Qartol BBQ & Bar app — Privacy Policy

Qartol BBQ & Bar, the restaurant, decides how the details you give when ordering are used, and is the data controller for them. TheZNZpublishes the app and runs the MenuDock platform behind it, and processes your data on the restaurant's behalf and on its instructions.

Questions about your data can go to either: to the restaurant directly, or to TheZNZ at privacy@menudock.co.uk, and we will deal with it or pass it on.

• Account details — if you create an account: your name, email address, phone number and password (stored hashed), or your Google or Apple sign-in identifier. Signing in is optional; you can order as a guest.
• Order details — what you order, collection or delivery, your delivery address, any notes, the time you asked for, and your order history.
• Saved addresses — delivery addresses you choose to save to your account.
• Payment status— whether a payment succeeded and the payment provider's reference. Card details are entered on the payment provider's secure payment page and are never seen or stored by the app, the restaurant or TheZNZ.
• Table bookings — if the restaurant takes bookings: the date, time, party size, your contact details and any deposit paid.
• Reviews — if you choose to review an order: your rating, your comment, and your first name and last initial as the author.
• Your marketing choices — whether you agreed to hear about offers by email, text or app notification, and when you opted out.
• Device identifiers — the push notification token for your device, and a random identifier the app creates so that it can send order updates for guest orders placed on that device.
• Crash and performance data — when the app crashes or an error occurs: device model, operating system and app version, the error itself, and your account identifier if you are signed in. Request contents, passwords and sign-in tokens are removed before it is sent.

The app does notcollect your location (delivery uses the address you type), contacts, photos, camera, microphone, browsing history or advertising identifier. It shows no advertising and does not track you across other companies' apps or websites.

• To take, prepare, deliver and charge for your order.
• To tell you about your order — by email, app notification and, where the restaurant has switched it on, text message.
• To keep your account, saved addresses and order history, and to let you reorder.
• To take and manage table bookings, where the restaurant offers them.
• To send you offers from Qartol BBQ & Bar — only if you agreed, and never after you opt out.
• To find and fix crashes and errors in the app.
• To keep the service secure, prevent fraud and meet legal obligations.

• Contract — to fulfil the order or booking you asked for, and to run your account.
• Legitimate interests — crash reporting, security and fraud prevention.
• Legal obligation — keeping order records for accounting and tax.
• Consent — marketing by email, text or app notification, which you can withdraw at any time.

Qartol BBQ & Bar sees your orders, bookings and contact details so that it can serve you. Nobody sells your data, and it is not shared for advertising. The following service providers handle it on our behalf under data-processing terms:

• Supabase — database and sign-in (EU region).
• Vercel — hosting of the ordering service.
• Stripe or Square — card payments, depending on which the restaurant uses.
• Google Firebase Cloud Messaging and Apple Push Notification service — delivering app notifications.
• Sentry — crash and error reports.
• Brevo — email.
• Twilio — text messages.
• Google and Apple — only if you choose to sign in with them.

Some of these providers may process data outside the UK. Where they do, the transfer is covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

• Account details and saved addresses: until you delete your account.
• Orders and payments: at least 6 years, as UK accounting and tax law requires — also after your account is deleted.
• Push notification tokens: until you delete your account, or the token stops working.
• Crash and error reports: up to 90 days.

Under UK GDPR you can ask to access, correct, delete or move your personal data, and object to or restrict how it is used. You can also complain to the Information Commissioner's Office at ico.org.uk.

• Delete your account inside the app, under Account → Delete account, or see how to delete your Qartol BBQ & Bar account.
• Stop marketing with the unsubscribe link in any email, the link in any promotional text, or the notification settings in the app and on your phone. Order updates are not marketing and continue.
• Anything else — email privacy@menudock.co.uk. We reply within one month.

The app is not directed at children under 16, and we do not knowingly collect their data. Where the menu includes alcohol, it is sold only with a food order and the restaurant checks age on collection or delivery.

Data is encrypted in transit and at rest, passwords are stored hashed, and each restaurant's data is kept separate from every other's. If a breach affected your personal data, we would tell you and the ICO as the law requires.

When this policy changes, the date at the top changes with it. For any question about your data in the Qartol BBQ & Bar app, contact TheZNZ at privacy@menudock.co.uk.