This is a translation for convenience. If it differs from the Romanian version, the Romanian version prevails.
1. Introduction
Protecting personal data matters to QBar.
This Privacy Policy explains how personal data is collected, used, stored and protected on the website www.qbar.ro and in the associated software services.
Data is processed in accordance with Regulation (EU) 2016/679 (GDPR) and the applicable law in Romania.
2. Identity of the controller
The QBar platform is operated by:
MLB DIGITAL COMMERCE SRL
- Tax ID (CUI): 50914870
- Trade Register no.: J2024042745004
- Registered office: Calea Moșilor nr. 88, Sector 3, Bucharest, Romania
- Email: hello@qbar.ro
- Website: https://www.qbar.ro
For data protection requests, you can contact us at hello@qbar.ro.
3. Roles in data processing
Depending on the nature of the operation, QBar may act in two legal capacities.
Data controller
MLB DIGITAL COMMERCE SRL acts as an independent controller for information processed for its own purposes, such as:
- Contact and demo requests;
- Managing commercial relationships;
- Invoicing and contract records;
- Security of its own services;
- Commercial communications carried out according to the law.
Data processor
When a HoReCa venue uses QBar to manage orders, tables and staff, the controller of that data is, as a rule, the company that runs the venue.
QBar processes this data on behalf of the controller, under documented instructions and the data processing agreement (DPA).
4. Categories of data collected
Depending on the services used, we may process the following categories of information:
Identification and contact data
First and last name, email address, phone number, job title and details about the company represented.
Account data
User identifiers, credentials protected by authentication mechanisms, roles, access rights and information about the organisation and the locations managed.
Commercial and contractual data
The subscription plan, the history of subscription payments, billing information and communications about the contracted services.
Service usage data
Location, table and session identifiers, orders, ordered products, requests to staff, order status and operational events.
Technical data
IP addresses, session identifiers, browser type, device information, authentication events, technical errors and logs needed for the security and operation of the platform.
The data collected depends on the features accessed. End customers do not usually need to create a QBar account to view a venue’s menu.
We do not ask for sensitive personal data that is not needed to use the service.
5. Purposes and legal bases
We process personal data for the following purposes and on the corresponding legal bases:
Providing the services and managing contracts
To create and manage accounts, give access to features, manage subscriptions and fulfil contractual obligations. The basis may be the performance of a contract or taking steps before a contract, under Article 6(1)(b) GDPR, where the data subject is a party to the contract.
For the data of representatives and employees of B2B customers, the basis may be the legitimate interest in managing the commercial relationship, under Article 6(1)(f) GDPR.
Legal obligations
To issue and keep tax documents, keep accounting records and meet other obligations imposed by law, under Article 6(1)(c) GDPR.
Security and abuse prevention
To protect accounts, identify attempts at unauthorised access, diagnose incidents and maintain the security of the platform, based on legitimate interest where applicable.
Commercial communications
To send promotional information only under the conditions allowed by applicable law, including obtaining consent where it is required.
Data subjects can unsubscribe from promotional communications through the means indicated in those messages or by contacting us.
6. Data processed through the QR menu
When a venue’s digital menu is opened, the platform may process technical data and temporary identifiers needed for the service to work.
When an order is placed, the selected products, the order value, the table identifier, its status and related requests may be recorded.
This data is used to transmit and manage orders by the HoReCa venue.
The restaurant or hotel decides the commercial purposes of the processing and, as controller, is responsible for informing its customers properly.
For requests about an order or about a venue’s services, the customer can contact the operator of that venue directly.
7. Payment processing
When online payments are activated, certain data is processed through Stripe or other authorised payment service providers.
Full card details are entered in the processor’s secure interfaces, according to the integration mechanism used.
QBar may process transaction identifiers, the payment amount, its status and other information needed to confirm or reconcile operations.
Processing by the payment processor is subject to its own terms and data protection notices.
8. Recipients of data
Personal data may be accessible, to the extent necessary, to the following categories of recipients:
- Cloud infrastructure and hosting providers, including Cloudflare;
- Google (the reCAPTCHA service), to protect the forms on the site against automated messages;
- Authentication and communications service providers;
- Payment processors, when the feature is activated;
- Technical support and monitoring providers;
- Consultants and professional service providers bound by confidentiality;
- Public authorities, in situations provided by law.
We do not sell users’ personal data.
Access to data is limited according to the purpose of the processing and the applicable contractual obligations.
9. International transfers
Data may be processed through infrastructure and services that involve access to or transfer of information outside the European Economic Area.
When such transfers fall under Chapter V of the GDPR, they must be carried out on an applicable legal mechanism, such as an adequacy decision or appropriate safeguards, including standard contractual clauses, as the case may be.
More information about the relevant recipients and the applicable safeguards can be requested at hello@qbar.ro.
10. Retention periods
Personal data is kept only as long as necessary to fulfil the purposes for which it was collected.
The criteria used include:
- The duration of the contractual relationship and the need to provide the service;
- Legal retention periods for financial and accounting documents;
- The need to resolve requests and complaints;
- Limitation periods applicable to possible disputes;
- Documented retention periods for temporary sessions and technical logs.
After the contractual relationship ends, data is deleted, anonymised or returned under the contract and the DPA, except for information that must be kept under the law.
Backups may follow separate technical expiry and deletion cycles.
11. Cookies and similar technologies
The QBar website and application may use cookies or similar mechanisms needed for authentication, sessions, security and the features requested by the user.
Optional analytics or advertising technologies, if used, are subject to the information and consent obligations provided by law.
Detailed information about these technologies is in the Cookie Policy.
12. Data security
We apply appropriate technical and organisational measures to protect data against unauthorised access, alteration, loss or unauthorised disclosure.
These measures may include secure connections, role-based access control, authentication mechanisms, technical monitoring and incident management procedures.
The measures are assessed and adapted according to the risks associated with the processing.
13. Rights of data subjects
Under the GDPR, data subjects have:
- The right of access to personal data;
- The right to rectification of inaccurate data;
- The right to erasure, when the legal conditions are met;
- The right to restriction of processing;
- The right to data portability, in applicable cases;
- The right to object;
- The right to withdraw consent, where it is the basis of the processing;
- The rights relating to automated individual decisions, when applicable.
Requests are sent to hello@qbar.ro.
We may ask for additional information needed to confirm the requester’s identity.
We usually reply within one month of receiving the request. This period may be extended under the conditions of the GDPR, with the data subject being informed.
14. The right to lodge a complaint
If you believe personal data is being processed in breach of the law, you have the right to lodge a complaint with:
The National Supervisory Authority for Personal Data Processing (ANSPDCP)
Website: https://www.dataprotection.ro
You also have the right to use the remedies provided by law.
15. Changes to the policy
This policy may be updated to reflect changes in the services, the technologies used or applicable law.
The updated version will be published on the website, stating the date of the last change.
For questions about the processing of personal data, you can contact us at hello@qbar.ro.