Privacy Policy

Scope and roles

YingYang | Tech, operating in Portugal, is the controller for the website, business enquiries and the data needed to manage platform accounts, security, contracts and support. Contact us at contacto@techyingyang.com.

In Foods, each restaurant is normally the controller for its customers’, workers’ and operational data. YingYang acts as processor to deliver and protect the service under the contract and documented instructions. The restaurant remains responsible for its purposes, legal bases, notices and requests concerning its store.

Data we process

For the website, we receive your name, email, company, product of interest, message, optional telephone number, marketing choice and minimal technical security logs.

In Foods, depending on the features used, we process team accounts and roles; restaurant, catalogue and device settings; orders, tables and delivery details; phone and address where needed; products, values, discounts and history; payment method, amount and operational reference; optional profiles and consents; tax information; sessions, devices and audit records. We do not store full card numbers, CVVs or expiry dates.

Free-text fields should contain only what is needed. Do not enter passwords, full card details, identity documents or unnecessary sensitive data.

Table QR name

A name entered through a table QR identifies that person’s tickets for the table, kitchen, bar, waiter and POS. The opaque browser token is held in a protected cookie and expires within 12 hours or when the table session ends. The name and order link may remain in operational history for the applicable order-retention period, but do not by themselves create a full profile or permit marketing.

FIZ tax integration

FIZ is optional and remains off until an authorised restaurant user completes OAuth. FIZ displays the requested permissions before approval. The restaurant may decline or revoke access without losing non-tax Foods features.

When enabled, the integration may send company, series and CAE information, catalogue and VAT data, tax-customer details, lines, discounts, payments, totals and document identifiers needed to manage tax documents. Foods may retain statuses, identifiers, PDFs and reconciliation, audit and printing metadata. Tokens are protected and used only server-side. Disconnecting prevents new actions but does not erase records subject to statutory retention. FIZ applies its own terms and privacy policy to data it receives.

Purposes and lawful bases

We process data to answer enquiries and requested pre-contractual steps; provide, support and charge for the service; authenticate users, prevent abuse and defend rights; comply with legal, accounting and tax obligations; and send marketing only under separate, withdrawable consent.

Where YingYang acts for a restaurant, the restaurant determines the lawful basis for customer processing. YingYang does not sell this data or reuse it for its own advertising.

Recipients and international transfers

Access is limited to authorised people at YingYang and the restaurant. We use necessary hosting, infrastructure and email providers, currently including Hostinger. FIZ receives data only when enabled. Authorities may receive data where required by law or the defence of rights.

We favour processing in the European Economic Area. If a provider processes data in a country without an applicable adequacy decision, we require an appropriate mechanism such as standard contractual clauses and proportionate supplementary measures.

Retention

Enquiries that do not lead to a business relationship are reviewed and deleted within 24 months. Marketing choices last until withdrawal, while evidence may be kept as needed. Accounts, sessions, orders, payments, audit records and operational data follow the service term, restaurant instructions, security needs and applicable statutory or limitation periods.

Accounting and tax records may remain after a deletion request where the law requires it. Backups rotate under their retention cycle; if restored, deletions already due are reapplied.

Security and incidents

Controls include HTTPS, tenant isolation, role-based permissions, credential hashing, encryption of FIZ tokens, request protections, audit records, backup and recovery. No system removes all risk; suspected events are investigated and notified to the restaurant, individuals or authorities where required.

Your rights

You may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. We may verify identity, and statutory duties may limit some requests.

For data held by a Foods store, contact the restaurant first. For the website, contract, platform account or security, email contacto@techyingyang.com. You may also complain to the competent data protection authority. We do not use this data for solely automated decisions with legal or similarly significant effects or for advertising profiles.