A short guide to who is responsible for which personal data on Octopus Menu, with links to the detail.
Who is responsible
- Diners’ data: the restaurant. Each restaurant is the controller of the personal data of its diners: feedback and any contact details left with it, its loyalty card members, its email subscribers, and its menu analytics. Octopus Menu is its processor and handles that data only on the restaurant’s instructions.
- Restaurant accounts and our website: Octopus Menu. We are the controller of the data of our customers’ account users, of billing records, and of visitors to our website. See our Privacy Policy.
The Data Processing Addendum
Our Data Processing Addendum meets the requirements of Article 28 of the UK GDPR and the EU GDPR. It is part of our Terms of Service and applies automatically to every customer; there is nothing to sign. It lists what we process, how long it is kept, our security measures, and how we help with diners’ requests and with breaches.
Sub-processors
The service providers that process personal data for us, what they do and where, are on our sub-processors page.
What restaurants are responsible for
- Having a lawful basis for collecting and using their diners’ data.
- Telling diners how their data is used. We provide a standard diner privacy notice, shown with the restaurant’s name and contact details and linked from its menu, which the restaurant may adopt.
- Getting consent for marketing emails and for any analytics or advertising tags they add to their menu.
- Answering diners’ requests to access, correct or delete their data, and their complaints.
- Everything they do with diners’ contact details, including emails and calls to diners.
Diners
If you are a diner, please contact the restaurant about your data. You can also delete your loyalty card from the card itself at any time.
Contact
Data protection questions: privacy@octopusmenu.com. Contract questions: legal@octopusmenu.com.