Privacy, GDPR & Data Protection Policy

1Data Collection & Sovereign Storage

When you configure a scope or when your diners place orders through your direct systems, we collect operational data: business contact information, venue locations, diner names, delivery addresses, order selections, and WhatsApp/phone numbers.

Storage Architecture: Primary customer databases are hosted on secured, dedicated on-premise Ubuntu servers located in the United Kingdom, protected behind Cloudflare Zero-Trust edge tunneling.

2Communication, Internal & Cross-Promotions Transparency

We adhere to strict transparency regarding the utilization of customer phone numbers and contact channels:

• Main Focus (Internal Promotions): The vast majority (the "main chunks") of promotional messaging is strictly dedicated to your own venue: order status updates, loyalty reward alerts, new menu launches, and re-order reminders.
• Curated Local Cross-Promotions: To accelerate mutual business growth, occasional partnerships with vetted, non-competing local businesses (e.g., local events, community perks, or complementary beverage/dessert brands) are permitted. Every message clearly identifies the originating venue and contains a 1-tap unsubscribe command (e.g. reply STOP).
• No Spam / Third-Party Reselling: Customer contact records are never sold, rented, or traded to generic cold telemarketers or third-party lead brokers.

3Zero-Trust Access & Brute-Force Immunity

Security is engineered from the protocol layer up:

• Zero-Trust Logins: Staff and administrative access utilizes identity-verified, least-privilege Zero-Trust authentication sessions. No public database or administrative ports are exposed to the open internet.
• Cryptographic Password Hashing: Passwords are never stored in plain text. All credentials utilize adaptive, salted hashing functions (Argon2id / bcrypt cost factor 12+).
• Multi-Layer Brute-Force Defenses: Cloudflare edge WAF rules, intelligent rate limiting, and fail2ban heuristics automatically identify and blacklist malicious automated brute-force attempts within seconds.

4Restaurant Owner Freedom of Choice & Data Portability

Unlike third-party aggregator monopolies that lock your data away from you, Marketricks champions restaurant sovereignty:

• Full Data Export: You can export your full customer and sales history to standard CSV/JSON at any time.
• Right to Erasure (GDPR Art. 17): Any customer or venue requesting complete data erasure is processed within 72 hours across all primary databases and backups.
• No Hostage Contracts: You retain ownership of your domain, your customer relationships, and your brand assets.