GDPR & privacy — overview

Restora 360 supports the seven GDPR rights for customer data inside your restaurant:

1. Right to be informed — your privacy policy must disclose Restora 360 as a sub-processor (template provided).
2. Right of access — export a customer's full data via Customers → [name] → Export.
3. Right to rectification — edit any field on the customer record.
4. Right to erasure — Customers → [name] → Delete. The record is anonymised; order history is retained for tax purposes but customer PII is stripped.
5. Right to restrict processing — toggle the marketing-consent flag off; no further marketing emails.
6. Right to data portability — the customer-data export is machine-readable JSON + CSV.
7. Right to object — opt-out links in every marketing email.

You (the restaurant) are the data controller for your customers. Restora 360 is your data processor. A Data Processing Agreement (DPA) is available on request — email legal@restora360.com. The DPA is also included automatically in Enterprise contracts.

• Active orders — retained indefinitely while you're a customer
• Customer accounts — retained while account is active; deleted 30 days after the customer requests deletion
• Audit logs — 1 year (longer on Enterprise)
• Backups — 30-day rolling
• Payment data — Stripe's retention policy applies (typically 7 years for tax/AML)

Restora 360 storefronts set only strictly necessary cookies by default (session, cart). If you enable Google Analytics or Meta Pixel under Settings → SEO, those tools require an explicit consent banner — Restora 360 ships one (Settings → Cookies → Enable banner).