This is a translation for convenience. If it differs from the Romanian version, the Romanian version prevails.
1. Our commitment
QBar respects the right to privacy and aims to protect the personal data processed through its services.
The platform works according to the principles of Regulation (EU) 2016/679 (GDPR), including lawfulness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
2. Who is responsible for the data?
MLB DIGITAL COMMERCE SRL operates the QBar platform and is an independent controller for personal data processed for its own purposes, such as managing commercial relationships, invoicing and the security of the service.
For data processed on behalf of restaurants, cafés, bars and hotels, the controller is, as a rule, the company that runs the venue.
In these situations, QBar acts as a processor, under Article 28 GDPR.
Specific responsibilities are set by the applicable contractual agreements and depend on the nature of each processing operation.
3. Data processing in the QBar platform
The platform may process information related to the following operations:
- Managing accounts and authorised users;
- Managing locations and staff;
- Placing and tracking orders;
- Managing tables and service sessions;
- Requests sent to waiters;
- Managing payments through specialised providers;
- Technical monitoring and security of the service.
Data is processed in accordance with the purposes and legal bases explained in the Privacy Policy and, where applicable, the instructions of the venue’s controller.
4. Rights of data subjects
Under the GDPR, you have the right to be informed, and rights of access, rectification, erasure, restriction, portability and objection, as well as the rights that apply to decisions based solely on automated processing.
If processing is based on consent, it can be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal.
The exercise of certain rights may be subject to the conditions and exceptions provided by law.
5. How to ask for access to or deletion of your data
To exercise your rights, send a message to:
hello@qbar.ro
Please state the type of request and the information needed to identify the processing concerned.
If the request concerns an order placed in a restaurant, it helps to name that venue. Data about the order is, as a rule, processed under the responsibility of the restaurant’s operator.
In these situations, we will assist the operator or direct the request in accordance with the applicable obligations.
For data for which QBar is the controller, requests are reviewed and resolved within the legal time limit.
6. Response times
We respond to requests about GDPR rights without undue delay, usually within one month at most.
In complex situations or when there are many requests, the period may be extended by a maximum of two further months, with the requester informed within the initial period.
Exercising the rights is usually free of charge, subject to the exceptions provided by the GDPR.
7. Data protection and security
QBar uses appropriate technical and organisational measures to protect personal data.
Depending on the risks and the architecture of the service, these include authentication mechanisms, role-based access control, secure communications and incident monitoring.
In case of an incident affecting personal data processed on behalf of a venue, QBar informs the controller without undue delay, in accordance with its legal and contractual obligations.
The controller assesses the obligations to notify the supervisory authority and the people affected.
8. The data processing agreement (DPA)
Business customers for whom QBar processes personal data as a processor must have a data processing agreement, under Article 28 GDPR.
This agreement sets out, among other things:
- The subject matter and duration of the processing;
- The nature and purposes of the operations;
- The categories of data and data subjects;
- The controller’s obligations and instructions;
- Confidentiality and security measures;
- The conditions for using sub-processors;
- Assistance with the exercise of rights and the handling of incidents;
- The conditions for returning or deleting data;
- Verification of compliance with contractual obligations.
This page is a public notice and does not replace the mandatory DPA between the relevant parties.
For information about concluding a DPA, contact hello@qbar.ro.
9. Providers and data transfers
QBar uses technical providers for hosting, running the platform and certain external services.
International data transfers, if any, must be carried out under the conditions set in Chapter V of the GDPR.
In processor relationships, the authorisation and conditions for using sub-processors are governed by the DPA.
10. Complaints and notifications
You have the right to lodge a complaint with the competent supervisory authority.
In Romania, this is:
The National Supervisory Authority for Personal Data Processing — ANSPDCP
Website: https://www.dataprotection.ro
You may also use the administrative or judicial remedies provided by law.
11. GDPR contact
MLB DIGITAL COMMERCE SRL
Tax ID (CUI): 50914870
Registered office: Calea Moșilor nr. 88, Sector 3, Bucharest, Romania
Email for GDPR requests: hello@qbar.ro
Website: https://www.qbar.ro