GDPR privacy policy generator for restaurants and cafes
If your restaurant is in the EU, or you sell to people in the EU (for example a delivery kitchen near a border or a brand with EU tourists ordering online), the GDPR expects a privacy notice with specific information: who controls the data, why you use it, the legal basis for each purpose, how long you keep it and every right customers have.
Tick what your business does and the generator lists the legal basis for each purpose for you, including the special case of allergy information, which can count as health data.
Your privacy policy
Fill in to finish:
- Trading name
- Registered company name
- Business address
- Country
- Contact email
Privacy policy
Last updated: 27 October 2026
This policy explains how our business, trading as our business ("we", "us", "our"), collects, uses, shares and protects your personal data when you visit our outlets, order from us, use our website or join our programmes, and the choices and rights you have.
Who we are and how to contact us
- our business, trading as our business
- Address:
- Email:
For the purposes of the GDPR, our business is the controller of your personal data.
Laws this policy follows
- General Data Protection Regulation (EU) 2016/679 (GDPR)
What we collect and why
We only collect what we need. Here is what we collect in each situation, and what we use it for.
When you order from us (online, pickup, delivery or at the table)
What we collect:
- your name, phone number and email address
- your delivery address and any delivery notes
- what you ordered, when, and any special requests
Why we use it:
- to prepare, deliver or hand over your order
- to contact you about your order, for example if an item is unavailable or your rider is on the way
- to issue receipts and handle refunds or complaints
Legal basis under the GDPR: performance of a contract with you (to take and deliver your order).
When you pay
What we collect:
- the amount, payment method and payment status
- payment details you enter are handled by our payment provider; we do not see or store your full card number
Why we use it:
- to take payment and issue refunds
- to detect and prevent fraud
- to keep the tax and accounting records the law requires
Legal basis under the GDPR: performance of a contract with you, and our legal obligations for tax and accounting.
When you agree to hear from us
What we collect:
- your name, phone number (including WhatsApp) and email address
- what you buy and which messages you open or click, so our offers are relevant
Why we use it:
- to send you promotions, new menu items and event news by WhatsApp, SMS or email
Legal basis under the GDPR: your consent; you can withdraw it at any time.
When you visit our website
What we collect:
- cookies and similar technologies on your device
- pages visited, device and browser type, approximate location from your IP address, and how you arrived
Why we use it:
- to make the website work, such as keeping your basket
- with your consent where required, to measure visits and show you relevant ads on other sites (for example Google Analytics and Meta Pixel)
Legal basis under the GDPR: your consent for analytics and advertising cookies; our legitimate interests for cookies strictly needed to run the website.
Allergy and dietary information
If you tell us about an allergy or dietary need, we use it only to prepare your food safely, with your consent, and we do not use it for marketing. Please also tell our staff in person: we cannot guarantee that any dish is free from allergens.
Who we share your data with
We do not sell your personal data. We share it only with:
- payment providers that process your payments
- other service providers that host our website, ordering, messaging and IT systems, under contracts that require them to protect your data and use it only for us
- professional advisers, such as accountants, auditors and lawyers
- the police, regulators, courts or other authorities, when the law requires it or to protect our rights, customers or staff
- a buyer or successor, if our business or part of it is sold or reorganised
Transfers outside your country
Some of our service providers store or process data in other countries. When we transfer your personal data abroad, we make sure it receives a comparable level of protection, for example by using providers in countries with adequate data protection laws or by contract terms that require them to protect it.
For transfers out of the EU or UK, we rely on an adequacy decision or on the standard contractual clauses approved for that purpose. You can ask us for a copy of the safeguards we use.
How long we keep your data
- orders, invoices and payment records: 6 years, because tax and accounting laws require it
- marketing preferences: until you unsubscribe; we keep a record of your opt-out so we do not contact you again
- anything else: only as long as needed for the purpose we collected it for, or as the law requires
How we protect your data
We use reasonable technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including encrypted connections, access limited to staff who need it, and service providers bound by confidentiality. No system is completely secure, so please keep your account login details private.
If a data breach is likely to put you at risk, we will tell you and the relevant authority as the law requires.
Marketing and how to stop it
We only send marketing messages if you agreed to them or if the law otherwise allows it. You can stop them at any time: use the unsubscribe link in an email, reply STOP to a WhatsApp or SMS message, change your account settings, or contact us. Stopping marketing does not affect messages about your orders.
Cookies
Some cookies are needed for our website to work and cannot be switched off. We only use analytics and advertising cookies with your consent where the law requires it, and you can change your choice at any time in your browser or in our cookie settings.
Your rights
You can:
- access your personal data and receive a copy
- have inaccurate personal data corrected (rectification)
- have your personal data erased in certain cases (erasure)
- restrict our processing in certain cases
- receive personal data you gave us in a structured, machine-readable format, or have it sent to another organisation (portability)
- object to processing based on our legitimate interests, and to direct marketing at any time
- withdraw your consent at any time, without affecting processing that took place before
We will reply within one month of receiving your request. If a request is complex we may extend this by up to two further months and will tell you why.
To use any of these rights, email us at . We may need to confirm your identity before we act on your request. We will not treat you less favourably for using your rights.
Children
Our services are not aimed at children. We do not knowingly collect personal data from children without the consent of a parent or guardian. If you think a child has given us personal data, please contact us and we will delete it.
Complaints
If you are unhappy with how we handled your personal data, please contact us first at so we can try to put it right.
You can also complain to the data protection supervisory authority in the EU or EEA country where you live, work or think your rights were infringed.
Changes to this policy
We may update this policy from time to time. We will post the new version on this page with a new "Last updated" date, and tell you directly about important changes where the law requires it.
Before you publish
- Read the whole policy and remove anything that does not match what you really do. A policy that describes practices you do not follow is worse than none.
- Have a lawyer qualified in each country you selected review it before you rely on it. This generator is a drafting aid, not legal advice.
- Publish it where customers can find it before they give you data: your website footer, online ordering page, WiFi sign-in page and loyalty sign-up.
- EU: non-essential cookies and pixels (analytics, Meta Pixel, advertising) need consent before they load. Add a cookie banner with a real "Reject" choice.
- EU: if you have no establishment in the EU but offer food or delivery to people there, you may need an EU representative (GDPR Article 27).
- EU: allergy and dietary information can be health data. Only collect it when needed, and ask for explicit consent.
- EU: keep a record of processing activities and check whether you need a Data Protection Officer.
Nothing you type here is sent to or saved by EatsVenture: the policy is put together in your browser. This tool is a drafting aid, not legal advice, and does not guarantee compliance with any law.
What the GDPR means for your restaurant
A legal basis for every purpose
Taking an order is a contract, marketing usually needs consent, CCTV relies on legitimate interests. The policy states each one, as Articles 13 and 14 require.
Allergy data is health data
Allergy and dietary information can be special category data. Collect it only when needed to prepare food safely, with explicit consent, and never use it for marketing.
Cookies need consent first
Analytics and advertising cookies, including Meta Pixel and Google Analytics, need consent before they load under the ePrivacy rules. A privacy policy alone is not enough: add a cookie banner with a real reject option.
One month to answer
Requests from customers must be answered within one month, extendable by two months for complex requests.
Privacy policy generator by country
Questions restaurant owners ask
Does GDPR apply to a restaurant outside the EU?
It can. The GDPR applies when you offer goods or services, including food delivery or online orders, to people in the EU, or monitor their behaviour, for example with tracking pixels aimed at EU visitors. If it applies and you have no EU establishment, you may also need an EU representative.
What legal basis covers CCTV in a restaurant?
Usually legitimate interests in safety and crime prevention, balanced against customers' privacy. Keep footage only for a short, defined period and put up clear signs.
Do I need a Data Protection Officer?
Most single restaurants do not, unless their core activities involve large-scale regular monitoring or special category data. A large group running a big loyalty programme with profiling should check carefully.
Is this privacy policy generator really free?
Yes. There is no sign-up and no watermark. Copy the text or download it as HTML, Markdown or PDF and use it on your own website.
Do you store the details I type in?
No. The policy is put together in your browser. Your business details are not sent to or saved on our servers.
Which countries does it cover?
It has specific clauses for Malaysia (PDPA), Singapore (PDPA), the European Union (GDPR) and the United Kingdom (UK GDPR). You can also select other countries, which get general clauses and a reminder to check local law.
Is the generated policy legal advice?
No. It is a restaurant-specific draft to save you time. Check that it matches what you actually do, and have it reviewed by a lawyer in each country where you operate.
Keep it up to date without thinking about it
EatsVenture runs your own online ordering, loyalty and WhatsApp marketing, with your privacy policy, terms and refund policy filled in from your business details and published on your ordering site.
Talk to us on WhatsApp