Privacy & data protection

1. Who is responsible for your data

thai & maki is the data controller for guest data collected through reservations and orders made on this website. We decide what data is collected and what it is used for.

The booking and ordering platform that hosts this website (the database and API at restaurant.digitallisbon.pt) is operated by Krishna Bahadur Thapa as a processor on our behalf. You can read the platform-level privacy notice here: https://restaurant.digitallisbon.pt/privacy.

To exercise any of your rights or to ask a question about how we handle your data, contact us using the phone or email shown in the footer of this website, or write to the platform operator at [email protected].

2. What personal data we process

• Reservations: name, email, phone, party size, date and time, table assignment where applicable, notes or special requests, status updates, and linked account data if you book while logged in.
• Orders: name, contact details, collection / delivery information, ordered items, and payment references. Card payments are processed directly by our payment provider (Stripe); we do not store full card numbers.
• Accounts: name, email, hashed authentication credentials, and activity needed to operate the account.
• Consent records: a timestamped record of your consent to this notice, plus technical context recorded at the moment you submit a form (browser user-agent, browser language, time zone, screen size, page URL, and your IP address). These records exist only as evidence that you actively gave consent and are not used for any other purpose.
• Technical logs: IP address, timestamps and similar metadata are kept in server or security logs for a limited time to operate and protect the service.
• Analytics: if you accept analytics cookies, anonymous usage events (e.g. pages viewed, menu searches) help us improve the site. Please avoid entering personal data in free-text search fields.

3. Purposes and legal bases

• Contract / pre-contract steps — to take and manage the reservations and orders you request.
• Legitimate interests — to secure the platform, prevent abuse, and improve the service, in balance with your rights.
• Consent — given by ticking the consent box on our forms (booking, checkout, registration) and by accepting cookies. You may withdraw consent at any time.
• Legal obligation — where we must keep or disclose information to comply with the law (e.g. Portuguese accounting and tax rules).

We use your data only for the purposes above. We do not sell your data, do not share it with third parties for advertising, and do not use it for profiling.

4. How long we keep it

We keep personal data only for as long as needed for the purposes above, including any period required by law. Reservation and order records linked to invoices may be kept for up to 10 years to meet Portuguese accounting / tax obligations. Account and contact data is kept while your account is active, or until you ask us to delete it. After the retention period, data is deleted or anonymised.

5. Recipients and international transfers

We use service providers who process data on our instructions: hosting and database (the digitallisbon platform), email delivery, payment processing (Stripe), and optionally web analytics (Google Analytics, only if you accept analytics cookies). Where a provider is outside the European Economic Area, the appropriate safeguards required by GDPR (typically the European Commission’s Standard Contractual Clauses) apply.

Restaurant staff and owners may access guest data relating only to their own venue, strictly in order to fulfil bookings and orders.

6. Your rights

Under GDPR you have the right to access, rectification, erasure, restriction, objection, and data portability, and to withdraw consent at any time. To exercise any of these rights contact us using the details in section 1.

You also have the right to lodge a complaint with the supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD).

7. Cookies and similar technologies

When you first open this site you are asked to choose between “Accept all” and “Essential only”:

• Strictly necessary cookies — needed for the site to work (e.g. authentication session, language preference, shopping cart, and the cookie-choice cookie itself). These cannot be disabled.
• Analytics cookies — Google Analytics with IP anonymisation, loaded only if you choose “Accept all”. Used to count visits and measure traffic patterns. We do not use advertising or cross-site tracking cookies.

You can change your choice at any time using the Cookie preferences link in the footer.

8. Automated decisions

We do not use solely automated decision-making, including profiling, that produces legal or similarly significant effects concerning you.

9. Updates to this notice

We may update this notice from time to time. The current version is always the one published on this page; the “Last updated” date at the top reflects the most recent change.