Privacy policy

Last updated: 22 September 2026

This English translation is provided for convenience; in the event of any discrepancy, the French version prevails.

This page explains, in plain words, what happens to your data when you use the restaurant-brasa.fr website or the Brasa app. In two sentences: we only collect what we need to serve you (booking, ordering, playing, keeping you informed), and we never sell or rent anything to anyone. There is no advertising, no audience measurement and no tracking.

Who is responsible for your data?

What data, and what for?

• Your account — first name, surname, email address, phone number and, if you provide them, address, postcode and town. Your password is stored encrypted: we cannot read it. Purpose: identifying you, pre-filling your bookings and orders, and reaching you if needed.
• Your bookings — surname, first name, email, phone, date, time, number of guests, preferred seating and any message (allergies, occasion, etc.). Purpose: keeping the bookings diary and getting back to you.
• Your orders (when online ordering is open) — contents, amount, collection time and contact details. Payment is handled by our payment provider: we never see or store your card number.
• Notifications — if you accept them: a technical identifier for your device or browser (provided by Apple or by your browser), your preferences (news, events, Brasa Challenge) and whether a notification was opened. Purpose: sending you our announcements and knowing whether they are useful.
• The Brasa Challenge — see the dedicated section below.
• Your job applications — identity, contact details, CV, cover letter and form answers, with your explicit consent. Purpose: considering your application, nothing else.
• Your messages sent through the contact form, so that we can reply.

Your favourite pizzas and the contents of your basket stay on your device.

The Brasa Challenge: location and camera

• Your location is only used while the challenge screen is open, never in the background. It is sent to our server to work out your clue ("cold", "hot", etc.) and is not stored.
• The only exception: when you attempt to catch a Brasa, the location of that attempt is kept together with your first name, to determine the winner, settle ties between players and detect cheating.
• The camera is used solely to display the Brasa in augmented reality. The images stay on your phone: nothing is filmed, recorded or transmitted.
• If you win, we keep your first name, your code and its expiry date, and we use your email and phone number to hand over your pizza. Your first name may be shown to other players ("Léa found the last Brasa!").

The full rules of the game are in the Brasa Challenge rules.

On what basis?

• Carrying out your request: account, bookings, orders, handing over a prize.
• Your consent, which you can withdraw at any time: notifications, location and camera (in your phone or browser settings), job applications.
• Our legitimate interest: security of the service and fair play.
• Our legal obligations: keeping accounting records.

Who has access?

The restaurant team, strictly for the needs of the service. And the technical providers without which nothing would work, each for their own part:

• IONOS (hosting of the website, database and email — servers in the European Union);
• Apple (delivery of notifications to iPhones, Apple Maps tiles) and your browser's notification service (Google, Mozilla, Apple, etc.) for website notifications;
• our payment provider, when online ordering is open;
• display services that receive your IP address, as with any website you visit: OpenStreetMap (map tiles), and the jsDelivr, unpkg and Google content delivery networks (technical libraries for the challenge and the web app).

Some of these providers are based in the United States; such transfers are then governed by the mechanisms provided for by the GDPR (adequacy decision or standard contractual clauses). No data is sold, rented or passed on for commercial purposes.

For how long?

• Account: for as long as you use it; deleted on request, or after 3 years of inactivity.
• Bookings: 1 year after the date of the meal.
• Orders and invoices: 10 years (accounting obligation).
• Job applications: at most 2 years after our last exchange, unless you ask for deletion.
• Brasa Challenge (attempts, prizes): 1 year.
• Notification identifier: until you turn off notifications, sign out or uninstall the app.

Cookies and local storage

There is no cookie banner, because there is nothing to accept: the website uses no advertising or audience measurement cookies. Only strictly technical items exist: a cookie that remembers you have already seen the welcome animation, and your browser's local storage to keep you signed in and to remember your basket and preferences.

Your rights

At any time you can access your data, correct it, have it erased, request a copy, restrict or object to a processing operation, and withdraw consent. The simplest ways:

• edit your details under Profile;
• delete your account yourself, immediately, in the app: Profile → Settings → "Delete my account";
• or write to us at info@restaurant-brasa.fr: we reply within one month.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr.

Minors

Creating an account is reserved for people aged 15 and over; below that age, a parent's consent is required.

Changes to this page

If our practices change, this page changes with them, and the date at the top is updated.