1. Purpose and scope of this Policy
Restaurant Booking & Distribution Services, S.L.U. (hereinafter, “CoverManager”) is committed to processing personal data lawfully, fairly and transparently. This Policy primarily explains how we process personal data when we act as data controller, in particular in connection with browsing our website, requests for information or a demo, direct marketing communications, our relationship with customers and their contact persons, and recruitment processes.
This Policy does not describe in detail the processing activities carried out by CoverManager on behalf of its customers when providing its technology services. In those cases, as a general rule, the relevant customer or establishment determines the purposes of the processing and acts as data controller, while CoverManager acts as data processor in accordance with the applicable Data Processing Agreement.
2. Who is the data controller?
| Data controller | Restaurant Booking & Distribution Services, S.L.U. |
| Tax Identification Number (NIF) | B90227976 |
| Registered office | Avenida de la Constitución 24, 4th floor, 41001 Seville, Spain |
| Website | www.covermanager.com |
| Data Protection Officer contact details | dpo@covermanager.com |
3. What processing activities do we carry out as data controller?
Below we describe the main processing activities for which CoverManager acts as data controller. Where certain information is required in order to handle a request or manage a relationship, it will be identified as mandatory in the relevant form or channel.
3.1. When you contact CoverManager or request a demo
| Sources / collection channels | Website forms, email, telephone or other corporate channels made available by CoverManager. |
| Personal data processed | Identification data (first name and surname) and contact details (telephone number, email address and address), professional data and information relating to the company or establishment, as well as any information you provide in your request. |
| Purpose | To respond to enquiries and requests for information. To manage demo requests. To follow up on commercial enquiries initiated by the data subject and, where appropriate, to take steps at the data subject’s request prior to entering into a contract. |
| Legal basis | Article 6(1)(b) GDPR where the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract. Where the request is made by a representative, contact person or professional acting on behalf of a company or establishment, the processing may be based on the legitimate interests of CoverManager and the relevant entity in managing the professional relationship, pursuant to Article 6(1)(f) GDPR and Article 19 of Spanish Organic Law 3/2018 (LOPDGDD). For enquiries that are not connected with a potential contractual relationship, the processing will be based on CoverManager’s legitimate interest in managing and responding to communications received. |
| Mandatory nature of the data | Mandatory fields will be identified in the relevant form. If the necessary information is not provided, we may be unable to handle your request or provide the requested service. |
| Retention | For as long as necessary to handle and follow up on the request and, in the case of prospective customers, for as long as there remains a reasonable expectation of a business relationship. Thereafter, the data may be retained in a restricted form for the applicable limitation periods in order to address potential legal liabilities. |
| Recipients | Service providers supplying support, CRM, communications, hosting or other services necessary to manage the request, acting as data processors where applicable. |
3.2. When you receive direct marketing communications from CoverManager
| Sources / collection channels | Subscription to direct marketing communications. Specific opt-in boxes in forms. Contact details obtained in the context of a prior contractual relationship with CoverManager. |
| Personal data processed | First name, surname, professional email address, telephone number where applicable, company or establishment, job title or professional role, marketing preferences and information relating to your interaction with our communications where the tool used makes this available. |
| Purpose | To send information, updates, content and direct marketing communications concerning CoverManager products and services. |
| Legal basis | Consent, under Article 6(1)(a) GDPR, where the individual has subscribed or has expressly agreed to receive such communications. Legitimate interests, under Article 6(1)(f) GDPR, where there is a prior contractual relationship and the communications relate to CoverManager’s own products or services that are similar to those previously contracted. Electronic direct marketing communications will also be sent in accordance with the requirements of Article 21(2) of Spanish Act 34/2002 on Information Society Services and Electronic Commerce (LSSI). You may opt out of direct marketing communications at any time by using the unsubscribe mechanism provided in each communication or by contacting dpo@covermanager.com. |
| Mandatory nature of the data | Receiving direct marketing communications is voluntary. Where such communications are based on your consent, you are free to decide whether you wish to receive them, and refusing consent will not affect any other services or relationship you may have with CoverManager. |
| Retention | Where the processing is based on consent, until consent is withdrawn. Where it is based on legitimate interests, for as long as those interests remain applicable or until the data subject exercises the right to object. Following an opt-out, the minimum information necessary may be retained in a restricted form for the applicable limitation periods in order to demonstrate compliance with legal obligations. |
| Recipients | Providers of email marketing, CRM, communications or ancillary services required to send communications and manage marketing preferences. |
3.3. When you are a customer, representative, contact person or authorised user of a customer
| Sources / collection channels | Order Form and other contractual documentation. Communications with CoverManager’s Sales, Hospitality, Billing, Legal or other teams. Creation and use of accounts or access credentials for the Platform. |
| Personal data processed | Identification data and professional contact details. Job title or role. Evidence of authority or representation where necessary. Account and access data. Billing and payment-related data where applicable. Communications and instructions relating to the contractual relationship. |
| Purpose | To manage the pre-contractual and contractual relationship with the customer. To administer accounts and access rights. To provide support and customer service. To manage billing and collections. To maintain operational and contractual communications. To comply with legal obligations and to establish, exercise or defend legal claims. |
| Legal basis | Article 6(1)(b) GDPR where the individual is a party to the contract. Where we process personal data relating to representatives, contact persons or authorised users of a customer entity, the processing is based on the legitimate interests of CoverManager and the relevant entity in managing and performing the professional relationship, pursuant to Article 6(1)(f) GDPR in conjunction with Article 19 LOPDGDD. Where applicable, processing is also based on compliance with legal obligations under Article 6(1)(c) GDPR. |
| Mandatory nature of the data | Personal data necessary to manage the contractual or administrative relationship, or access to the Services, must be provided in order for us to properly provide the Services and manage the customer relationship. |
| Retention | For the duration of the contractual relationship or for as long as the individual remains a representative, contact person or authorised user. Thereafter, the necessary data will be retained in a restricted form for the applicable limitation periods in order to comply with legal obligations and address potential liabilities. |
| Recipients | Financial institutions and service providers required for billing, collections, electronic signature, CRM, support, communications, hosting, corporate management and other ancillary services. Public authorities, courts or other competent authorities where disclosure is required by law. |
3.4. When you take part in a recruitment process
| Sources / collection channels | Application form or careers portal. Direct submission of an application. Recruitment platforms used by CoverManager. |
| Personal data processed | Identification and contact details. Education, professional experience, CV/resume and any other information voluntarily provided in connection with the application. |
| Purpose | To manage the application and assess the candidate’s suitability for a vacancy. Where separately authorised by the individual, to retain the candidate profile for future employment opportunities. |
| Legal basis | Steps taken at the request of the data subject prior to entering into a contract, under Article 6(1)(b) GDPR, for an application to a specific vacancy. Consent, under Article 6(1)(a) GDPR, where the individual separately agrees to be included in a candidate pool or considered for future vacancies. |
| Mandatory nature of the data | Mandatory fields will be identified in the relevant application form or recruitment process. Failure to provide the necessary information may prevent us from assessing or managing the application. |
| Retention | Personal data will be retained for the duration of the relevant recruitment process. Where you have authorised us to retain your data for future employment opportunities, they will be retained for a maximum period of one year. After that period, the data will be erased, without prejudice to the possibility of retaining them in a restricted form for the applicable legal limitation periods in order to address potential liabilities. |
| Recipients | Providers of recruitment platforms, storage, communications or human resources services acting on behalf of CoverManager. |
3.5. When you browse our website
| Sources / collection channels | Browsing www.covermanager.com and using its functionalities. |
| Personal data processed | IP address, technical identifiers, device information, browser and operating system, date and time of access, technical logs, security information and, where applicable, data generated through the use of cookies or similar technologies. |
| Purpose | To ensure the technical and secure operation of the website. To prevent abusive or fraudulent use. To diagnose errors and incidents. Where consent has been given, to carry out analytics, personalisation or advertising measurement in accordance with the user’s selected settings. |
| Legal basis | Legitimate interests, under Article 6(1)(f) GDPR, for processing strictly necessary for the security, operation and maintenance of the website. Consent, under Article 6(1)(a) GDPR, for non-essential cookies or similar technologies where consent is required. |
| Retention | Technical and security logs will be retained for as long as strictly necessary to ensure the proper operation and security of the Website, diagnose incidents and prevent or investigate misuse. Thereafter, they may be retained in a restricted form for the applicable limitation periods in order to address potential liabilities. Data obtained through cookies and similar technologies will be retained for the periods specified in the Cookie Policy and in the preference management panel. |
| Recipients | Providers of hosting, security, analytics, consent management and other necessary technical services, in accordance with the user’s selected cookie settings. |
4. Where do we obtain your personal data from?
As a general rule, we obtain your personal data directly from you when you contact CoverManager, request information or a demo, register for any of our services, take part in a recruitment process or otherwise interact directly with us.
However, where you act as a representative, contact person or authorised user of a company or establishment, your professional contact details may also be provided by the entity for which you work or with which you collaborate.
In addition, where lawful and necessary to establish or maintain professional relationships, CoverManager may obtain professional contact details from publicly available sources, professional directories or third parties lawfully entitled to provide them.
5. Processing carried out on behalf of our customers
CoverManager provides technology services to restaurants, event organisers and other customers that may involve the processing of personal data relating to their customers, diners, attendees, guests or other end users. In these cases, as a general rule, the relevant customer acts as data controller and CoverManager processes the data on its behalf as data processor, in accordance with the customer’s instructions and the applicable Data Processing Agreement.
If you wish to exercise your rights in relation to personal data processed in connection with a booking, order, waiting list, experience, ticket or other service offered by one of our customers, you should contact the relevant establishment or entity. CoverManager will provide the customer with the assistance required to handle your request in accordance with applicable data protection law.
6. Do we make automated decisions about you?
CoverManager does not make decisions based solely on automated processing of your personal data that produce legal effects concerning you or similarly significantly affect you.
7. Who may have access to your personal data?
As a general rule, CoverManager will not disclose your personal data to third parties unless there is a lawful basis for doing so or disclosure is necessary to comply with a legal obligation. Certain service providers may also have access to personal data where necessary to provide services to CoverManager, such as hosting, communications, CRM, support, billing, electronic signature, corporate tools or recruitment services. Where such providers process personal data on behalf of CoverManager, they will act as data processors and will be subject to the obligations laid down in Article 28 GDPR.
We may also disclose personal data to public authorities, regulatory or supervisory authorities, courts or other third parties where necessary to comply with a legal obligation, respond to a valid request, or establish, exercise or defend legal claims.
In the event of a corporate reorganisation, merger, acquisition, transfer of a business unit or similar transaction, personal data may be disclosed to the entities involved where necessary and where an appropriate lawful basis exists, subject to the relevant confidentiality and security safeguards.
8. International transfers of personal data
Some of the service providers used by CoverManager may process personal data from countries outside the European Economic Area. Where an international transfer of personal data takes place, CoverManager will rely on a valid transfer mechanism under Chapter V GDPR, such as an adequacy decision adopted by the European Commission, Standard Contractual Clauses or other appropriate safeguards, and will implement any supplementary measures that may be required.
You may request further information about the safeguards applicable to international transfers involving your personal data by contacting dpo@covermanager.com.
9. Your rights
Where applicable, you may exercise the following rights:
• Right of access to your personal data and information about how they are processed.
• Right to rectification of inaccurate or incomplete personal data.
• Right to erasure of your personal data where any of the circumstances provided by law applies.
• Right to object to processing based on legitimate interests, including the right to object to direct marketing.
• Right to restriction of processing in the circumstances set out in Article 18 GDPR.
• Right to data portability where the processing is based on consent or on a contract and is carried out by automated means.
• Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, in accordance with Article 22 GDPR.
• Right to withdraw your consent at any time in relation to processing based on consent, without affecting the lawfulness of processing carried out before its withdrawal.
To exercise your rights, you may contact dpo@covermanager.com, indicating the right you wish to exercise and providing, only where necessary, reasonable information to verify your identity.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) if you consider that the processing of your personal data infringes applicable data protection law.
10. Security and confidentiality
CoverManager implements technical and organisational measures appropriate to the risk in order to protect personal data against unauthorised or unlawful destruction, loss, alteration, disclosure or access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.
In addition, persons authorised to process personal data are subject to confidentiality obligations and may access only the information necessary for the performance of their duties.
11. Cookies and similar technologies
CoverManager uses cookies and similar technologies on its website. Non-essential cookies will be placed only where the required lawful basis exists, in accordance with the preferences selected by the user. Detailed information on cookie categories, providers, purposes and retention periods is available in our Cookie Policy and in the preference management panel available on the website.
12. Changes to this Policy
CoverManager may amend this Privacy Policy where necessary to reflect changes in applicable law, guidance or criteria issued by supervisory authorities, changes to its processing activities or material changes to its services. The current version will be available on the website and will indicate the date on which it was last updated.
Where an amendment materially affects a processing activity about which data subjects have previously been informed and notification is required under applicable law, CoverManager will take appropriate steps to communicate the change to the affected individuals.