs are retained for 12 months following the dining date for dispute resolution and no-show auditing, after which identifying fields are automatically anonymized.
• Restaurant operational and invoicing records are kept for the statutory period required under European commercial and fiscal law (typically 7 to 10 years depending on national jurisdiction).

European data subjects (both operators and dining guests) possess comprehensive rights under Chapter III of the GDPR:

If you have questions, exercise requests under GDPR, or feedback regarding our privacy practices, please contact our Data Protection Officer: