Privacy Policy

Introduction

metroluxubum S.A. ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard data we collect through our restaurant guest behaviour analytics platform and website at metroluxubum.pro.

Data Controller Information

The data controller for your personal information is metroluxubum S.A., a company registered in Portugal with registration number 635241795, located at Rua do Comércio 130, 1047-300 Lisbon, Portugal. For privacy-related inquiries, please contact us at privacy@metroluxubum.pro or by phone at +351 212 675 131.

Data We Collect

The data we collect includes both personal information you provide directly and information collected automatically through our services. Personal data collection occurs when you use our website, contact our services, or utilise our analytics platform. We collect the following categories of information:

Information You Provide Directly

• Contact information including name, email address, phone number, and company details
• Communication records when you contact us for support or inquiries
• Account information for platform access and user preferences
• Restaurant operational data provided for analytics purposes

Information Collected Automatically

• Website usage data including pages visited, time spent, and navigation patterns
• Technical information such as IP addresses, browser types, and device information
• Analytics data from our platform usage and performance metrics
• Cookie data as described in our Cookie Policy

How We Use Your Information

We use of your data is based on legitimate business interests, contractual obligations, and your consent where required. The primary purposes for processing your personal information include:

• Providing and maintaining our restaurant analytics platform services
• Processing and responding to your inquiries and support requests
• Improving our services and developing new features based on usage patterns
• Communicating important updates about our services and platform
• Ensuring platform security and preventing fraudulent activities
• Complying with legal obligations and regulatory requirements
• Conducting business analysis and performance optimisation

Cookies and Tracking Technologies

We may use cookies and tracking technologies for analytics, advertising, and remarketing purposes, including Google Ads. These technologies help us measure campaign effectiveness, deliver relevant advertisements, and improve our services. You can manage your cookie preferences at any time through our cookie consent banner. For detailed information about our use of cookies, please refer to our Cookie Policy.

Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following limited circumstances:

• With trusted service providers who assist in operating our platform and services
• When required by law, legal process, or regulatory authorities
• To protect our rights, property, or safety, or that of our users
• In connection with a business transfer, merger, or acquisition
• With your explicit consent for specific purposes

International Data Transfers

As a European-based company, we primarily process data within the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including adequacy decisions, standard contractual clauses, or other legally recognised transfer mechanisms under GDPR.

Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. The specific data retention periods vary based on the type of information and the legal basis for processing. Generally, we retain account information for the duration of our business relationship plus a reasonable period thereafter, and communication records for up to seven years for business and legal compliance purposes.

Your Rights

Under the General Data Protection Regulation (GDPR) and applicable data protection laws, you have several rights regarding your personal information:

• Right of Access: Request copies of your personal information
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal information under certain circumstances
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Data Portability: Request transfer of your data in a structured format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for processing where applicable

To exercise any of these rights, please contact us at privacy@metroluxubum.pro. We will respond to your request within one month of receipt.

Security Measures

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include encryption, access controls, regular security assessments, and staff training on data protection principles. However, no internet-based service can guarantee complete security, and you acknowledge the inherent risks of online data transmission.

Children's Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information promptly.

Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us using the following information:

Supervisory Authority

You have the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados - CNPD) if you believe we have not complied with applicable data protection laws. Contact information for the CNPD is available at their official website.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on our website and updating the "Last Updated" date. Your continued use of our services after such changes constitutes acceptance of the updated Privacy Policy.

Legal Basis for Processing

We process your personal information based on the following legal grounds under GDPR:

• Contractual Necessity: Processing necessary for performing our services
• Legitimate Interests: Processing for our business operations and service improvement
• Consent: Where you have provided explicit consent for specific processing activities
• Legal Obligation: Processing required to comply with applicable laws and regulations