Privacy policy

Data controller

NEW NOMIYA (SARL), which operates the restaurant Nomiya, 211 bis avenue Charles de Gaulle, 92200 Neuilly-sur-Seine. Contact: [TO BE COMPLETED: email address dedicated to GDPR requests], or call +33 1 46 37 49 02.

Data collected and purposes

Online ordering — name, phone number, email address (optional), delivery address and its details (floor, access codes, instructions for the courier), chosen time slot, order contents and notes for the kitchen. At the table, none of this: only the table number and the order contents. This data is used to prepare, deliver or hand over your order, to contact you if something unexpected happens, and to send you the order confirmation and tracking. Legal basis: performance of the contract.

If you mention an allergy in a note, this information is used only to prepare your order. You provide it on your own initiative, which constitutes explicit consent; you can also tell the restaurant by phone.

Online payment, when offered — your card details are entered with Stripe and never pass through our servers. We only receive the payment status and reference. Legal basis: performance of the contract.

Table booking — name, phone number, email address, number of guests, date, time, preferred area, any note for the restaurant. This data is used only to hold your table, to confirm your booking by email and to contact you if something unexpected happens. Legal basis: performance of the contract.

Customer account (optional) — name, email address and password, stored in encrypted form. With “Continue with Google”, there is no password: we receive your name, your email address and your Google account identifier. The account brings together your orders, your bookings, your loyalty points and the addresses you choose to save; it shows the dishes you have already ordered at the top of the menu and fills in your details (name, email, phone and address from your last order). Legal basis: performance of the contract.

Newsletter (optional) — if you agree to it, when signing up or from your account (the box is never ticked in advance), your name and email address are used to send you our news, seasonal set menus and offers. We keep the date of your consent as proof of it. You can unsubscribe at any time from your account or using the link in each email; your data is then no longer used for this purpose. Legal basis: consent.

Sign-in log — sign-ups, sign-ins and sign-outs on your account, with your name and email address and the IP address and browser used, to detect suspicious access and manage accounts. Legal basis: legitimate interest.

Technical logs — IP address and time of requests, for the security of the service and to limit abuse. Legal basis: legitimate interest.

Retention periods

These periods are applied automatically, every day.

• Orders: your contact details (name, phone, email, address, notes) are deleted 3 years after the order; its contents and amount are kept for 10 years for accounting purposes, then deleted.
• Bookings: 12 months after the date of the meal.
• Customer account and saved addresses: until the account is deleted, on simple request. You can remove an address yourself from your account.
• Copies of emails sent: 90 days.
• Sign-in log: 7 days at most.
• Technical logs: deleted on a rolling basis, the oldest being removed beyond 50 MB per service.

Recipients and processors

Your data is processed by the restaurant’s staff. It is neither sold nor passed on to third parties for commercial purposes. Our service providers only access it for the service they provide to us:

• hosting of the website and services: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France · +33 9 72 10 10 07;
• databases: Supabase, Inc. (United States), on servers located in Paris (Amazon Web Services, eu-west-3 region);
• account management and sign-in log: Better Auth, Inc. (San Francisco, United States);
• online payment, when offered: Stripe Payments Europe, Ltd. (Ireland);
• sending of confirmation and tracking emails: Scaleway SAS, 8 rue de la Ville l’Évêque, 75008 Paris, France, on servers located in Paris;

Supabase and Better Auth are American companies: these transfers outside the European Union are governed by the European Commission’s standard contractual clauses. If you choose to sign in with Google, that step takes place with Google, under its own privacy policy.

Cookies

The website sets no advertising or audience-measurement cookies: only those needed to sign in to your account, and your basket is kept in your browser. Details are given in the cookie policy.

Your rights

You have the right to access, rectify and erase your data, to restrict and object to its processing, as well as the right to data portability and to withdraw any consent given at any time. Write to us at [TO BE COMPLETED: email address dedicated to GDPR requests] or call +33 1 46 37 49 02; we reply within one month. You may also lodge a complaint with the CNIL (cnil.fr), the French data protection authority.