Legal notice and privacy
https://fornata.eatsallover.page is the website of Fornata. This page explains who owns it, how the data of people who place an order is handled and what is stored on your device.
This restaurant has not completed its legal details yet. If you need information about the owner of the website or about your data, contact the restaurant directly.
Website owner
Details of the owner of this website, as required by Spanish Law 34/2002 on information society services and electronic commerce (LSSI):
- Owner: Fornata
The owner is also the controller of the personal data collected with orders.
What data is collected
When you place an order on this website, Fornata collects:
- What you order: dishes, options, amounts, the service (delivery, pickup or at the table) and the time slot.
- Your contact details: name, phone and, if you want, email.
- For delivery orders, the delivery address and its location on the map.
- The notes you add and the allergies you declare.
- If you pay online, the payment status and amount. Your card details go only to Stripe.
- If you order at the table, the rounds, the dishes and the table's allergies, with an anonymous id for each diner. No names are asked for at the table.
Your orders are grouped by your email or your phone so the restaurant can see your history. If you create an account (My account, with a link sent to your email), the addresses you choose are also kept and, if you ask, the allergies you want flagged on your next orders.
What it is used for
| What for | Legal basis |
|---|---|
| Preparing and delivering your order, and charging for it if you pay online | The contract for your order |
| Contacting you about your order, for example to confirm it or to tell you about a change | The contract for your order |
| Taking your allergies into account when preparing the order, and remembering them if you ask | Your explicit consent |
| Your account: seeing your orders, repeating them and saving addresses | Your request when you create it |
| Sending you news from the restaurant, only if you tick the box | Your consent, which you can withdraw in your account |
| Meeting the restaurant's legal obligations | Legal obligation |
If you give your email, you receive the order confirmation there.
Allergies
Allergies and intolerances are health data. They are collected only if you declare them and, by doing so, you give your explicit consent for them to be used for one purpose only: preparing your order safely.
The kitchen sees them on its screen and on printed tickets. They are removed from the order together with the rest of your personal data, 90 days later.
Who else handles your data
The website and its orders use these providers, which handle your data on behalf of Fornata and following its instructions:
- All Over Apps, which offers Eats All Over, the platform this website and its orders run on, processes the data as a processor. It stores your personal data encrypted, does not build marketing lists or profiles with it and does not write to you to advertise. Its servers are in the United States and the transfer is covered by the European Commission's Standard Contractual Clauses.
- Stripe, the restaurant's payment provider, receives your card details when you pay online. Stripe is also a controller of the payment data under its own privacy policy.
- Amazon Web Services (Amazon SES) sends the order emails, through All Over Apps.
- When you type an address, the Eats All Over server (not your browser) sends that text to Photon (komoot, Germany) to suggest addresses and to Nominatim (OpenStreetMap Foundation, United Kingdom) to place it on the map.
How long it is kept
Your personal data (name, phone, email, address, notes and allergies) is removed from the order 90 days after you place it. The dishes, the amounts, the city and the postal code are kept for the kitchen history and the restaurant's reports.
If you do not have an account, your customer data is deleted 90 days after your last order. If you have an account, it is kept for as long as you keep the account: you can delete it whenever you want in My account, and if it goes unused for 24 months it is deleted automatically.
Invoices or receipts issued by Fornata are kept for as long as the law requires.
Your rights
You can ask to access your data, correct it, delete it, restrict its use, object to its use or receive it in a portable format, and withdraw your consent for allergies or news at any time. If you have an account, you can change your details or delete the account yourself in My account.
To exercise them, contact Fornata directly.
If you believe your rights have not been respected, you can complain to the data protection authority, Agencia Española de Protección de Datos (aepd.es).
What is stored on your device
This website sets a cookie only if you sign in to your account: the session cookie (eats_customer), needed to keep you signed in for 90 days or until you sign out. It also keeps in your browser's storage, only on this device:
- Your cart.
- The service, location and address you choose.
- The name, phone and email from your last order, to fill in the next one.
- An anonymous diner id, so the phones at the same table share the tab.
- The payment method you choose at a table.
None of this is used to track you or show you ads. You can delete it at any time by clearing this site's data in your browser.
Visits may be measured with Cloudflare Web Analytics, which does not use cookies or identify people.
So the restaurant knows how many visits it gets, where they come from (a search engine, a social network or one of its QR codes) and which dishes people look at, the site counts each visit with a random number that only lasts while the tab is open. It does not keep your IP, your browser or anything that identifies you, and it uses no cookies.
Changes to this page
This page may change when the restaurant's details or the way your data is handled change. The current version is always the one you see here.