Privacy Policy
Updated
Portano builds ordering channels for restaurants. Personal data comes with that: data about visitors to this site, about owners who ask for a demo, about the people who work with Portano at a restaurant, and about the guests who order at such a restaurant.
This statement tells you which data we process, what for, on what legal basis, how long we keep it and what say you have in it. If you find something unclear, mail hello@portano.nl.
Who we are
Portano gives restaurants their own ordering site and ordering app under their own name, with the menu, loyalty, email and SMS and a kitchen screen behind them. Portano is a sole proprietorship (eenmanszaak), registered with the Dutch Chamber of Commerce under number 42034499. There is no separate statutory name beside the trade name. Portano was founded by Parnav.
Our address in the registers is Amperestraat 2d, 3112 MC Schiedam. That address is there for post. It is not a place you can drop by, and we receive no visitors there.
If you have a question about this statement, or you want to use one of your rights, mail hello@portano.nl. We reply within one working day.
What this statement covers, and what it does not
This statement is about the data Portano itself decides what happens with. That is the data of visitors to portano.nl, of owners who ask for a demo or mail us, of the people who work with Portano at a restaurant, and the data that belongs to invoicing. For that data Portano is the controller. For the accounts of the people who work at a restaurant we are the controller too, and deliberately so: we decide how signing in works, which roles there are and how we secure those accounts. The restaurant does decide who gets an account there and when that account is withdrawn again. If the Data Processing Agreement makes that look different, what is written here governs those accounts.
For the data of a restaurant’s guests it works differently. A guest orders from the restaurant, and the restaurant is the seller of the food. The restaurant decides what happens with its guests’ data and what it is used for. Portano processes that data only on the restaurant’s instructions and is a processor for it within the meaning of artikel 28 AVG (article 28 of the GDPR).
What Portano may and may not do with guests’ data, what security belongs to that, and what happens to it when the working relationship ends, is set out in the Data Processing Agreement. That agreement belongs with the agreement with the restaurant. If this statement and the Data Processing Agreement differ about guests’ data, the Data Processing Agreement applies.
If you are a guest and you ordered from a restaurant that works with Portano, put your question to that restaurant. That restaurant is your point of contact and decides. We help the restaurant answer your question.
Alongside this statement, the Website Terms and the Disclaimer apply to the use of this site, and the General Terms and Conditions and the Platform Terms apply to the service. What we do to keep the site usable is set out in Accessibility.
What data we process
If you ask for a demo, we process what you fill in yourself. On the form on the demo page the name of your restaurant, your role in the business and your email address are required, and your name is optional. On the shorter form with the prices your name, the name of your restaurant and your email address are required, and we do not ask for your role. Your phone number is optional on both forms. We also record which language you were reading the site in, so that we answer in your own language. Your request is stored in our database and we send ourselves one message with the request in it, so that we do not miss it.
We attach no IP address and no browser details to a demo request. The form does not ask for them and they do not end up with your request in our database.
If you mail us or call us, we process your name, your email address or your phone number and what your question is about. We keep those messages so that a conversation picked up later does not start from nothing.
If your business works with Portano, we process the data of the people who sign in there: name, email address, phone number and the role someone has in the system. We also process the data we need to set up and support your business, such as the name and address of the location, the opening hours and who our fixed contact person is.
For invoicing we process the data of your business and of the person who receives the bill: name, address, email address, the plan chosen, the amounts and the payments. Part of those records we have to keep because tax law requires it.
If you only read the site, we process only what is needed to show the page and to measure anonymously how the site is used. How that works is set out below under Cookies and measurement. We use your IP address only during the request itself, to protect the forms against abuse. We do not write it down.
The data of a restaurant’s guests is deliberately not listed here. We process it on the restaurant’s instructions, and what we process of it is set out in the Data Processing Agreement.
What we use it for, and on what legal basis
Below is, per purpose, which data we use, which basis under the AVG it rests on and how long we keep it.
| What for | Which data | Legal basis | How long |
|---|---|---|---|
| Answering a demo request and preparing the demo | The name of the business, the email address, and whatever else you fill in | Legitimate interest: responding to an owner who asks for contact themselves | Up to twelve months after the last contact, sooner if you ask |
| Handling a question by mail or phone | Name, email address or phone number, and what your question is about | Legitimate interest: handling your question | Up to twelve months after the last contact, sooner if you ask |
| Performing the agreement with a restaurant: setting the business up, publishing it, keeping it current and supporting it | Data of the business | Performance of the agreement | For as long as the agreement runs, and after that for as long as winding up takes |
| Giving people at a restaurant access to the portal and the kitchen screen, and keeping that access safe | Name, email address, phone number and role | Legitimate interest: a restaurant can only use the service if its people have their own account, and we have to be able to see who did what | For as long as someone has an account, and after that for as long as winding up takes |
| Sending invoices and keeping the records | Data of the business, the person who receives the bill, the amounts and the payments | Performance of the agreement and legal obligation | Seven years, the retention period for tax records |
| Measuring anonymously how the site is used | Which pages are viewed, with no recognition between visits | Legitimate interest: knowing which pages are read and which are not | Nothing is kept between visits |
| Measuring after you say yes to it | Which pages you view and how you move through the site, tied to a cookie and an entry in your browser storage | Consent | Until you undo your choice or clear this site’s data in your browser |
If we rely on a legitimate interest, we have weighed that interest against your privacy and we process no more than that purpose needs. You can object to such processing. How that works is set out under Your rights.
If a processing rests on consent, you can always withdraw that consent again. From that moment we stop. What happened before it stays lawful.
We do not use your data to make automated decisions about you and we do not build a profile of you with it.
Cookies and measurement
By default portano.nl sets no cookie and stores nothing on your device. You do not have to do anything to keep it that way.
We do measure how the site is used, with a product analytics service that runs on European servers. By default that measurement is anonymous. No profile of you is built, and because nothing is kept between visits, we do not recognise you if you come back later.
At the foot of the page we ask whether we may remember you after all. If you say yes, we keep a cookie and an entry in your browser storage, so we can see whether the same visitor returns and how they move through the site. If you say no, the measurement stays anonymous as described above.
Whichever answer you give, we remember that answer in your browser storage under the name portano-consent. Otherwise we would ask the question again on every page. You undo your choice by clearing this site’s data in your browser.
For that measurement this site loads one script from another party. It is the only script from outside that sits here. The fonts come from our own server.
Transfers outside the European Economic Area
Our servers and our database are in the European Union. The product analytics service also runs on European servers, and the address lookup service of the Kadaster sits in the Netherlands.
Some of the other services in the table above are established outside the European Economic Area. If data goes to such a service, that transfer rests on the standard contractual clauses of the European Commission, or on an adequacy decision in which the European Commission has established that the country where the service is based offers an adequate level of protection.
We transfer no more than that one task needs. If you want to know which service receives which data and what the transfer rests on, mail hello@portano.nl. Then we send you the overview.
How long we keep data
The periods are set out per purpose in the table above. In short, it comes down to this.
- We keep a demo request for up to twelve months after our last contact. Ask us to delete it sooner and we take the request out of our database and throw the message about it out of our mailbox.
- Messages by mail and notes from a phone call we keep just as long.
- The data of a restaurant and of the people who sign in there we keep for as long as the agreement runs, and after that for as long as winding up takes.
- Invoices and the records around them we keep for seven years, because tax law requires it.
- Of the anonymous measurement of the site, nothing is kept between visits.
- If you said yes to measurement, that holds until you undo your choice or clear this site’s data in your browser.
What we no longer need, we delete. We take a backup copy of our database every night, and it sits on the same infrastructure. A deletion from the database works through into those backup copies as soon as they are replaced by new ones.
How long guests’ data stays is for the restaurant to decide. That is set out in the Data Processing Agreement.
How we secure data
Our systems and our database run on rented servers in the European Union. The traffic between your browser and our server runs over a secure connection.
All restaurants sit in one database. The data of each restaurant is separated by its own identifier, and the application guards that someone only reaches the data of their own business. Access runs through a personal account with a role that determines what someone may see and do.
We take a backup copy of the database every night, on the same infrastructure.
Payment details never reach us. A guest pays on the payment service provider’s own page, with iDEAL, Bancontact or card. We see no card details and we do not store them.
We write down here only what we do, not what a certificate would say. There is no ISO or SOC statement, no external audit and no penetration test. If something is not here, we do not have it. If that changes, it comes here.
If something does go wrong with personal data, we report it to the Autoriteit Persoonsgegevens, the Dutch data protection authority, where the law requires that, and to you if it is likely to be a high risk to you. If the breach affects a restaurant’s guests, we let that restaurant know, as the Data Processing Agreement requires.
If you think there is a hole in our security, mail hello@portano.nl. We reply within one working day and we take a report like that seriously.
Your rights
Send a message to hello@portano.nl and write what you want. We reply within one working day and settle your request within a month. If it is a complicated request, we let you know within that month that we need more time and why. Using your rights costs nothing.
We may ask you for extra details to be sure that you are who you say you are. We use those for that alone and not afterwards.
If you object to processing based on a legitimate interest, we stop, unless we have compelling grounds that outweigh your interest. You can object to the use of your data for direct marketing at any time, and there we always stop.
If you withdraw a consent, the processing that rests on it stops from that moment. Processing that rests on another basis carries on. An invoice we have to keep under tax law, for example, we cannot throw away.
If you are a guest of a restaurant that works with Portano, you put your request to that restaurant, because that restaurant decides on it. In your own account you can download everything we hold about you in one file, and you can delete your account yourself. When you delete it, we also strip your name, email address, phone number, address and the delivery note from your earlier orders. What you typed yourself for the kitchen with a dish, and what you wrote in a review, stays. If you want that gone as well, ask the restaurant.
Complaints
If you disagree with how we handle your data, tell us yourself first. Mail hello@portano.nl and write down what happened. Usually we work it out together, and that goes quicker.
You also always have the right to lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch supervisory authority for privacy law. You do not have to talk to us about it first. The way to the courts is open to you as well.
If your complaint is about the data a restaurant holds about its guests, that restaurant is the party that decides on it. We help that restaurant answer your complaint.
Children
Portano sells to businesses. This site, the demo and the portal are meant for owners and for the people who work in their business, not for children.
The ordering sites and ordering apps we build for restaurants are aimed at guests who place and pay for an order themselves. They are not aimed at children and we aim no marketing at them either. In the Netherlands, someone under sixteen needs the consent of a parent or guardian before their data may be processed on the basis of consent.
If you think we hold data about a child without that consent, mail hello@portano.nl. Then we look into it and delete it. If it concerns data a restaurant holds about a guest, we put you in touch with that restaurant, because that restaurant decides on it.
Changes to this statement
We adjust this statement when our service changes, when we start working with a different service or when the rules change. Every version carries the date on which we updated it, so you can see which is the most recent.
If something material changes for a restaurant we have an agreement with, we let them know by email. If something changes about a processing that rests on consent, we ask for your consent again.
This statement is about Portano itself. What happens with guests’ data changes only along the route set out in the Data Processing Agreement.
Contact
If you have a question about this statement, about your data or about one of your rights, mail hello@portano.nl. We reply within one working day.
You can also call, on 06 87 83 83 18. From abroad that is +31 6 87 83 83 18.
You can send post to Portano, Amperestraat 2d, 3112 MC Schiedam, the Netherlands. That address is for post. Dropping by is not possible.
Portano has no data protection officer. Your question reaches Parnav, and he answers it himself.