Privacy Policy

Ελληνική έκδοση

1. Who we are

edrink Private Company (Ι.Κ.Ε.), 11-13 Aristotelous St, Athens 104 32, Greece (Tax ID: 802281720, General Commercial Registry (GEMI) no. 173565201000) is the data controller for the personal data described in this policy, which means we decide how and why that data is processed.

For anything relating to your personal data, contact us at support@edrink.gr or by post at the address above. Our designated privacy lead handles all data protection requests.

2. What this policy covers

This policy covers personal data we process when you use the edrink mobile app or the edrink website (including reservations made on the website or through a venue's edrink booking link or widget, also when it is embedded on the venue's own website), when you book an edrink venue through Reserve with Google or through a partner app or website integrated with edrink, when you use edrink Manager on behalf of a venue (Section 6.4), and when you contact our support team or receive our communications.

It does not cover:

• What venues do with your data after you book. Restaurants, bars and other venues on edrink are independent businesses. Section 6 explains exactly what we send them and where our responsibility ends and theirs begins.
• Cookies in detail. Our Cookie Policy, available on our website, lists every cookie and similar technology we use. Section 10 below summarises how consent works.

3. The data we collect

3.1 Data you give us

• Account data: name, email address, phone number, and password (stored hashed).
• Reservation data: venue, date and time, party size, and the status of your booking (confirmed, seated, cancelled, no-show).
• Special requests: free-text notes you add to a booking, for example a birthday, a stroller, or dietary needs. See the box below for how we treat allergy and dietary information.
• Payment data: where a venue requires a deposit or prepayment, payment is processed by Stripe. Your full card details go directly to Stripe and never touch our servers; we receive only a payment confirmation, the last four digits, and the card brand.
• Support conversations: messages you exchange with our support team (via Intercom chat or email).

3.2 Data collected automatically

• Device and technical data: IP address, device model and OS, browser or app version, language, and device identifiers (including the mobile advertising identifier, only where you have consented; see Section 10). To stop abuse of SMS verification, we also keep your IP address and a device fingerprint in our abuse-prevention system for up to 48 hours; security logs are kept as set out in Section 9.
• Crash reports: if the app crashes, technical details about the crash (device model, operating system and app version, the error), without your name or contact details, only after you consent (see Section 10).
• Usage data: pages and screens viewed, searches, taps, and session length, collected through Google Analytics on the website and in the app, only after you consent (see Section 10).
• Precise location (GPS): only if you grant the app location permission, and only while you use the app, to show venues near you. This is optional: you can always search by area instead, and you can revoke the permission in your device settings at any time. The map in the app and the booking widget is provided by Mapbox, which receives the map area shown on your screen, which may be centred on your location.

3.3 Data from third parties

• Social login: if you sign in with Google, Apple or Facebook, we receive your name and email address (or Apple's private relay address) from that provider.
• Reserve with Google: if you book an edrink venue through Google, we receive your name, contact details, reservation details and any special requests you write from Google in order to place and manage the booking. This policy applies to that data from the moment we receive it.
• Partner apps and websites: if you book an edrink venue through an app or website integrated with edrink (for example a travel or discovery app), we receive your name, contact details and reservation details from that partner in order to place and manage the booking, and we send the partner the status of that booking. This policy applies to that data from the moment we receive it.

3.4 What you must provide, and what is optional

To create an account and make a booking we need your name, email address and phone number; without these we cannot provide the service, because venues need to know who is coming and how to reach you. Everything else (special requests, dietary notes, location access, marketing preferences) is optional, and declining it never affects your ability to book.

4. Why we use your data, and our legal basis for each purpose

Under the GDPR we must have a legal basis for every use of your personal data. This table is the complete list; we do not use your data for purposes that are not on it.

5. Personalisation, marketing and automated decisions

Personalisation. We may use your reservation history, searches, saved venues and in-app activity, including through automated and machine-learning models, to order venues, suggest places you might like and, from time to time, offer you coupons. This is a limited form of profiling. It never uses your special request notes or other sensitive data, no venue can pay to be shown to you this way, and no decision with legal or similarly significant effects is made about you through it.

Marketing. We send marketing emails and push notifications only if you have opted in, and every marketing message tells you how to stop them. Push notifications can also be turned off in the app or your device settings.

Automated decisions. To run bookings fairly and protect venues, some decisions are made automatically:

• a reservation is recorded as a no-show if the venue has not recorded your arrival within 6 hours after the reservation ends; under the venue's cancellation policy, this can mean the venue keeps some or all of a prepaid amount;
• an account with repeated no-shows or cancellations, or too many reservations created or left open, may be temporarily unable to book;
• phone numbers, IP addresses or devices used to abuse our SMS verification are blocked.

These decisions are necessary for our contract with you (GDPR Art. 22(2)(a)). You can ask for any of them to be reviewed by a person, give your view and contest it at support@edrink.gr or through our live chat; if a no-show was recorded wrongly, we correct it and any amount retained is refunded (Terms of Use, Section 6). A venue can also choose not to take bookings from you; the app then declines your requests at that venue, and that is the venue's decision.

6. edrink and venues: who is responsible for what

6.1 When you book

To fulfil your reservation, we send the venue: your first and last name, phone number, email address, party size, the date and time, your booking status, and any special request notes. Where a note contains sensitive information (allergies, dietary needs), we send it only on the basis of your explicit consent, given as described in Section 3; the venue may keep it in its guest records solely to serve you on future visits, until you withdraw your consent or request deletion. We do not send the venue your location or your activity on edrink, including your bookings at other venues.

From the moment the venue receives this data, it processes it as an independent data controller under its own responsibility and its own privacy policy, for example to prepare your table or comply with its own legal obligations. Our agreements with venues allow them to use data received through edrink only to manage and honour your reservations, contact you about them and your visit, handle cancellations, no-shows and refunds, keep their own reservation history and guest records for their own venue(s), and meet their legal obligations. They may not sell it or pass it to other businesses, other than their own service providers, and may not use it for marketing unless you opt in (Section 6.2). We are not responsible for a venue's own processing. Ask the venue directly about its privacy practices.

6.2 Venue marketing

Venues may not use the contact details they receive through edrink for their own marketing unless you separately opt in to that venue's communications. If you do opt in, the venue is solely responsible for that marketing and for honouring your opt-out.

6.3 Where we work for venues

We provide venues with reservation-management tools (their digital reservation book). When we host and maintain a venue's guest records in those tools, we act as the venue's processor under a data processing agreement (GDPR Art. 28): the venue decides what happens to its guest book, and we act on its instructions.

Where a venue moves to edrink from another reservation system, we may, at the venue's request, import the venue's existing guest and reservation records into that venue's own records on our platform. The venue is responsible for ensuring it may lawfully transfer this data and for informing the people concerned. We act only as the venue's processor for these records and for the records a venue enters itself: they are never used for our own purposes, never feed our recommendations, are never shared with any other venue, and no marketing to you results from them. The venue decides how long it keeps its guest records. Two things do happen within that venue only: when you book it on edrink with the email address and phone number held in a record in its guest book, we link the two so the venue sees one guest history, including any notes it keeps about you; and if the venue has chosen not to take bookings from you, we decline your requests at that venue.

6.4 Venue owners and staff

If you use edrink Manager on behalf of a venue, we process your name, work email address, phone number, login credentials, activity logs and crash reports from the edrink Manager app to provide the venue with the service, keep the account secure and meet our legal obligations (contract with the venue, Art. 6(1)(b), and our legitimate interest in security, Art. 6(1)(f)). We keep this data for the term of the venue's agreement with edrink and for the limitation periods that follow. The recipients, transfers, security measures and rights described in this policy apply to you in the same way. The venue's own guest records are a separate matter: for those, the venue is the controller and we act as its processor (Section 6.3).

7. Who else receives your data

We never sell your personal data. Beyond venues (Section 6), your data is handled by the providers below. Most act as processors on our instructions under GDPR Art. 28 contracts; the ones marked † act as independent controllers under their own privacy policies.

We may also disclose data where the law requires it (for example to tax authorities, courts, or the police on a valid legal order), and, in the event of a merger, acquisition, corporate restructuring or sale of assets, to the parties and advisers involved; see Section 13.

8. International data transfers

Your data is stored on servers in Frankfurt, Germany, inside the EU. Some of the providers listed in Section 7 process data in the United States, Israel or Australia. Where that happens, the transfer is protected by one of the GDPR's approved mechanisms, as listed per provider in the table above: the European Commission's adequacy decisions (including the EU-US Data Privacy Framework for certified US providers, and the adequacy decision for Israel), and/or the Commission's Standard Contractual Clauses together with supplementary measures where needed. You can request a copy of the relevant safeguards by contacting us.

9. How long we keep your data

Where we must keep transaction records for tax law after you delete your account, we pseudonymise them: your name, contact details and any notes are removed from operational systems and the retained record is accessible only for the legal purpose. We are transparent that this is pseudonymisation: the retained record remains subject to the GDPR and to the protections in this policy until it is finally deleted.

10. Cookies, SDKs and consent

We use cookies and similar technologies (including mobile SDKs) as described in our Cookie Policy, available on our website. Strictly necessary cookies run without consent. Everything else (analytics, crash reporting, attribution and any advertising technology) runs only after you consent through our consent banner (web) or consent screen (app), as required by Greek Law 3471/2006. On the website, consent is managed through Cookiebot with "Accept" and "Reject" given equal weight, and we use Google Consent Mode in basic mode: no Google analytics or advertising script loads until you accept. You can change your choices at any time via the "Cookie settings" link in the website footer or the app's settings, and on iOS we additionally respect your App Tracking Transparency choice.

11. Your rights

Under the GDPR you have the right to:

• Access your data and get a copy (Art. 15);
• Correct inaccurate data (Art. 16); you can edit most of it yourself in account settings;
• Delete your data (Art. 17); see Section 12 for the self-serve path;
• Restrict processing while a dispute or verification is pending (Art. 18);
• Portability: receive the data you gave us in a machine-readable format, or have it sent to another provider (Art. 20);
• Object (Art. 21); see the box below;
• Withdraw any consent at any time (Art. 7(3)), as easily as you gave it, without affecting past processing.

How to exercise your rights: in your account settings, or by emailing support@edrink.gr. We respond within one month (extendable by two further months for complex requests; if so, we will tell you within the first month). Exercising your rights is free; we may ask you to verify your identity so we do not hand your data to someone else. We will only refuse or charge for requests that are manifestly unfounded or excessive, and we will explain why (Art. 12(5)).

Complaints. You can lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifissias 1-3, 115 23 Athens, www.dpa.gr, contact@dpa.gr, +30 210 6475600, or with the supervisory authority of the EU country where you live or work. We would appreciate the chance to resolve your concern first, but you do not have to contact us before going to the authority.

12. Deleting your account and data

You can delete your account in three ways: from the app (account settings), via the account-deletion form on our website, or by emailing us at support@edrink.gr.

When you delete your account we erase your profile, preferences, saved venues, dietary notes and support history from our live systems within 30 days; copies in encrypted backups expire automatically within roughly 90 days. Transaction records that Greek tax law obliges us to keep are pseudonymised as described in Section 9 and deleted at the end of the statutory period. If you signed in with Apple, Google or Facebook, we also revoke the connection on our side. Upcoming reservations stay valid with the venue unless you cancel them. Venues you booked with keep their own record of your reservations; we pass your deletion request on to them.

13. Security, age limits, and corporate changes

Security. All traffic is encrypted in transit (TLS); passwords are stored hashed; access to personal data is limited to people who need it; our processors are bound to equivalent standards. If a personal data breach occurs, we will notify the Hellenic DPA within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to you. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

Age limits. edrink is a service for booking venues that serve alcohol; you must be 18 or older. We do not knowingly collect data from anyone under 18, and we delete such data if we become aware of it.

Corporate changes. If edrink is involved in a merger, acquisition, corporate restructuring (including a change of the group parent company) or sale of assets, your data may be transferred to the successor entity. Any successor remains bound by this policy, and your data remains protected by the GDPR regardless of where the new controller is established. If the controller of your data changes, we will inform you prominently, in the app and by email, before the change takes effect, and remind you of your rights, including deletion.

14. Changes to this policy

When we change this policy, we will post the new version here with a new date. For material changes (new purposes, new categories of recipients, changes to your rights) we will notify you in the app or by email before the change takes effect, and where a new processing purpose requires consent, we will ask for it rather than assume it. Previous versions are available on request.

Language. This policy is published in English and in Greek. In case of any discrepancy between the two versions, the English version prevails; your rights under the GDPR are not affected by this.

15. Contact us

edrink Private Company (Ι.Κ.Ε.)
11-13 Aristotelous St, Athens 104 32, Greece
support@edrink.gr

Supervisory authority: Hellenic Data Protection Authority, Kifissias 1-3, 115 23 Athens. Website: www.dpa.gr. Email: contact@dpa.gr. Phone: +30 210 6475600.