Privacy policy
Last updated: 11 October 2026
This policy explains what personal data Edesia processes, what for, and what rights you have. It applies to everyone who uses Edesia: restaurant staff, diners and visitors to this site.
1. Who is responsible
NODOTIC ASESORIA TECNOLOGICA Y GESTION DE PROYECTOS SL, tax ID (NIF) B66080532, Calle Salvador Espriu 13, 08188 Vallromanes (Barcelona). Privacy contact: privacy@edesiapp.com.
When you order at a restaurant
The data of your visit is processed by the restaurant, which is the controller: the name or nickname you join the table with, what you order, your notes, your payments and, if you ask for one, your invoice. You do not need your real name to join a table: you can use a nickname. What you write in the name and in the notes is up to you, so do not put anything you would not want to share with the restaurant. Edesia provides the app to the restaurant and processes that data only on its behalf and on its instructions, as a processor. To exercise your rights over that data, contact the restaurant. If you write to us, we will pass your request on to it.
Whatever you write in a note is seen by the staff to prepare your order. If you have an allergy, tell them in person as well.
2. What data we process and what for
| What for | What data | Legal basis |
|---|---|---|
| Giving restaurant staff access to Edesia and managing their accounts | Name, email, role, restaurant and encrypted password | The contract with the restaurant (art. 6.1.b GDPR) and, for its staff, the legitimate interest in providing the contracted service (art. 6.1.f) |
| Recording who does each action in the app | User, action and time | The legitimate interest in security and in being able to account for every order and every payment (art. 6.1.f) |
| Answering your questions and support tickets | Whatever you send us, screenshots included, and technical data about your device | The contract (art. 6.1.b) or the legitimate interest in answering you (art. 6.1.f) |
| Keeping the service secure and fixing errors | IP address, device data and technical logs | The legitimate interest (art. 6.1.f) |
| Meeting legal obligations | Whatever the law requires, such as invoicing records | The legal obligation (art. 6.1.c) |
The data we ask for as required is essential to provide the service: without it we cannot give you access. We do not make automated decisions that affect you, we do not build profiles and we do not sell your data.
3. Who it is shared with
Only with those who need it to provide the service, always under contract and bound by confidentiality:
- providers of hosting, network and storage, technical logs and email delivery;
- the restaurant, for what concerns its own service;
- the Spanish Tax Agency (Agencia Tributaria), when a restaurant issues its invoices with Edesia;
- courts and authorities, when the law requires it.
The servers and the database are in the European Union. Some providers have their parent company in the United States. If any of them accessed data from outside the EU, it would do so with the safeguards of the GDPR, such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.
4. How long
For as long as you use Edesia or the restaurant you work for has the service contracted. After that, the data is blocked and kept only for as long as liability can be claimed or the law requires it (invoices, for example), for 24 months at most unless the law requires longer. Data we process on a restaurant’s behalf is kept according to its instructions, and is returned to it or deleted when its contract ends. Technical logs are deleted after 30 days.
5. Your rights
You can ask to access your data, rectify or erase it, object to its use, restrict it and ask for its portability. If you gave us your consent, you can withdraw it whenever you like; what was done before remains valid. Write to privacy@edesiapp.com from your account’s email address, or telling us how to identify you, and we will reply within one month at most. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es (opens in a new tab)).
6. Security
We apply measures suited to the risk: encrypted connections, passwords stored irreversibly, access control and backups.
7. Changes
If we change this policy, we will publish the new version here with its date. If the change is significant and you have an account, we will let you know.