Privacy policy

1. Who is responsible?

The controller for the processing described in this policy is:

For privacy questions or to exercise your rights, email mail@nordicnexus.nl. Please use the subject “Privacy request”.

2. Scope

This policy applies to the restaurants.qa website, its public restaurant directory, submission forms and the protected operator and administration areas. It does not govern websites, booking services or social networks operated by third parties that we link to.

3. Data we process

• Website and security data: IP address, request time, requested URL, browser or device information and technical security events that may be generated by the web server and hosting infrastructure.
• Submissions and correspondence: your name, business email address, optional phone or WhatsApp number, restaurant details, your message and information supplied to support an ownership claim or correction.
• Operator accounts: name, email address, password hash, role, restaurant memberships, account status, authentication events and a short-lived session identifier.
• Restaurant and source records: business contact details and factual restaurant information obtained from the restaurant, a submitter or publicly accessible sources. Restaurant email addresses are kept internal and are not displayed publicly.
• Images and rights information: uploaded files, filenames, descriptive text, creator or attribution details, the stated rights basis and an audit record of review actions. Original uploads are kept private; approved optimized versions may be published.
• Email delivery data: recipient address, message type, delivery status, provider message ID and a sanitized error code. We do not use these transactional emails for advertising.
• Consent-based audience measurement: if you accept analytics cookies, Google Analytics receives information about page views, interactions, approximate location derived from the IP address, browser, device and referring source. We do not send restaurant submission, operator-account or other form contents to Analytics.

4. Why we use the data

Where we rely on legitimate interests, we consider the necessity of the processing and its impact on the people concerned. We do not use personal data submitted to this service for unrelated direct marketing.

5. Cookies and browser storage

We do not use advertising cookies. Google Analytics is optional and remains disabled until you select “Accept analytics”. Your choice is stored locally in your browser and can be changed at any time through “Cookie settings” in the footer.

• Operator session: after a successful sign-in, an essential, secure, HTTP-only cookie named restaurants_qa_session keeps the operator signed in for up to eight hours.
• Favorites: restaurant IDs selected as favorites are stored locally in your browser under restaurants.qa:favorites. They are not sent to our server. You can remove them through the favorites interface or by clearing browser storage.
• Analytics preference: your selection is stored locally under restaurants.qa:analytics-consent.
• Google Analytics: after consent, Google may set cookies beginning with _ga to distinguish visits and sessions. These cookies may remain for up to two years unless you withdraw consent or delete them sooner. We use Analytics only for audience measurement, not advertising.

6. Where data comes from

We receive data directly from visitors and restaurant representatives, from authorized imports, and from public restaurant, hotel, reservation or social-media sources used for editorial verification. We keep source and review information internally. Public attribution is shown where the applicable source licence requires it.

7. Service providers and disclosures

Access is limited to authorised Nordic Nexus personnel and service providers that need the data to operate restaurants.qa. These include hosting, database, backup and security providers, Mailtrap (Railsware Products Studio LLC) for transactional email delivery, and—only after consent—Google Analytics for audience measurement. We may also disclose data to professional advisers, courts or authorities where this is necessary to comply with law or protect legal rights.

We do not sell personal data.

8. International transfers

Because restaurants.qa serves an international audience and uses infrastructure, email-delivery and optional analytics providers outside the Netherlands, data may be processed outside the European Economic Area, including in the United States. Where the GDPR requires it, we rely on an applicable adequacy mechanism, approved standard contractual clauses or another lawful transfer mechanism together with appropriate safeguards. Mailtrap states that its service data is hosted in the United States and provides a data processing agreement incorporating relevant transfer safeguards. Information about Google's data-transfer safeguards is available in its compliance resources.

9. How long we keep data

• Pending and reviewed submissions, correspondence and evidence are normally retained for up to three years after the matter is closed, unless a dispute or legal duty requires longer retention.
• Operator account and membership data is kept while the account is active and normally for up to three years afterwards. Password-reset links expire after one hour; only a hash is stored.
• Email-delivery and routine security records are normally kept for up to twelve months.
• Analytics cookies may remain for up to two years. Aggregated and event-level Analytics data is retained according to the retention settings of the Google Analytics property and may be deleted or anonymised earlier.
• Approved images, rights evidence, source records and related audit history are kept while the content is used and afterwards for as long as reasonably necessary to document publication rights or defend claims.
• Restaurant business facts remain in the directory while relevant. We correct, archive or remove them when they are no longer accurate or when a valid objection requires it.

Legal, accounting, security or dispute-related obligations may require a longer period. When data is no longer required, we delete or anonymise it.

10. Security

We use access controls, role-based permissions, encrypted transport, hashed passwords and reset tokens, secure session cookies, rate limiting, restricted administration areas, backups and audit records. No internet service can guarantee absolute security, so please do not submit unnecessary sensitive information.

11. Your rights

Subject to the conditions of applicable law, you may request access to, correction or deletion of your personal data, restriction of processing, data portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it for the future. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects; restaurants.qa does not make such decisions.

Send requests to mail@nordicnexus.nl. We may ask for information needed to verify your identity. You may also lodge a complaint with the Dutch Data Protection Authority or another competent supervisory authority. Where Qatar's Law No. 13 of 2016 on Protecting Personal Data Privacy applies, we will also respect the rights and obligations provided by that law.

12. Children

The operator and submission services are intended for adults acting in a business or professional capacity. We do not knowingly request personal data from children.

13. Changes to this policy

We may update this policy when the service or legal requirements change. The current version and its update date will always be published on this page. Material changes affecting an operator account may also be communicated by email.