Privacy policy

Two distinct roles coexist, and confusing them is the most common source of error.

Alcess is the controller for the restaurateur’s account data: identity, email address, tax identifiers, billing, connection logs.

Alcess is a processor for guests’ data: phone number, first name, order history. The restaurant is the controller: it decides to offer a loyalty programme, and it determines the purpose.

In practice: guests leave a loyalty programme themselves from “My space”, on the restaurant’s menu, or ask the restaurant, which has the same tool in its dashboard. Alcess does not, on its own initiative, erase data for which it is not the controller.

From the restaurateur: establishment name, address, public phone and email address, tax identifiers (NIF, NIS, commercial register), account email address, billing details, IP addresses and connection timestamps.

From the guest: phone number, verified by a code, and first name if they join a loyalty programme; the content of their orders, amounts, timestamps; the note they leave for the kitchen and the review they post after the meal, if they do; their consents.

Allergies reported with an order: if the guest or staff indicate them, the list of allergens concerned (out of fourteen, no free text), sent to the kitchen so the order is prepared safely. This is health data: it is not linked to any account.

From staff: first name, hashed access code, assigned permissions, a named log of sensitive operations (discount, refund, drawer opening) and, if the restaurant uses them, clocked hours, schedule and hourly cost (the latter visible to the owner only).

No banking data is processed or stored by Alcess. Payments are handled by an approved provider, which alone handles card numbers.

Performance of the contract: providing the Platform, taking orders, taking payment, producing receipts and closure statements.

Legal obligation: retaining unalterable sales records and the journals required by article 51 bis of the turnover tax code, together with accounting documents.

Consent: loyalty programme, order-ready notifications, marketing messages. Consent is collected separately for each purpose, and is withdrawn as simply as it is given.

Legitimate interest: security of the Platform, fraud prevention, aggregated and non-nominative audience measurement.

Country suggestion at sign-up (legitimate interest): when several countries are offered, the IP address is matched, on our own servers, against a locally installed geolocation database to pre-fill the establishment’s country. The address is sent to no service, the result is not stored, and the suggestion can be freely changed. Database used: IP Geolocation by DB-IP (db-ip.com), under the CC BY 4.0 licence.

Sales data, closures and tax journals: retained for the statutory retention period for accounting and tax records. They cannot be deleted, including on request: erasing them would deprive the restaurateur of the documents they must produce in the event of an inspection.

Loyalty account: until consent is withdrawn, and at the latest three (3) years after the last order.

Number and notes carried by an order: removed two (2) years after the order. The sale remains, without them.

Restaurateur account: for the duration of the contract. An account that does not yet carry any record (no sale, no subscription payment) can be deleted from the dashboard, with immediate effect. Beyond that, deletion is requested in writing, using the contact details in the legal notice; the records the law requires us to keep (sales, closures, invoices) are kept for the legal period.

Sign-in logs: ninety (90) days. They serve only to block repeated attempts against an account.

Allergies reported with an order: two (2) days after the order, then erased at the next run of the clean-up task. They are used for the service only.

Staff time records: not editable (law no. 90-11), kept for as long as the restaurant’s account exists.

An erasure request concerning a sale does not delete the sale: it detaches the customer’s identity from it. The amount, the date and the receipt number remain, because they are the accounting trace of the transaction.

Data is neither sold, nor rented, nor transferred.

It is accessible to the restaurant concerned and its authorised staff, within the limits of the permissions the restaurateur has granted them.

They are disclosed only to the service providers needed to deliver the service, all established in Algeria: hosting provider, licensed payment provider, email delivery service. Each acts on instruction and for the sole purpose assigned to it.

It may be disclosed to administrative or judicial authorities upon a lawful request.

This is the point that calls for the most attention. Transferring personal data to a foreign country is subject to the prior authorisation of the National Authority for the Protection of Personal Data (ANPDP): not to a mere declaration.

The authorisation is assessed in the light of the adequate level of protection in the destination country, respect for fundamental rights and freedoms, the existence of a supervisory authority in that country and the security measures applied.

All data is hosted in Algeria: the application, the database, files, rate limiting, error reporting and email delivery run on servers located in Algeria. No personal data is transferred outside Algeria, and no transfer authorisation is therefore required.

The only planned exception: the photo of a restaurant menu, sent to read its dishes (OpenAI). It contains no personal data: this is the condition that allows this processing outside Algeria.

Alcess undertakes to carry out no transfer outside the authorised framework, and to keep this page up to date with every change.

Encryption in transit for all exchanges, and encryption at rest of payment providers’ secrets.

Strict separation of data between establishments, enforced at database level rather than in the interface: an interface-level guard can be bypassed.

Second authentication factor for dashboard access, and re-authentication required before any operation touching bank details.

Named logging of sensitive operations, itself unalterable.

You have a right of access, rectification, objection, erasure and restriction of processing, together with a right to the portability of your data.

You may withdraw a consent at any time, without calling into question the lawfulness of processing already carried out.

For a loyalty account: leave the programme from “My space”, on the restaurant’s menu — number, first name, points and consents are erased, your receipts remain without your identity. The restaurant can also do it at your request.

For a restaurateur account: the request is made from the account settings, or in writing to the details shown in the legal notice.

Data protection officer: their appointment is mandatory (art. 41 bis) and takes place with the company’s registration; their contact details will appear on this page. Until then, requests are addressed to the details shown in the legal notice.

A reply is given within one (1) month. That period may be extended if the request is complex; you are then informed.

In the event of a personal data breach, the ANPDP is informed within five (5) days of becoming aware of it: a period shortened by law no. 25-11.

The persons concerned are warned without delay where the breach is likely to result in a high risk to their rights and freedoms.

The notification describes the nature of the breach, the categories and approximate number of persons concerned, the likely consequences and the measures taken.

A register of processing activities is being established, as required by article 41 bis 2 of law no. 18-07 as amended by law no. 25-11; it will be kept up to date by the data protection officer as soon as they are appointed.

Access to sensitive data and operations involving money are recorded in an unalterable audit log, retained and admissible.

No decision producing legal effects is taken on the sole basis of entirely automated processing.

The Platform uses only trackers strictly necessary to its operation: keeping the session, the current basket, the chosen language.

No advertising tracker, no sharing with an ad network, no profiling for targeting purposes.

Any audience measurement is aggregated and does not allow a person to be re-identified.

If you consider that your rights are not being respected, write to us first: a reasoned reply will be sent to you.

You may, at any time and without any prior step, refer the matter to the National Authority for the Protection of Personal Data (ANPDP), the independent administrative authority responsible for overseeing the application of the law.