Socialeat Back to home

For venues (Socialeat Manager) · In force from 2026-09-29 · version 2026-09-29

This is a translation: in case of differences, the Italian version prevails.

NOTICE ON THE PROCESSING OF PERSONAL DATA

Socialeat Manager · App and web features dedicated to Businesses, venues and their staff

Consolidated version · 29 September 2026

This notice concerns Socialeat Manager. Socialeat Manager is intended for professional use by Businesses, owners, legal representatives and authorised staff.

1. Data controller and contacts

The Data Controller is Socialeat S.r.l., with registered office at Via G. Compagnoni 26, Milan, VAT no. and tax code 13257270960. E-mail: info@socialeat.net. Privacy contact: privacy@socialeat.net. Data Protection Officer: info@socialeat.net.

2. Who this notice is for

This notice applies to the natural persons who use Socialeat Manager on behalf of a Business: owner, legal representative, Manager account administrator, venue manager, employee, collaborator or other authorised staff member. Data relating purely to a company or other legal entity are not personal data in themselves; they become relevant for privacy purposes when they concern or identify a natural person, for example the legal representative, a contact person or an employee.

3. Purposes of Socialeat Manager

Socialeat Manager allows Businesses to create and manage one or more venues, complete the related onboarding, publish and administer shared tables and venue content, receive and manage bookings, organise staff with roles and permissions, consult statistics and use the operational features made available by the platform.

4. Categories of data processed

Category Examples
Manager account First name, last name, e-mail, telephone where requested, authentication credentials/identifiers, language, account status, date and time of registration and access.
Business data Company name, trading name, VAT no./tax code, registered office, business contacts, data of the legal representative or contact person, any documents needed to verify the Business.
Venue data Venue name, address, coordinates, contacts, description, opening hours, photos, menus, services, public and operational information, approval/publication status.
Tables and promotions data Shared tables, seats, dates/times, availability, rules, discounts/promotions, changes and publication status.
Bookings and attendance Identifiers of the Customer users needed for the booking, event/table, booking status, confirmation/cancellation, attendance/no-show and other operational information needed for management.
Staff and permissions Name, e-mail, role, associated venues, permissions, invitations, invitation status, access, revocations and history of authorisation changes.
Usage and audit data IP, device, operating system, app version, timestamp, access logs, relevant actions performed on bookings, tables, venues, staff and settings.
Support and communications Requests to support, content of communications, attachments and information needed to handle the ticket.
Operational statistics Aggregated or summary data on bookings, cancellations, attendance, tables, performance and use of the service.
Billing/payment data Payments and charges through Socialeat Manager are currently suspended; entering a payment method is not required for registration or current use of the Manager.
Purpose Legal basis Retention
Registration and management of the Manager account Performance of the contract / pre-contractual measures For the life of the account and afterwards for the period needed for technical closure, security and protection of rights.
Verification of the Business and approval of the venue Performance of the contract and legitimate interest in the security and reliability of the platform For the duration of the relationship and, for the necessary documents, for the period required by legal obligations or disputes.
Management of venues, tables, menus, promotions and content Performance of the contract As long as the content remains active, then for the period needed for technical archiving, security and protection of rights.
Management of bookings and attendance Performance of the contract; legitimate interest in preventing abuse and handling disputes For the period needed for operational management, the service history and protection in case of disputes.
Management of staff, invitations, roles and permissions Performance of the contract; legitimate interest in security As long as the access relationship is active and afterwards for a period proportionate to audit and security needs.
Security, logging, prevention of abusive access Legitimate interest; GDPR security obligations For a period proportionate to the risk, to security and to the applicable obligations.
Support Performance of the contract / legitimate interest For the time needed to resolve the request and to document how the relationship was handled.
Statistics and service improvement Legitimate interest, with preference for aggregated or pseudonymised data Aggregated data may be kept without direct references to persons; individual data only for the time needed for the purpose.
Promotional communications Consent, when used Until consent is withdrawn or the purpose ends.
Legal obligations and litigation Legal obligation / establishment, exercise or defence of rights For the periods provided by law or needed to protect rights.

6. Registration, verification and approval of the Business

Registration to the Manager requires the data needed to identify the person who creates the account and the Business on whose behalf they act. Socialeat may check the consistency of the data provided and request information or documents needed to verify the Business and the venue.

In the current flow, the venue and its tables remain unpublished until onboarding is completed and Socialeat approves them. Setting up the first shared table is part of the operational process of completing the venue profile before publication.

7. Customer and Manager accounts with the same e-mail

The same person may use the same e-mail address for a Socialeat Customer account and for Socialeat Manager access. The two environments remain separate in terms of purposes, roles, authorisations, operational credentials and legal acceptances. Accepting the Customer Terms does not replace accepting the Manager Terms, and vice versa.

8. Staff, invitations, roles and permissions

The Business administrator may invite staff members and assign them one or more venues and the permissions provided by the system. Manager invitations have a limited duration and, in the current flow, the invitation code or link expires after 14 days if not used, or earlier if revoked.

Each staff member has personal access: credentials must not be shared. Authorisations may be changed or revoked by the Business. Socialeat records the relevant operations for security, audit and reconstruction of the activities carried out in the Manager.

9. Customer users’ data visible in the Manager

The Manager shows Businesses only the Customer users’ data needed to manage bookings, tables, attendance, cancellations, operational communications and related features. Such data may not be used freely for purposes unrelated to the booking or to the relationship with the customer.

When the Business independently determines further purposes and methods of use of its customers’ data - for example independent archiving, its own commercial contacts or exports outside the platform - it acts as an independent data controller and must directly comply with the obligations laid down by the GDPR and the applicable legislation.

10. Privacy roles between Socialeat and the Business

Socialeat acts as controller for the processing needed to provide, protect and administer the Manager platform, manage accounts, security, venue approval, logs and the features of the service. The Business acts as an independent controller when it uses the data for purposes determined directly by its own organisation.

For any specific processing that Socialeat carries out exclusively on behalf of the Business according to documented instructions, the relationship is governed by the rules of Article 28 GDPR and by the applicable contractual documents.

11. Data on attendance, cancellations and no-shows

The Manager may allow the attendance or absence of users who had booked to be recorded. This information is processed for booking management, operational statistics, abuse prevention, support and dispute handling. The Business is required to record such statuses correctly and in a non-discriminatory manner.

12. Payments temporarily suspended

At the time of this version, payments, automatic charges and the collection of fees through Socialeat Manager are suspended. Registration and current use of the Manager do not require entering cards, IBAN or other payment instruments.

If in the future Socialeat reactivates a payment, commission, subscription or other form of consideration, the Business will receive clear information on the applicable economic conditions before activation. Any processing of new payment data will be governed by the updated privacy documentation and by the related commercial conditions.

13. Operational communications and marketing

Socialeat may send communications strictly necessary for the Manager relationship: account/venue verification and approval, staff invitations, password resets, security, bookings, operational changes, support and technical notices. Such communications are not marketing.

Optional promotional or commercial communications are handled separately and, when based on consent, can be switched off at any time without affecting ordinary use of the Manager.

14. Recipients of the data

15. Transfers of data outside the EEA

When providers are used for the service that involve processing or access from countries outside the European Economic Area, Socialeat applies the transfer mechanisms provided by Articles 44-49 GDPR, including adequacy decisions, Standard Contractual Clauses and supplementary measures where necessary.

16. Security and access control

Socialeat adopts technical and organisational measures appropriate to the risk, including access control, segregation by roles and venues, protection of credentials, logging of relevant operations, backup procedures and incident management. The Business must keep staff permissions up to date and revoke access that is no longer needed without delay.

17. Data breach

In the event of a personal data breach, Socialeat applies the procedures provided by Articles 33 and 34 GDPR, including risk assessment, notification to the supervisory authority where applicable and, when required, communication to the data subjects.

Businesses are required to cooperate promptly when an incident involves accounts, credentials or data managed through the Manager.

18. Rights of data subjects

Requests can be sent to privacy@socialeat.net or info@socialeat.net. The exercise of rights concerns the personal data of the natural person using the Manager; data relating purely to the company remain governed by the contractual relationship with the Business.

19. Account deletion, staff removal and end of the relationship

Removing a staff member revokes their access to the Manager but does not automatically delete the logs and information that must be kept for security, audit or the protection of rights. Deletion of the main account or of the venue follows the Manager’s procedures and does not entail the deletion of data that must be kept for legal obligations or disputes.

20. Privacy by design and data minimisation

The Manager must show each staff member only the information consistent with the venues and permissions assigned to them. Socialeat and the Business must avoid collecting unnecessary data and limit access to, exports and uses of Customer data to what the operational purposes require.

21. Languages

Socialeat Manager is available in Italian and in English. The Manager user can choose the language during registration and change it later. The Privacy Notice is made available in the selected language; the Italian version is the reference text in case of differences in interpretation, to the extent permitted by law.

22. Updates to this notice

Socialeat may update this notice for regulatory, organisational or functional changes. Substantial updates are communicated through the Manager, by e-mail or by another suitable channel. When a new purpose requires consent, the related processing is not activated before valid consent has been obtained.