How we process your guests’ data for you

For the personal data of your guests and of the customers in data you bring in from connected platforms, you are the controller and we are your processor. Our privacy policy at 86d.io/en/privacy-policy describes the data we control ourselves, such as your staff’s console accounts and the payment records we keep under our own legal obligations.

We process personal data to provide 86d to you, for as long as your account is open and then as set out in clause 10, and to meet our own legal obligations, such as keeping payment records; for that we decide ourselves, as set out in our privacy policy. Records of the charges made on our own Stripe account, with the billing details on them, we keep as controller under the Accounting Act; the payment status and details we show you, we process for you.

• Purpose: Taking orders, reservations and memberships; running your loyalty programme, gift cards and wallet passes; recording payments; bringing in and showing your sales, orders and payouts from Wolt, Bolt and CompuCash
• People: Your guests and members; people who receive a gift; visitors to your restaurant pages; the customers in your Wolt, Bolt and CompuCash data
• Data: Names, email addresses, phone numbers, birthdays, sign-in details, marketing preferences, orders and their notes, reservations and requests, loyalty points, visits and spend, membership and gift card details, payment records and billing details from Stripe (no card details), IP addresses, delivery addresses and comments from Wolt, CompuCash receipts with their items and the client card used, which can carry the card holder’s personal identification code, and device identifiers for wallet passes
• Special categories: None intended. Free-text notes may contain health information, such as allergies, if your guests write it there

We process the data only on your documented instructions: these terms, your choices in the console, and written requests to hello@86d.io from an owner or administrator of your account. If an instruction would break data protection law, we tell you and need not follow it. If a law requires us to process the data otherwise, we tell you first, unless that law forbids it. If an authority asks us for your data, we refer it to you and tell you, unless the law forbids it.

We keep a record of the processing we carry out for you.

Everyone at 86d with access to your data is bound to keep it confidential, and only people who need access for their work have it.

We protect the data with these measures (GDPR Article 32), and keep them at least at this level for as long as we process your data:

You authorise the providers listed under "Providers that handle restaurants’ data" in "Who we share data with" in our privacy policy, except those marked there as deciding for themselves (Apple for wallet passes; Google for address search in the console, wallet passes, and fonts and maps on restaurant pages), which receive data through those features and are controllers under their own policies, not our sub-processors. We bind each authorised provider by a written processing agreement that protects your data at least as these terms do, and we remain responsible to you for them.

We tell you by email at least 30 days before we add or replace such a provider. If you object on reasonable data protection grounds, we try to find a solution with you; if we cannot, you may close your account before the change takes effect.

We transfer data outside the European Economic Area only with a safeguard that the GDPR recognises: the EU-US Data Privacy Framework, or the European Commission’s standard contractual clauses (Module 3, processor to processor), as set out for each provider in our privacy policy. You can ask us for a copy.

When a guest asks you to see, correct, export, restrict or delete their data, or objects to its use, write to hello@86d.io, and without undue delay we find that guest’s data in 86d and export, correct or delete it, or stop using it, as you instruct, so you can answer within the month the law gives you. If a guest asks us directly, we pass the request to you without undue delay and do not answer it ourselves unless you ask us to.

If we become aware of a personal data breach affecting your data, we tell you without undue delay and no later than 48 hours after, with the nature of the breach, the people and records affected, the likely consequences and what we are doing about it, and updates as we learn more. We help you with data protection impact assessments and prior consultation with the authority where they concern our processing, with your own security obligations, and with telling your guests about a breach where the law requires.

Before your account closes, you can ask us at hello@86d.io for an export of your data in a machine-readable format. If we close your account, we tell you 30 days before, and you can still ask for an export. After closing, we delete your data from 86d; copies stay in our encrypted backups until they expire, within 35 days, and in our providers’ logs, which delete them on their own schedules. We keep only what the law requires us to keep, such as payment records under the Accounting Act, and only for as long as it requires.

We give you the information you need to show that these terms are met, and answer your written questions at hello@86d.io. If those answers are not enough, you or an auditor bound by confidentiality may audit our processing once a year, and also after a breach affecting your data or whenever a supervisory authority requires it, with 30 days’ notice (less after a breach) and at your cost.

You allow us to combine figures about your sales, orders and payouts with other restaurants’ figures into anonymised statistics, to show you and other restaurants how they compare; for this step we decide the purpose ourselves, as our privacy policy says. We use no names or contact details for this, and no figure shows a single guest’s record. Each figure covers at least five restaurants and identifies no person and no single restaurant. Once anonymised this way, the figures are no longer personal data and these terms no longer apply to them. Because this step is ours, your privacy notice should tell guests that their order and payment figures, without names or contact details, may go into 86d’s anonymised statistics.

You make sure you may lawfully collect your guests’ data and have us process it, that your guests get the information the law requires (including your own privacy notice), and that you have your guests’ consent where it is needed, for example before you send them marketing. New members have notifications switched on; a default setting does not show that a guest chose it, so before you send marketing, rely only on consent you can show. A Google Maps map on your page loads Google’s content and cookies when the page opens; if you add one, you are responsible for any consent the law requires. If you ask guests for health information, such as allergies, you need a lawful condition for it (GDPR Article 9).

Each party is liable to the other for direct damage it causes by breaching these terms. Neither is liable for lost profit or other indirect loss, unless caused intentionally or by gross negligence. This does not limit anyone’s rights under Article 82 of the GDPR.

We tell you by email at least 30 days before a material change to these terms takes effect. If you do not agree, you may close your account before then. The same notice and right apply if 86d OÜ or its business is sold or merged and your data would pass to the new owner. The date of the last change is at the top of this page.

• 27 October 2026: Updated: wording.
• 24 October 2026: Updated: providers, backup retention and wording.
• 23 October 2026: Updated: providers and wording.
• 22 October 2026: First published.

These terms are governed by Estonian law. Disputes go to Harju County Court (Harju Maakohus), unless the law requires otherwise. Questions: hello@86d.io.