Privacy policy

Last updated on October 5, 2026

1. Who are we?

QEAT is a French société par actions simplifiée (simplified joint-stock company) with a share capital of 500 euros, registered under number 838 118 594 RCS Paris, whose registered office is located at 6 avenue Franklin D. Roosevelt, 75008 Paris, France, represented by its President (“QEAT” or “We”).

2. Purpose of this Privacy Policy

This document (the “Privacy Policy”) sets out the terms and conditions under which QEAT processes certain personal data relating to certain natural persons (the “Customers”) in connection with the services it offers within its range of offers, namely the “Analyses”, “Loyalty” and “AI” offers (the “Services”), which it provides to restaurant owners (the “Restaurant Owners” or “You”), as described in QEAT’s General Terms and Conditions of Sale (the “GTC”).
This Privacy Policy also describes which data relating to Restaurant Owners, as customers of QEAT, is collected and processed.
This Privacy Policy has been drafted in light of the applicable legal and regulatory provisions, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of personal data (hereinafter the “GDPR”) and the French Data Protection Act (Loi Informatique et Libertés) as amended to incorporate the provisions of the GDPR into French law.
This Privacy Policy supplements QEAT’s General Terms of Use (the “GTU”) and QEAT’s General Terms and Conditions of Sale (the “GTC”), which form the basis of the contractual relationship between You and Us. You must accept the terms of the GTU, the GTC and this Privacy Policy when subscribing to the Services.

3. What is QEAT’s role?

As part of the Services, QEAT is responsible for analysing certain information which may consist of personal data relating to Customers, in order to carry out a segmentation and/or send loyalty text messages (SMS).
QEAT’s role is therefore to provide Services that improve the relationship between a Restaurant Owner and its Customers. The aim is to enable the Restaurant Owner to anticipate the specific expectations of those Customers, classified according to certain positive categories (see section 5 below).
The data that You collect from your Customers and transmit to QEAT feeds our database and enables Us to carry out the processing provided for as part of the Services.
Ultimately, the result of the processing carried out by QEAT is intended exclusively to qualify a Restaurant Owner’s Customer database. As part of the “AI” offer, this result may also be made available to the Restaurant Owner through a connector enabling it to access it from the artificial intelligence agent of its choice (see section 13 below).
In addition, QEAT collects and processes certain personal data relating to Restaurant Owners, namely their surname, first name, e-mail address, restaurant name and bank details. This data is collected and processed exclusively for the purposes of the proper performance of the contract entered into in relation to the Services and of invoicing.

4. How does QEAT collect Customers’ personal data?

The provision of the Services necessarily requires information to be transmitted between Restaurant Owners and QEAT. Without this information, QEAT cannot fulfil the role assigned to it under the GTC.
This transmission may be carried out manually or automatically by the Restaurant Owner, who sends us a file containing the information QEAT needs to provide the Services (see section 5 below). The Restaurant Owner may also ask a third party, a service provider responsible for managing the restaurant’s reservations, to send this file to QEAT.
Likewise, certain information is provided to QEAT by gift voucher publishing partners.
QEAT itself does not collect any information relating to Customers: strictly speaking, only Restaurant Owners are responsible for such collection and for transmitting the information to QEAT for analysis.

5. What personal data does QEAT process?

In accordance with the GTC, and strictly for the purposes of providing the Services, You transmit to QEAT certain personal data relating to your Customers, which then enables QEAT to carry out its tasks.
This data is limited, as it consists of:
for the “Analyses” and “Loyalty” offers: the telephone number and the surname and first name used by a Guest to make the reservation at the restaurant, the date and time of the reservation, the name of the restaurant and the network to which the restaurant belongs (where applicable). No other personal data relating to Customers should be provided to QEAT;
for the “AI” offer: the above-mentioned data relating to reservations made at your restaurant(s) and, depending on the plan subscribed, the information resulting from their enrichment by QEAT, which is made available to You through the AI Connector (see section 13 below). In this context, QEAT also processes the technical data required for the operation of the AI Connector (credentials and access tokens, connection and query logs).
No other personal data relating to Customers should be provided to QEAT, which does not need it and does not wish to know it.
In particular, QEAT does not know Customers’ e-mail addresses. Nor does QEAT know any other information relating to Customers that may appear in your customer database.
QEAT therefore applies the data minimisation principle laid down by the GDPR, since only the personal data strictly necessary for the provision of the Services is transmitted to and then processed by QEAT.

6. How is the personal data collected used?

Customers’ personal data is processed by QEAT in order to draw up a categorical profile of them. On the basis of the data transmitted to us by all Restaurant Owners, QEAT is thus able to create a profile of each Guest according to various categories.
THE PROCESSING OF CUSTOMER DATA RESULTS EXCLUSIVELY IN THE DETERMINATION OF A GUEST CATEGORY.
As part of the “AI” offer, the data relating to the Restaurant Owner’s reservations and, depending on the plan subscribed, the categories and information derived from it are also made available to the Restaurant Owner, at its request, through the AI Connector, so that it can query them from its own artificial intelligence agent (see section 13 below).
The processing of Customers’ personal data does not and will never result in automated decision-making by QEAT. Furthermore, QEAT will never contact any Guest, whether on your behalf or on ours, for commercial prospecting or any other purpose.
Restaurant Owners’ personal data is collected and processed by QEAT exclusively for the purposes of the administrative and accounting management of the contracts entered into in relation to the Services.

7. On what legal basis does QEAT process personal data?

QEAT does not carry out any unlawful collection or processing of personal data.
The personal data We process relating to Customers is exclusively the data You have transmitted to Us, solely on the basis of the contract entered into between Us and You, namely the GTC, in order to provide You with the Services, pursuant to your legitimate interest in having information about your Customers (Article 6(1)(f) GDPR).
The personal data We process relating to Restaurant Owners is processed on the basis of the contract entered into between Us and You, in accordance with Article 6(1)(b) GDPR.

8. To whom is the data processed by QEAT disclosed?

The personal data relating to Customers that We process, in accordance with the GTC and this Privacy Policy, is intended for Us and Us alone, solely for the purpose of providing the Services You have ordered from Us. As part of the “AI” offer, it is also made available to the Restaurant Owner itself and to the artificial intelligence agent it has chosen, under the conditions described in section 13 below.
Data processing is fully automated: no human intervention is required on QEAT’s side.
This data is not transmitted to any third party whatsoever, in particular to any commercial partner of QEAT, with the exception of certain technical service providers duly selected by QEAT, which are responsible for hosting our database and for maintaining it, as well as the service provider responsible for sending SMS campaigns and the service provider responsible for producing statistics. In all cases, QEAT has entered into a written contract with each of these service providers containing strict confidentiality and security obligations at least equivalent to those set out in this Privacy Policy. The publisher of the artificial intelligence agent chosen by the Restaurant Owner is not a service provider of QEAT: it acts on the instructions and under the sole responsibility of the Restaurant Owner (see section 13 below).
In any event, no third party whatsoever has the right to access the data for the purpose of contacting Customers or carrying out any unauthorised processing of the data concerning them.

9. How long is personal data retained?

It should be borne in mind that the data processed by QEAT is not directly identifiable by us, since QEAT never knows the Customers.
This data is retained by QEAT for a fixed period of 12 (twelve) rolling months from the last known reservation at a QEAT partner restaurant. At the end of this period, and in the absence of any update, the data will be permanently deleted from our database.
Data duplicated for the purpose of making it available through the AI Connector is retained for the duration of the Restaurant Owner’s subscription to the “AI” offer and is deleted from QEAT’s servers upon its expiry. AI Connector connection and query logs are retained for 12 (twelve) months.
Certain data will only reappear in our database if the Guest concerned makes a new reservation at one of QEAT’s partner restaurants. In that case, however, the reservation history will have been lost, which the Restaurant Owner acknowledges and accepts.
In any event, data is automatically purged after 24 (twenty-four) months without a new reservation.

10. QEAT respects the choices of data subjects

QEAT respects the rights granted to natural persons, and therefore to Customers, under the GDPR and the French Data Protection Act.
In particular, under these texts, as interpreted in light of the recommendations of the Article 29 Working Party, every data subject must be informed of the existence of processing of their personal data resulting in profiling, i.e. the evaluation of certain personal aspects of the Customers.
IT IS THEREFORE YOUR RESPONSIBILITY, AT THE TIME THE DATA IS COLLECTED, TO INFORM CUSTOMERS OF THE SEGMENTATION CARRIED OUT ON THE BASIS OF THE DATA USED. YOU MUST ALSO INFORM CUSTOMERS OF THE UNDERLYING LOGIC AND OF ITS CONSEQUENCES.
In accordance with the GTC, QEAT cannot be held liable in this respect, as the Restaurant Owner is solely responsible for informing Customers.
In addition, the GDPR and the French Data Protection Act provide for enhanced rights with regard to profiling. As this is profiling for analysis or evaluation purposes only, with no prospecting purpose and no decision-making (automated or otherwise), Customers have a right to erasure and a right to object.
You must therefore give your Customers the possibility of requesting the deletion of the personal data concerning them, as well as of objecting to the processing of their personal data for profiling purposes. In this respect, the Restaurant Owner is required to inform QEAT if a Guest objects to receiving commercial prospecting text messages (“opt-out”).
In all cases, QEAT will act on requests to exercise Customers’ rights as soon as it becomes aware of them. After verifying the identity of the person making the request, You must therefore forward the request (together with proof of identity) to QEAT by e-mail to privacy@qeat.io. QEAT will take the necessary measures as soon as possible.
You are aware that if the right to erasure or the right to object is exercised, QEAT will no longer be able to provide the Services in relation to the Guest concerned, for which QEAT cannot be held liable.
Where data has been transmitted to an artificial intelligence agent through the AI Connector, QEAT is not able to pass on requests for erasure, rectification or objection to the publisher of that agent. It is Your responsibility to deal with such requests directly with that publisher.
With regard to personal data relating to Restaurant Owners, the same rights as above may be exercised (in particular the right to object). In the event of objection, QEAT will no longer be able to provide the Services and the GTC will be terminated automatically.

11. How is data subjects’ personal data protected?

QEAT undertakes to implement and maintain, at its own expense, appropriate technical and organisational measures for the processing and security of the personal data of Customers and Restaurant Owners, having regard to the nature of the data processed and the risks involved.
The measures put in place are thus adapted to the specific risks presented by its processing activities, in order to protect Customers’ personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
With regard to the technical measures put in place by QEAT:
all personal data is stored on servers located in France, hosted by OVH;
a logging and monitoring system enables Us to detect any suspicious activity in real time; all access attempts are recorded and saved in the logs;
we carry out regular security tests to ensure that the system is not vulnerable to this type of attack;
with regard to the AI Connector, access is subject to authentication by credentials or tokens specific to each Restaurant Owner, which can be revoked at any time; each Restaurant Owner only has access to the data relating to its own restaurant(s); queries are logged and their volume may be limited.
With regard to organisational measures:
only QEAT’s executives may have access to data subjects’ personal data, under the conditions set out in this Privacy Policy;
the servers used are controlled by security groups.
QEAT also undertakes to keep, update and retain complete and accurate records of the personal data processing carried out as part of the Services. These records detail its processing activities.

12. Are international data transfers carried out?

No, as regards the processing carried out by QEAT: Customers’ personal data is stored on servers located in France.
However, when the Restaurant Owner connects its artificial intelligence agent through the AI Connector, the data it transmits to it may be processed by the publisher of that agent outside the European Union, in particular in the United States. Such processing is the sole responsibility of the Restaurant Owner, who must ensure that appropriate safeguards within the meaning of the GDPR are in place (see section 13 below).

13. Connection to an artificial intelligence agent

As part of the “AI” offer, QEAT enables the Restaurant Owner to connect the artificial intelligence agent of its choice, among the compatible agents listed in the GTC (the “AI Agent”), to QEAT’s database by means of a connector (the “AI Connector”), in order to access from that AI Agent the data relating to its reservations and, depending on the plan subscribed, the information resulting from their enrichment by QEAT.
Activating the AI Connector constitutes an instruction from the Restaurant Owner, within the meaning of Article 28 of the GDPR, to make this data available to the AI Agent it has designated. In this respect, QEAT acts as processor on behalf of the Restaurant Owner and merely makes the data available from its servers, under the security conditions described in section 11 above.
From the moment it is transmitted to the AI Agent, the data is processed by the publisher of that AI Agent under the contractual terms agreed directly between the Restaurant Owner and that publisher. That publisher is not a subcontractor of QEAT. QEAT has no control over the processing it carries out, in particular as regards where the data is hosted, how long it is retained, its security or its possible reuse to train artificial intelligence models.
IT IS THEREFORE THE RESTAURANT OWNER’S RESPONSIBILITY, BEFORE ANY ACTIVATION OF THE AI CONNECTOR, TO ENSURE THAT THE AI AGENT IT USES COMPLIES WITH THE GDPR AND THE FRENCH DATA PROTECTION ACT, TO ENTER INTO ANY AGREEMENT WITH ITS PUBLISHER REQUIRED BY THESE TEXTS, TO DEACTIVATE ANY OPTION ALLOWING THE DATA TO BE REUSED FOR TRAINING PURPOSES, AND TO INFORM ITS CUSTOMERS OF THIS PROCESSING, FOR EXAMPLE USING THE MODEL CLAUSE SET OUT IN THE ANNEX TO THE GTC.
In accordance with the GTC, QEAT cannot be held liable for processing carried out by the AI Agent or its publisher, nor for any data breach occurring after the data has been transmitted to the AI Agent.

14. Notification of personal data breaches

In the event of any personal data breach whatsoever, QEAT shall, without delay and no later than 24 (twenty-four) hours after becoming aware of such breach, inform the Restaurant Owners and provide them with sufficient details of the nature of the breach to enable them to comply with their obligations under the applicable texts.
This obligation covers breaches affecting QEAT’s systems, excluding breaches occurring after the data has been transmitted to the Restaurant Owner’s AI Agent, which are the sole responsibility of the Restaurant Owner and of the publisher of the AI Agent.

15. Updates to this Privacy Policy

This Privacy Policy may be amended from time to time. Any amendment will be implemented after You have been informed of it. In that case, the “Last updated” date mentioned above will be changed. The new version of the Privacy Policy will come into force from that date.