Privacy notice — how we handle business contact information

1. Who we are (the controller)

Restaba is currently operated by an individual, and we would rather say so than imply otherwise.

A note on why there is no street address above: Restaba is being incorporated as a Portuguese company. Until that completes, the controller is a natural person, so the postal address on file is a private home rather than an office — we give it in writing to anyone who asks at privacy@restaba.com, and we do not publish it on a public page. When the company is registered, it becomes the controller, its registered office goes in the table above, and we will say on this page that the change happened — we will not quietly swap the name.

We have not appointed a Data Protection Officer; we are not required to.

2. What information we hold about your business

• Your venue name and trading address
• Your published business email address and published business phone number
• Your website address and your public business listing (for example, your Google Business Profile)
• Public signals from that listing: your rating, the number of reviews, the languages your reviews are written in, whether the listing has photographs of dishes, whether a menu is available and how current it appears
• Where your website publishes the name of an owner or manager in a business role, that name and role
• Our own assessment score for your venue (explained in section 5), and a record of any emails we sent you and any reply

We do not hold, and do not try to obtain: anyone's home address or personal phone number, private social media profiles, financial information, anything about your customers or staff, or any special category of data (such as health, religion, political opinions or trade-union membership).

3. Why we hold it, and our lawful basis

Purpose: to identify restaurants and cafés whose public online presence suggests our service would be useful to them, and to send at most two emails offering that service.

Lawful basis: legitimate interests — Article 6(1)(f) GDPR.

Our legitimate interest is in offering a paid business service to businesses that our public research indicates have the problem it solves. Direct marketing is expressly recognised as a possible legitimate interest by Recital 47 of the GDPR.

We carried out a Legitimate Interests Assessment before collecting any data, weighing our interest against your rights. In short, we concluded it is proportionate because we use only information you published about your own business, at a business address, for a message about your own trade, at a volume of no more than two emails, with a free and immediate way to stop. You can ask us for a copy of that assessment at privacy@restaba.com, and we will send it.

We do not rely on consent for this, which is why we are not asking you for any. We rely on legitimate interests — and that is exactly why you have the absolute right to object in section 8.

4. Where we got it — and that it was publicly accessible

Article 14(2)(f) requires us to tell you our source. In full:

1. Your own public website — this is the only place we take an email address from.
2. Your own public business listing (Google Maps / Google Business Profile) — for the listing signals in section 2.
3. The public company register — KVK in the Netherlands, the Companies Registration Office in Ireland — used only to check what legal form your business takes.

All of this information was publicly accessible at the time we collected it, published by your business about itself.

Equally important, here is what we did NOT do, because you are entitled to know that too:

• We did not buy, rent or licence your details from anyone.
• We did not obtain them from a data broker or a B2B contact database.
• We did not scrape a directory, an aggregator, or LinkedIn.
• We did not guess your email address from a name pattern, and we did not use a tool to test whether a guessed address exists.
• We have not enriched, appended to, or combined your details with data from any other source.

If you believe we hold an address you never published, tell us and we will delete it and tell you what we find — that would be a failure of our own rules, not a grey area.

5. Automated assessment (and what it does not do)

We score each venue out of 100 on public signals — how often the menu appears to change, how weak the current digital menu is, how few dish photographs the listing has, how many languages the reviews are in, and whether a business contact route is published. The score decides whether we spend our own money pre-building a sample menu for you, and whether we write to you at all.

What this is not:

• It is not a decision that produces legal effects or similarly significant effects on any individual, so Article 22 does not apply. What it decides is how we spend a few euros of our own budget, and whether one email is sent.
• It makes no judgment about any person — not their seniority, influence, creditworthiness or likelihood of buying. Where a named owner or manager is involved, the score records only that a business contact route exists, nothing about the individual.
• Nothing is inferred about you that you did not publish.

Where the scoring does involve a named individual, we treat it as profiling under Article 4(4) GDPR and it is covered by the objection right in section 8 — including the profiling itself.

6. Who we share it with

We do not sell, rent, share or publish your information, and we never will.

We use a small number of standard service providers who process data on our behalf under contract — an email sending service and a database host. They act only on our instructions and may not use your data for their own purposes. You can ask us for the current list at privacy@restaba.com and we will send it.

We do not transfer your data outside the European Economic Area, other than as may be inherent in those providers' standard infrastructure, in which case appropriate safeguards apply.

7. How long we keep it

• 18 months from the last time we contacted you, after which the record is deleted.
• If we collect a record and do not contact you within 30 days, we delete it.
• If you never reach the point of being contacted (your venue does not meet our criteria), the contact details are deleted at the end of that batch.
• If you ask us to erase your data, we do so the same day.

One honest exception, so it does not surprise you later. If you object or ask us to stop, we must keep a minimal suppression record — your email address (in a protected form where we can), the date, and the fact that you objected — for as long as we do any outreach at all. We keep it for one reason: so that we never contact you again. Deleting it would guarantee that a future list picks you up afresh, which is the opposite of what you asked for. We keep nothing else about you — no score, no history, no name.

8. YOUR RIGHT TO OBJECT

(This section is presented separately and clearly, as Article 21(4) GDPR requires.)

9. Your other rights

Alongside the right to object in section 8, you have the right to:

• Access — get a copy of the information we hold about you (Article 15)
• Rectification — have inaccurate information corrected (Article 16)
• Erasure — have your information deleted (Article 17), subject only to the minimal suppression record explained in section 7
• Restriction — have us pause our use of your information while a question is resolved (Article 18)

One right that does not apply here, stated plainly rather than listed misleadingly: the right to data portability (Article 20) applies only where processing is based on your consent or on a contract, and is carried out by automated means. We rely on legitimate interests, not consent or a contract, so portability does not apply to this processing. We would rather tell you that than list a right we do not in fact owe you.

To exercise any right: email privacy@restaba.com. We will respond within one month (Article 12(3)). There is no charge. We may ask for enough information to be sure we are dealing with the right business — we will not use that as an obstacle.

10. Complaining to a supervisory authority

If you are unhappy with how we have handled your data, please tell us first — but you do not have to, and you can complain to a data protection authority at any time (Article 77). You may complain to the authority in the country where you live or work, or where the problem occurred:

You may also seek a judicial remedy (Article 79).

11. When we tell you

Where we obtain your information from public sources, the GDPR requires us to inform you within a reasonable period and at the latest one month after collection, and — if we use it to contact you — at the latest when we first contact you (Article 14(3)).

Our own rule is tighter: we contact you within 30 days of collecting your details, or we delete them. Every email we send links to this page, so this notice reaches you no later than the first message.

12. Changes to this notice

If we change this notice we will update the date at the top. If the controller changes — when Restaba is incorporated as a company — we will say so on this page rather than simply replacing the name.

Questions: privacy@restaba.com