Effective date: 1 November 2026
Platform: youRest
Website: yourest.eu and applicable restaurant subdomains on youRest

1. About this Privacy Policy

youRest provides technology that enables restaurants, cafés, bakeries and other food businesses (“Restaurants”) to display menus, receive orders and manage delivery or collection.

The platform is operated by Nataliia Kirejeva, a sole trader established in Ireland, trading as NK Platform Studio (“we”, “us” or “our”).

This Policy explains how personal data is handled when you browse a menu, place or manage an order, contact us or use a Restaurant’s business account. Features vary between Restaurants.

Privacy contact: nataliaki@nataliaki.eu
Operator business address: Main Street, Enniscorthy, Wexford, Y21 WYK5, Ireland.

2. Who is responsible for your data?

The Restaurant identified on the ordering page is the controller of personal data used to accept and fulfil your order, prepare food, arrange collection or delivery, communicate about the order and meet its own legal obligations. The Restaurant is responsible for identifying itself and explaining its processing. Contact us if you need help identifying the Restaurant or directing a privacy request.

For order data that we store and process solely on a Restaurant’s instructions, we act as its data processor. That processing must be governed by a data processing agreement.

We act as a separate controller where we determine the purposes and means of processing, including managing our relationship with Restaurant partners, administering platform charges, handling enquiries addressed to us, protecting our service against abuse and meeting our own legal obligations.

Where we collect a platform service charge, we are the controller of the transaction information needed to administer that charge, reconcile payment, handle related refunds or disputes and meet our own accounting obligations. This is separate from the Restaurant’s processing to fulfil the food order.

This Policy describes our own processing and the technology we provide. The Restaurant’s notice explains its processing. Payment providers and any independent delivery services also explain their own processing in their respective notices.

3. Personal data processed through the platform

Depending on the features you use, the platform processes:

• Contact information: your name, email address and telephone number.
• Order information: the Restaurant selected, items, quantities or weights, options, prices, fees, order reference, order status and relevant timestamps.
• Delivery and collection information: delivery address, delivery instructions, selected date or time slot, collection time and any proposed or confirmed changes.
• Payment information: payment method, amount, currency, transaction reference, payment status, outstanding balance and refund or dispute information.
• Communications: enquiries, order-related messages, complaints and our replies.
• Technical information: IP address, browser and device information, language settings and operational or security logs.
• Notification information: preferences, delivery status and, when enabled, Telegram chat identifiers or web-push subscription endpoints and associated keys.
• Restaurant account information: applicants’ and authorised users’ names, business contacts, roles, password hashes and account activity, together with company and billing details, legal representative information and agreement acceptance evidence.

We obtain information directly from you, from the Restaurant when it enters or updates an order, and from payment or notification providers when they report events. Technical information is generated when a device communicates with the service. Required information is identified during the relevant process: a name and telephone number are needed for an order, and delivery requires an address. Without necessary information, the requested service may not be available. Optional information and browser notification permission are not required to place an ordinary order. If you provide another person’s contact details, make sure you are entitled to do so and tell them how the information will be used.

4. Why personal data is used and the legal bases

For its order-fulfilment activities, the Restaurant generally relies on performance of its contract with you, or steps you request before entering into it, to receive and assess an order, confirm or propose a time, prepare food, arrange delivery or collection and provide order support. As its processor, we carry out the relevant operations on its instructions.

For processing where we act as controller, we rely on:

• Contract or pre-contractual steps: setting up and administering Restaurant partner accounts, providing agreed platform services where the individual is a party to the contract, and administering a platform service charge payable under our agreement with you.
• Legitimate interests: administering relationships with staff acting for business partners, responding to enquiries, protecting the platform, investigating misuse and establishing or defending legal claims. We consider the effect on individuals and balance these interests against their rights.
• Legal obligations: retaining records required by applicable accounting or tax law and responding to legally binding requests.
• Consent: optional marketing and non-essential tracking where introduced and where consent is required. Refusing or withdrawing this consent does not prevent ordinary ordering. Browser permission is requested separately when you choose push notifications.

5. Order notes, allergies and dietary information

Please avoid entering medical information or other sensitive personal information in general order notes. For allergy requirements, contact the Restaurant using the contact details shown on its page.

Menu allergen information describes food and does not by itself record a customer’s medical condition. Identifiable allergy or health information can receive additional protection under data protection law. A Restaurant that asks for it must explain the purpose, recipients, retention and applicable legal grounds, including an Article 9 condition where required. This Policy does not itself obtain explicit consent to processing health information.

6. Delivery addresses and location

Delivery addresses and instructions are used to check service coverage, calculate applicable charges and help deliver an order. A delivery worker receives the information needed for the assigned delivery, such as your name, address, contact number and delivery instructions.

When a Restaurant opens a delivery route in Google Maps, the route locations, including delivery addresses or coordinates, are passed to Google for navigation. Google explains its processing at https://policies.google.com/privacy.

An optional business-address tool can, with the user’s browser permission, obtain the device’s current coordinates and send them to Google’s geocoding service to suggest an address. The business address can be entered manually instead. This feature does not mean that youRest continuously tracks customers or couriers.

7. Payments

Where online payment is offered through Stripe, payment details are entered through Stripe’s payment interface. The platform receives transaction information needed to update an order, reconcile charges and manage refunds, rather than your full card number or security code.

Stripe has controller or processor responsibilities depending on the activity, including its own fraud-prevention and regulatory processing. Read its Privacy Policy at https://stripe.com/privacy.

The checkout identifies the applicable payment arrangement, including whether the payment covers the full order, a deposit or a platform fee. The Restaurant records cash or other directly collected payments where relevant.

Restaurant partners may also provide business verification and payout details directly to Stripe when setting up a connected account. We receive the account identifiers and status information needed to administer the integration.

8. Service messages and marketing

Order confirmations, requests to approve a changed time, delivery or collection updates, payment messages and refund notices are service communications.

Placing an order does not by itself give consent to promotional messages. If we introduce our own marketing, we will explain it separately, use a lawful basis, obtain consent where required and provide an unsubscribe method. Unsubscribing does not stop messages necessary for an active order.

A Restaurant is responsible for any marketing it independently sends and for establishing the necessary permission.

Email updates are sent where an email destination and that service are configured. If you enable browser push notifications, we store the subscription endpoint and keys needed to send messages through your browser’s push service. You can revoke permission in browser or device settings and contact us to request removal of the stored subscription. Order notifications can also use Telegram where the channel and recipient are configured, as described below. Messages may be visible to others with access to the receiving account or device. Keep your private order-page link confidential because it provides access to information and actions for that order.

9. Cookies and similar technologies

Browser storage supports functional features such as the Restaurant-specific shopping cart and business-account authentication. A signed session cookie supports business sign-in and normally expires after seven days. Business users may also save a language preference or choose to remember their sign-in email on their device. Persistent cart and preference data can remain until replaced or cleared. You can remove stored information through browser controls, although clearing authentication or cart data affects those functions.

Only technologies that qualify for a legal exemption may operate without consent. Non-essential analytics, advertising and conversion tracking require consent before activation. If introduced, they must be accompanied by the relevant notice and controls to change or withdraw consent. This Policy does not provide consent to optional tracking.

The Cookie Policy describes the technologies actually used, their purposes, providers and lifetimes.

10. Who receives personal data?

Depending on the service, personal data is made available to:

• the Restaurant fulfilling your order and its authorised staff;
• authorised platform personnel supporting accounts, orders, payments, security or privacy requests;
• delivery personnel or delivery providers handling the order;
• payment providers;
• hosting, database, email and other technical service providers supporting the relevant processing;
• professional advisers where necessary and subject to confidentiality;
• authorities or courts where disclosure is legally required.

Providers acting as processors must process data under appropriate contractual instructions. A provider acting as an independent controller is responsible for its own processing.

Where Telegram order notifications are configured, Telegram receives the chat destination and message content. Alerts can contain an order reference, status, time or amount and, in staff alerts, the customer’s name. Its notice is at https://telegram.org/privacy. Google receives the location information described above when the relevant mapping feature is used. Email and browser-push providers handle the destinations and messages needed for their channels.

We do not sell personal data or disclose it for unrelated third-party marketing.

11. International transfers

Some providers may process data outside the European Economic Area, including through international infrastructure or support access. This can apply to payment, mapping and messaging services.

Where processing involves a transfer outside the European Economic Area, the relevant controller must ensure an applicable transfer mechanism is in place. Depending on the destination and recipient, this may be a European Commission adequacy decision or standard contractual clauses with any necessary supplementary safeguards.

For transfers for which we are responsible, you can contact admin@bbqr.site for information about the safeguards and how to obtain a copy, subject to appropriate redaction.

12. How long data is kept

We retain personal data only for the purposes for which it is needed. Restaurant-controlled order data is retained in accordance with the Restaurant’s documented instructions and applicable law.

For data under our control, retention is determined by these criteria:

• Restaurant accounts and business contacts: while needed for the relationship, followed by the information needed to close the account, settle balances, demonstrate the agreement or address applicable legal claims.
• Our invoices and tax records: for the applicable statutory period. Irish Revenue generally requires relevant business records to be kept for six years; a particular record may need longer retention where the law requires it. This concerns necessary financial records rather than every field of an order.
• Platform payment, refund and dispute records: while needed to reconcile charges and resolve disputes, and for any applicable statutory or claims period.
• Support enquiries and complaints: while needed to resolve the matter and, where applicable, establish, exercise or defend a related claim.
• Operational, security and audit records: while needed to operate and protect the service, investigate a relevant incident or address a related claim. A dispute concerning one record does not justify keeping all unrelated data.
• Notification subscriptions: while needed for the requested notification service. Revoking browser permission does not itself erase the associated server record; contact us to request removal.
• Browser cart and preference data: until replaced or cleared as described above.

Data that is no longer required should be deleted or irreversibly anonymised. Backup handling must respect the applicable retention and deletion requirements.

Information retained for a legal obligation or ongoing claim is restricted to that purpose. Where data is anonymised, it must no longer identify an individual. Closing an account does not necessarily erase records that must lawfully be retained.

13. Security

We use authenticated business accounts, role-based access and tenant permissions intended to limit access to the relevant Restaurant and authorised users. Appropriate technical and organisational safeguards are required for the information handled. Keep passwords and private order links confidential and contact us if you suspect unauthorised access.

No system is completely secure. Where a personal data breach requires notification, we notify the appropriate authority and affected individuals in accordance with applicable law. For Restaurant-controlled data, we notify the Restaurant as required and assist it with its obligations.

14. Your data protection rights

Subject to the conditions in the GDPR, you may request access, correction, erasure, restriction of processing or data portability. You may object to processing based on legitimate interests and may object at any time to direct marketing.

Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

Contact nataliaki@nataliaki.eu and, where relevant, provide the Restaurant name and order reference. For data we process on a Restaurant’s behalf, we help route your request to the Restaurant and assist it in responding.

For requests for which we are responsible, we normally respond within one month. Where legally permitted because of complexity or the number of requests, this may be extended by two further months; we explain the extension within the first month. We may request proportionate information to verify identity. Requests are normally free of charge, subject to the exceptions in the GDPR.

15. Automated processing

Order totals, fees, available time slots and eligibility under the Restaurant’s configured requirements can be calculated automatically. A Restaurant may use automatic order acceptance or choose to review requests manually.

These functions support ordering and scheduling; youRest does not use them for solely automated decisions producing legal or similarly significant effects within Article 22 of the GDPR. Payment providers may conduct their own automated fraud checks; their notices explain the relevant processing and available rights. Contact us if you need help identifying the provider involved.

16. Children

The ordering service is not specifically directed at children. Please do not include children’s personal information in order notes. If you believe a child’s data has been collected unnecessarily, contact us so that we can investigate and take appropriate action with the Restaurant.

17. Complaints

You may complain to the Irish Data Protection Commission at https://www.dataprotection.ie, or the competent supervisory authority in the EU or EEA country where you live or work, or where the alleged infringement occurred.

You may contact us first if you would like us to address a concern, but doing so is not a condition of making a complaint.

18. Changes and contact

We may update this Policy when our services, processing arrangements or legal obligations change. The published version shows its effective date. Material changes will be communicated appropriately, and fresh consent obtained where required.

For privacy enquiries, contact nataliaki@nataliaki.eu, or write to the operator at the address above.