Privacy policy — English summary
SimplyRestau website and solution
This page is not the privacy policy. It is an unofficial, informational summary provided as a courtesy to English-speaking readers. The only authoritative text is the French document Politique de confidentialité (version 2026.07.1). In the event of any discrepancy, omission or ambiguity, the French version prevails. Rights under the GDPR are exercised against the French text, not against this summary.
What is changing in version 2026.08.1 (drafted, not yet in force)
A version 2026.08.1 of the French policy has been drafted and legally reviewed, but is not yet applicable. It only takes effect once SimplyRestau dates the French text and publishes it to the catalogue; until then, version 2026.07.1 above remains the sole current and authoritative version. In outline, once in force, it will add processing linked to Shop orders (items ordered, delivery address; printing and shipping partners among the recipients) and a new information box for guests who booked a table at a restaurant using SimplyRestau: their data is processed by the restaurant, as controller, with SimplyRestau acting on its behalf — their card, where the restaurant has switched on the anti-no-show guarantee, being registered directly with the restaurant's own payment provider, not with DevMeOn. The section on cookies will also describe the embedding of help videos in the management area through a privacy-enhanced player.
This is a thematic overview of the coming version, not a section-by-section summary. Once 2026.08.1 is in force, this English page will be updated to summarise it in full.
What this policy covers — and what it does not
This policy explains how DevMeOn processes personal data for its own purposes. It is information, not a request for blanket consent. Where SimplyRestau processes data on the documented instructions of a client restaurant, the roles and obligations are set out in the data processing annex instead (English summary · version française).
Processing carried out
| Purpose | Main data | Legal basis | Indicative retention |
|---|---|---|---|
| Creating and administering the account, providing the service and support | Identity, contact details, company, permissions, exchanges and settings | Performance of the contract or pre-contractual steps | Life of the account, then evidential archiving for up to 5 years |
| Managing subscriptions, payments and invoices | Billing identity, plan, due dates, Stripe identifiers; full card details stay with Stripe | Contract and accounting obligations | Contractual data: 5 years; accounting records: 10 years |
| Evidencing the accepted terms and conditions | User and company, document version and fingerprint, date, context, IP address and browser | Legitimate interest in establishing, exercising or defending rights | Life of the contract, then 5 years, longer in case of dispute |
| Securing and diagnosing the solution | Technical logs, IP address, browser, security events | Legitimate interest in securing the service | Normally 12 months; longer if needed to analyse an incident |
| Answering sales and contact requests | Identity, contact details, company and message content | Pre-contractual steps or legitimate interest | Handling time, then up to 3 years after the last contact |
| Sending the newsletter | Email address and record of the choice made | Consent, withdrawable at any time | Until withdrawal, or 3 years without interaction |
| Measuring audience and loading optional services | Online identifiers and browsing, according to the preferences you set | Consent where required | Per service, at most the duration announced in the cookie manager |
Fields marked as mandatory are necessary for the service requested; without them, account creation, subscription or handling of the request may be impossible.
Recipients and providers
Data is accessible to authorised DevMeOn staff and, to the extent necessary, to its hosting, payment (Stripe), email, support, translation, security monitoring and audience measurement providers, all bound by contract. DevMeOn does not sell personal data. Data may also be disclosed to authorities or advisers where the law requires it or to defend a right.
Transfers outside the EEA
Some international providers may process data outside the European Economic Area. DevMeOn then checks that an adequacy decision exists, or puts in place the European Commission’s standard contractual clauses together with any additional measures required. Details can be requested at the contact address.
Security
DevMeOn applies measures proportionate to the risks: permission management, encryption of communications, relevant logging, backups, patch management and incident response procedures. No system can guarantee zero risk, so any suspected compromise should be reported promptly.
Your rights
Depending on the processing, you may request access, rectification, erasure, restriction or portability, or object to processing based on legitimate interest. You may withdraw consent at any time, without affecting processing carried out beforehand. Send your request to contact@simplyrestau.fr, including what is needed to identify you; proof of identity is only requested in case of reasonable doubt. A reply is normally provided within one month. You may also lodge a complaint with the French data protection authority, the CNIL.
Cookies and optional services
Strictly necessary cookies handle authentication, security and technical preferences. Audience measurement and optional chat tools are only loaded after the corresponding choice where consent is required. That choice can be changed at any time from “Manage cookies” in the site footer.
Read the authoritative text
This summary does not reproduce the policy in full. The authoritative document is the French text: Politique de confidentialité (version 2026.07.1) — SHA-256 fingerprint 6f347cb8f234b02e8d792a741314aaf3b930e7e1400f5acdc0d908188c74572d, taken from the published document catalogue, so you can verify you are reading the accepted text. Questions in English are welcome at contact@simplyrestau.fr, but only the French text is authoritative.