INOVA Francesinha — Mobile Application

Privacy Policy

Inevitável e Primordial, Lda. · Corporate taxpayer no. 513 490 426
Av. do Brasil, 54, 4480-659 Vila do Conde, Portugal
Document version: 2026-08-09.1

Ler este documento em português

1. Data controller and contact details

The data controller is Inevitável e Primordial, Lda., corporate taxpayer no. 513 490 426, with registered office at Av. do Brasil, 54, 4480-659 Vila do Conde, Portugal (the “Controller” or “INOVA”).

To exercise your rights or raise any data-protection query, you may contact us at inevitaveleprimordial.lda@outlook.com.

INOVA has not appointed a Data Protection Officer, as it is not required to do so under Article 37 of the GDPR; the address above is the contact point for all data-protection matters.

2. Legal framework

The processing of personal data is governed by Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), by Portuguese Law no. 58/2019 of 8 August, and by Portuguese Law no. 41/2004 of 18 August, as amended, as regards electronic communications and direct marketing.

3. Categories of data, purposes and legal bases

INOVA processes only the data that the user provides directly. The application does not collect data in the background and performs no hidden collection. The categories of data, the purposes and the legal bases under Article 6 of the GDPR are as follows.

• Account creation and management — Name, e-mail, mobile number, password (encrypted).
• Legal basis: performance of a contract — 1(b).

• Authentication and account security — E-mail and password; session credentials.
• Legal basis: performance of a contract — 1(b); legitimate interest in security — 1(f).

• Order processing (takeaway/delivery) — Name, billing and delivery address, e-mail, mobile number, items ordered, delivery/collection type.
• Legal basis: performance of a contract — 1(b).

• Billing and payment — Transaction identifier (card/MB WAY data is entered directly into Stripe and not stored by INOVA).
• Legal basis: performance of a contract — 1(b); legal (tax) obligation — 1(c).

• Table reservations — Name, e-mail, mobile number, restaurant, date, time, number of guests, notes.
• Legal basis: performance of a contract / pre-contractual steps — 1(b).

• Loyalty programme (points and vouchers) — Order and reservation history, points balance, vouchers.
• Legal basis: performance of a contract — 1(b).

• Transactional notifications (order/reservation status) — Mobile number, order/reservation data.
• Legal basis: performance of a contract — 1(b).

• Marketing communications — E-mail and/or mobile number.
• Legal basis: consent — 1(a).

• Proof of consent and compliance — Consent status, document version, date and time.
• Legal basis: legal obligation — 1(c); legitimate interest — 1(f).

• Application diagnostics and error correction — Technical error data (device model, version, stack trace), without personal data.
• Legal basis: legitimate interest in stability and security — 1(f).

Note: the password is transmitted to the server and there processed and encrypted; it is not stored by the application. Session credentials are kept in the secure vault of the operating system (Keychain on iOS, Keystore on Android).

4. Recipients and processors

For the purposes above, INOVA relies on service providers acting as processors, bound by contract under Article 28 of the GDPR and required to process data only on INOVA’s instructions:

• Google Cloud (Google LLC / Google Ireland) — Hosting of the backend and API. USA (us-central1, Iowa). Safeguard: SCCs + EU-US Data Privacy Framework.

• WordPress / WooCommerce — Order and catalogue engine (in the backend). In the backend (USA). Safeguard: covered by Google Cloud hosting.

• Stripe — Payment processing (card and MB WAY). EU/USA. Safeguard: SCCs + EU-US Data Privacy Framework.

• Sentry — Error/crash reports (technical data only). USA. Safeguard: SCCs.

• Twilio / WhatsApp — Transactional notifications. USA. Safeguard: SCCs + EU-US Data Privacy Framework.

• Meta and Google Ads — Advertising audiences (hashed e-mail/mobile). USA. Safeguard: SCCs + DPF — only with consent (planned feature).

Data may also be disclosed to public authorities where required by law or court order. INOVA does not sell personal data to third parties.

5. International data transfers

The application backend is hosted in the United States (Google Cloud, us-central1, Iowa) and the processors Stripe, Sentry and Twilio/WhatsApp likewise process data in the USA. Personal data is therefore transferred outside the European Economic Area.

These transfers rely on the following appropriate safeguards under Chapter V of the GDPR: (i) the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914, entered into with the processors; and, cumulatively where applicable, (ii) the providers’ certification under the EU-US Data Privacy Framework, subject to the European Commission adequacy decision of 10 July 2023.

INOVA adopts the Standard Contractual Clauses as a principal and standalone safeguard, so as to ensure continued protection even in the event of a change to the status of the Data Privacy Framework. Users may request information on the applicable safeguards and obtain a copy of the instruments via the contact in section 1.

6. Retention periods

Data is retained only for as long as necessary for the purposes for which it was collected, unless a longer statutory retention period applies. Specifically:

• Account data: for as long as the account is active; after account deletion, it is erased or anonymised within 30 days at most, without prejudice to the points below.

• Billing and transaction data: 10 years, as required by tax law (Article 123 of the Corporate Income Tax Code and VAT legislation).

• Reservation data: up to 12 months after the reservation date, for management and evidence.

• Proof of consent: during the relationship and for up to 5 years after its termination or withdrawal, to demonstrate compliance.

• Technical diagnostic data (Sentry): up to 90 days.

7. Data security

INOVA applies appropriate technical and organisational measures, in particular: communication encrypted exclusively via HTTPS/TLS between the application and the server, with unencrypted traffic blocked in production versions; storage of session credentials in the secure vault of the operating system; absence of personal data in production logs; and direct routing of payment data to Stripe, so that it never reaches INOVA’s servers.

8. Device permissions and absence of tracking

The application requests no sensitive device permissions and does not access location (GPS), camera, microphone, contacts, photographs or calendar. It does not collect the advertising identifier and performs no cross-app tracking. As of this date, no usage-analytics or tracking SDK is installed in the application.

9. Data subject rights

Under Articles 15 to 22 of the GDPR, users have the right to request access to their data, its rectification, erasure, restriction of processing, portability and, where applicable, to object to processing. Where processing is based on consent, that consent may be withdrawn at any time, without affecting the lawfulness of processing carried out beforehand.

Several of these rights may be exercised directly in the application: data export on the “My Data” screen, account deletion (with anonymisation/erasure in the backend), withdrawal of marketing consent in Marketing Preferences, and rectification and password change in the account. Alternatively, users may address their request to the contact in section 1, and a reply will be provided within one month, extendable under Article 12(3) of the GDPR.

Users also have the right to lodge a complaint with the supervisory authority, the Portuguese Data Protection Authority (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon (www.cnpd.pt).

10. Marketing and consent

Marketing communications are sent only with prior, free, specific and informed consent, obtained at registration through an unticked box. Consent may be withdrawn at any time in the account’s Marketing Preferences or via the opt-out mechanism included in each communication. Every change of consent is recorded with the document version and the relevant date and time.

Any sharing of hashed e-mail and mobile number with Meta and Google to build advertising audiences depends on specific consent and is a planned feature, not active as of this version.

11. Minors

The application is not intended for persons under 16 and INOVA does not knowingly collect data from minors of that age. If it emerges that a minor’s data has been collected without the required consent, it will be deleted as soon as the situation is detected.

12. Changes to this policy

INOVA may update this Privacy Policy. Changes are made available on the “Legal” screen of the application and published at the policy’s public URL. Material changes are communicated to users by appropriate means. The applicable version is identified by the date shown at the start of the document.