Legal information

Privacy policy

How we handle your data and how you can exercise your rights.

Last updated: 07/10/2026

On this page

The controller of personal data processed through TAVLO is:

Controller:Sonia Vidal Cortés
Tax ID:21691476S
Trading name:TAVLO
Email address:info@tavlo.es
Websites:tavlo.es and tavlo.menu

Personal data is processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD).

This Privacy Policy applies to personal data processed by TAVLO through its websites and platform, including:

  • owners, managers or contact persons of venues registering with or using TAVLO;
  • people contacting TAVLO through forms, email or other available channels;
  • users browsing tavlo.es or tavlo.menu;
  • users viewing venues' digital menus;
  • users accessing or interacting with the “Just for you” section and its offers;
  • customers purchasing products or services offered directly by TAVLO, such as QR sticker packs.

The data processed depends on how users interact with TAVLO.

3.1. Venue registration and management data

When creating and managing a venue account, we may process:

  • the contact person's first and last names;
  • email address;
  • telephone number;
  • password, stored using appropriate security mechanisms rather than in plain text;
  • venue name and type;
  • venue address;
  • tax ID, where provided;
  • preferences or goals indicated during registration;
  • venue profile information and settings;
  • links to social networks, review pages or other URLs the venue chooses to include;
  • images, logos, photographs and other content added to the venue's menu.

Certain venue data, such as trading name, images, menu, social networks or information configured for that purpose, may be publicly displayed as part of the digital menu.

3.2. Contact data

When someone contacts TAVLO, we may process:

  • name;
  • email address;
  • content of the enquiry or message;
  • any other information voluntarily provided in the communication.

3.3. Purchase and billing data

When products or services offered directly by TAVLO, such as QR stickers, are purchased, we may process:

  • first and last names;
  • email address;
  • telephone number;
  • venue name;
  • shipping and billing addresses;
  • tax ID and other tax information where necessary;
  • order, payment and billing information.

Payments are processed through Stripe. TAVLO does not store complete bank-card details used for payment.

3.4. Technical and browsing data

When our websites or platform are used, we may process technical data such as:

  • IP address;
  • browser and device type;
  • operating system;
  • pages or sections visited;
  • access date and time;
  • technical information related to service operation and security;
  • information obtained through cookies or similar technologies where applicable.

Use of cookies and similar technologies is explained specifically in our Cookie Policy.

TAVLO processes personal data for the following purposes:

4.1. Creating and managing the venue account

We use the necessary data to register the venue, create its account, provide dashboard access, enable creation and management of its digital menu, generate its QR code and provide TAVLO's related features.

Legal basis:performance of the contractual relationship or pre-contractual measures requested by the user (Article 6(1)(b) GDPR).

The service may be free of charge without preventing a contractual relationship governed by the Terms of Service accepted during registration.

4.2. Communications necessary to provide the service

We may send account or service-related communications, including confirmations, information needed to activate or use the service, incidents, relevant changes, security matters or communications related to service provision.

Legal basis:performance of the contractual relationship (Article 6(1)(b) GDPR) and, where applicable, TAVLO's legitimate interest in maintaining a secure and operational service (Article 6(1)(f) GDPR).

These communications are not commercial and may be sent even when users have not agreed to promotional messages.

4.3. Commercial communications and other optional emails

When users have given consent, TAVLO may send news, advice, information to help create or improve their menu, newsletters, offers, surveys and other optional TAVLO-related communications.

Legal basis:the data subject's consent (Article 6(1)(a) GDPR).

Consent is voluntary and may be withdrawn at any time without affecting ordinary use of TAVLO.

4.4. Handling enquiries

Data provided through the contact form, email or other channels will be used to respond to and manage the enquiry.

Legal basis:the data subject's consent when voluntarily sending an enquiry (Article 6(1)(a) GDPR), or pre-contractual measures where the enquiry concerns a potential purchase or use of the service (Article 6(1)(b) GDPR).

4.5. Managing orders, payments, shipping and invoicing

When users purchase a product or service directly from TAVLO, we process their data to handle the order, manage payment, prepare shipping, issue the corresponding invoice and meet the administrative and tax obligations arising from the transaction.

Legal basis:performance of the contract (Article 6(1)(b) GDPR) and compliance with legal obligations (Article 6(1)(c) GDPR).

4.6. Analytics and improving TAVLO

When users give the relevant consent through the cookie-management system, we may use tools such as Google Analyticsto obtain statistics about use of our websites and platform and improve their operation and user experience.

Legal basis:the data subject's consent (Article 6(1)(a) GDPR).

Rejecting analytics cookies does not prevent use of TAVLO's essential features.

4.7. Security and abuse prevention

We may process certain technical data to secure the platform, prevent fraudulent or abusive use, diagnose incidents and protect TAVLO's and users' systems and information.

Legal basis:TAVLO's legitimate interest in ensuring the security and integrity of its services (Article 6(1)(f) GDPR).

4.8. Compliance with legal obligations

We may retain or disclose information when necessary to comply with tax, accounting, administrative or other statutory obligations, or to respond to requests from competent authorities.

Legal basis:compliance with a legal obligation (Article 6(1)(c) GDPR).

TAVLO's digital menus include a section called “Just for you”, where users can view third-party benefits, promotions or offers.

TAVLO currently integrates this feature through Sovendus GmbH, a provider specialising in marketing services and offers.

Displaying this section may involve loading content or technical resources supplied by Sovendus.

When users choose to interact with certain offers, Sovendus may request consent to send a technical identifier to the relevant provider and receive confirmation if a conversion occurs, for measurement and attribution purposes.

Where Sovendus allows access to an offer without such measurement, users may use the alternative provided by Sovendus.

Personal information subsequently provided directly to an advertiser or provider to purchase a product, request information, register or take another action is subject to that third party's privacy policy and terms.

TAVLO does not control data processing performed directly by those third parties after users access their websites or services.

TAVLO may attribute certain commissions to a venue from interactions or conversions generated through its menu, in accordance with the applicable service terms.

Where no amounts are payable, TAVLO does not necessarily request all information required to make such payments.

When a venue has commissions available to collect, TAVLO will contact it and may request additional information needed to verify the beneficiary, manage payment and comply with relevant tax, accounting or legal obligations.

When an external provider is enabled to manage these payments, the venue will receive the relevant information about processing of its data.

TAVLO uses technology providers that may access certain data only to the extent necessary to provide their services.

Providers that may currently be involved include:

  • Webempresa, for web hosting and infrastructure services;
  • Google Workspace, for email and work tools;
  • Resend, for automated TAVLO-related emails;
  • Google, through services such as Google Analytics and Google Search Console;
  • PostHog, to analyse platform usage, performance and errors with analytics consent.
  • Stripe, for payment processing and invoicing;
  • Sovendus GmbH, for integration and operation of the “Just for you” section and measurement of certain interactions or conversions where applicable.

Data may also be disclosed to public authorities, courts, law-enforcement agencies or other authorities where legally required.

TAVLO does not sell personal data to third parties.

Providers acting on TAVLO's behalf must process data under applicable terms and the safeguards required by data-protection law.

Some technology providers used by TAVLO belong to international groups or may provide certain services from countries outside the European Economic Area.

International transfers of personal data will use a mechanism recognised by the GDPR, such as a European Commission adequacy decision, standard contractual clauses or other legally valid safeguards.

Where applicable, data subjects may request further information about the safeguards used by writing to info@tavlo.es.

Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected.

In particular:

  • Account data:while the account remains active and afterwards for as long as necessary to manage closure and address possible liabilities.
  • Enquiries:for as long as necessary to respond and afterwards while liabilities may arise from the communication.
  • Commercial communications:until users withdraw consent or ask to stop receiving them.
  • Order, payment and billing data:for the periods required by tax, accounting and other applicable laws.
  • Analytics and cookie data:for the periods indicated in the Cookie Policy or until users withdraw consent where applicable.
  • Data needed to establish, exercise or defend claims:may be retained with appropriate restricted processing for the applicable statutory periods.

Once data is no longer necessary, it will be deleted or anonymised, subject to legally required retention periods.

Fields marked as required are necessary to provide the service or handle the relevant request.

Without this data, TAVLO may be unable to create an account, process an order or provide the requested feature.

Optional fields may be left blank without preventing access to features that do not depend on them.

Where applicable, data subjects may exercise the following rights:

  • Access:to know which personal data we process about them.
  • Rectification:to request correction of inaccurate or incomplete data.
  • Erasure:to request deletion of their data where legal requirements are met.
  • Objection:to object to certain processing based on legitimate interests.
  • Restriction:to request restricted processing in certain circumstances.
  • Portability:to receive their data in a structured, commonly used and machine-readable format where applicable.
  • Withdrawal of consent:to withdraw previously given consent at any time without affecting the lawfulness of earlier processing.

To exercise these rights, please write to:

info@tavlo.es

The request must identify the data subject adequately and specify the right they wish to exercise.

TAVLO may request additional information where necessary to reasonably verify the applicant's identity.

Where processing is based on consent, consent may be withdrawn at any time.

Withdrawal does not affect the lawfulness of processing performed before withdrawal.

For commercial communications, users may also use the unsubscribe mechanisms included in those communications where available.

If someone considers that TAVLO has not properly processed their personal data or handled their requests to exercise rights, they may complain to:

Spanish Data Protection Agency (AEPD)
www.aepd.es

TAVLO does not currently make decisions based solely on automated processing that produce legal effects or similarly significantly affect users.

TAVLO is intended for professionals and hospitality venues and is not specifically directed at children.

TAVLO does not knowingly seek to collect children's personal data through venue registration.

If a child's personal data is found to have been supplied without a legitimate basis for processing, appropriate steps may be taken to delete it.

TAVLO adopts technical and organisational measures to protect personal data against loss, alteration, unauthorised access, disclosure or processing, taking account of the nature of the data, state of the art and existing risks.

Measures include access controls, secure connections and safeguards to protect platform credentials and systems.

For security reasons, TAVLO does not publish full technical details of every measure implemented.

TAVLO uses cookies and similar technologies needed for certain features and, with user consent, analytics tools such as Google Analytics and PostHog.

Non-essential analytics cookies require user consent.

Detailed information about cookies, their purposes, providers, duration and mechanisms for accepting, rejecting or withdrawing consent is available in the Cookie Policy.

Venue menus may include links to social networks, review platforms, WhatsApp or other services configured by the venue.

The “Just for you” section may also direct users to third-party websites and services.

When users leave TAVLO and access an external service, processing performed directly by that third party is governed by its own terms and privacy policies.

TAVLO is not responsible for data processing independently performed by those third parties.

TAVLO may update this Privacy Policy to reflect changes to the platform, providers, processing activities or applicable law.

The current version will be available on our websites with its latest update date.

TAVLO may communicate changes relevant to registered users through the platform or email.

For any enquiries about this Privacy Policy or personal-data processing:

TAVLO
Controller: Sonia Vidal Cortés
Email: info@tavlo.es