Last updated: 19 August 2026
Controller: Jose Santiago Mateos
Tax ID (NIF): 43565896D
Address: Martorell (Barcelona), Spain
Email: proyectos@asesmarket.com
Phone / WhatsApp: +34 644 55 14 08
Service: Qarta (cartas.asesmarket.com)
When you fill in the contact form at cartas.asesmarket.com, we collect:
Purpose: to handle your request and contact you with information about Qarta.
Legal basis: pre-contractual measures at the data subject's request (Art. 6.1.b GDPR).
Retention: up to 3 years from the last contact, or until you exercise the right to erasure.
If you subscribe to Qarta, we process your account data (venue name, tax ID, address, phone, administrator email) to deliver the service and issue invoices.
Legal basis: performance of a contract (Art. 6.1.b GDPR).
Retention: for the duration of the contract and 5 years thereafter for tax obligations.
When a diner scans the QR code, the system records:
In the menu analytics, the diner's IP address is not stored: only an HMAC hash computed with a daily salt that is destroyed on rotation is kept (irreversible; re-identification is not possible).
However, as on any web server, the server access logs do contain the IP address. They are kept for 14 days for security purposes: automatically detecting and blocking abusive access attempts to the management panel. After that period they are deleted.
Legal basis: legitimate interest of the service provider (Art. 6.1.f GDPR) to improve the service. Processing is anonymous and does not require prior consent.
Retention: 24 months from the date of the record.
| Processor | Role | Location |
|---|---|---|
| Hetzner Cloud GmbH | VPS hosting where Qarta runs | Germany (EU) |
| Brevo (Sendinblue SAS) | Transactional email delivery (request confirmation, welcome email) | France (EU) |
| Stripe Payments Europe, Ltd. | Processing of restaurant subscription payments (not diners'): billing and subscription data | Ireland (EU) |
We do not share your data with third parties for advertising purposes.
You may exercise your rights of access, rectification, erasure, objection, restriction, and portability by writing to proyectos@asesmarket.com with the subject "GDPR Rights Request" and a copy of your identity document.
If you believe our processing infringes data protection law, you may lodge a complaint with the Spanish Data Protection Authority (AEPD) at aepd.es.
The public menu ({slug}.cartas.asesmarket.com) uses no cookies of any kind. The administration panel uses a strictly necessary session cookie to authenticate the administrator — no tracking or advertising.
The menu does store one single item in the diner's browser (local storage, not a cookie): the language they selected, so the menu opens in that language next time. It identifies no one, is never sent to us, and the diner can remove it by clearing the site data in their browser.
All communications are encrypted with TLS 1.2/1.3. Passwords are stored with bcrypt (cost 12). Database access is local and not exposed to the internet.