Privacy policy

Last updated: 22 July 2026

NovaResto is a platform published by Novadesko SRL, a Belgian company specialised in management solutions for the hospitality (HORECA) sector. We take the protection of your personal data seriously: this page explains, in plain language, which data we collect, why, how long we keep it and what your rights are. It applies to novaresto.com, the BackOffice, establishment websites ({slug}.novaresto.com) and the NovaResto mobile apps.

1. Data controller

The data controller is Novadesko SRL, with registered office at Rue de Boussoit 4, 7110 Maurage, Belgium, registered with the Belgian Crossroads Bank for Enterprises under company and VAT number BE 1018.192.568 (telephone: +32 64 78 00 87).

For any question about your personal data, you can contact our data protection officer at privacy@novaresto.com.

2. Data we collect

We only collect the data needed to run the service:

  • Account data: first name, last name, email address, password (encrypted), language.
  • Establishment data: name, address, contact details, logo, menu, opening hours, published content.
  • Billing data: billing details, VAT number, payment history. Card data is processed by our payment provider (Stripe) and never touches our servers.
  • Usage data: orders, reservations, technical logs (IP address, browser type, timestamps) required for security and diagnostics.
  • Contact form data: name, email, establishment and message.
  • Guest account data (establishment websites): name, email address, order and reservation history, processed on behalf of the restaurateur concerned.
  • Cookies: strictly necessary session cookies and, only with your consent, Google Analytics audience-measurement cookies.

3. Your guests' data

When your guests order or book through your establishment's website, you are the controller of their data and NovaResto acts as a processor within the meaning of Article 28 GDPR. We process this data exclusively on your instructions, to provide the service, and we never use it for our own commercial purposes.

4. Legal bases

We process your data on the following bases:

  • Performance of the contract: providing the platform, billing, support.
  • Our legal obligations: accounting, taxation, invoice retention.
  • Our legitimate interest: service security, fraud prevention, product improvement based on aggregated statistics.
  • Your consent: audience-measurement cookies (Google Analytics) and possible marketing communications; you can withdraw it at any time.

5. Retention periods

Account data is kept for the duration of your subscription, then for 30 days after account closure (so you can export your data), before deletion or anonymisation. Accounting documents are kept for 7 years, in line with Belgian law. Technical logs are kept for a maximum of 12 months.

6. Recipients and processors

Your data is never sold. It is shared only with the providers strictly necessary to the service: hosting (OVH, European Union), payments (Stripe), transactional email delivery and, with your consent, audience measurement (Google). Each provider is bound by a GDPR-compliant data processing agreement. Where a transfer outside the European Union is unavoidable, it is covered by standard contractual clauses.

7. Security

All connections are encrypted (HTTPS). Passwords are hashed, internal access is limited to what is strictly necessary and data is backed up several times a day on servers located in the European Union. In the event of a data breach likely to create a risk for your rights, we notify the Data Protection Authority and the persons concerned within the legal deadlines.

8. Your rights

Under the GDPR, you have the following rights:

  • Right of access: obtain a copy of the data we hold about you.
  • Right to rectification: correct inaccurate data.
  • Right to erasure: request deletion of your data, within the limits of our legal obligations.
  • Right to portability: receive your data in a structured, machine-readable format.
  • Right to object and right to restriction of processing.
  • Right to withdraw your consent at any time, for processing based on consent.

9. Exercising your rights and complaints

To exercise your rights, write to privacy@novaresto.com. We reply within one month. If you believe your rights are not being respected, you may lodge a complaint with the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.

10. Changes

This policy may evolve with the service. In the event of a substantial change, we inform you by email or via the BackOffice at least 30 days before it takes effect.