Last updated: 29 September 2026
Controller: Jose Santiago Mateos
Tax ID (NIF): 43565896D
Trade name: AsesMarket
Address: C/ Santiago Rusiñol 2 A, 08760 Martorell (Barcelona), Spain
Email: proyectos@asesmarket.com
Phone / WhatsApp: +34 644 55 14 08
Service: Qarta (cartas.asesmarket.com)
When you fill in the contact form at cartas.asesmarket.com, we collect:
Purpose: to handle your request and contact you with information about Qarta.
Legal basis: pre-contractual measures at the data subject's request (Art. 6.1.b GDPR).
Retention: up to 3 years from when you wrote to us, or until you exercise the right to erasure.
If you subscribe to Qarta, we process your account data (venue name, tax ID, address, phone, administrator email) to deliver the service and issue invoices.
Legal basis: performance of a contract (Art. 6.1.b GDPR).
Retention: for the duration of the contract and 5 years thereafter for tax obligations.
We also process the email address of the people on your team you give access to the panel (you invite them).
Panel login attempts: to stop attacks, we record each attempt to log in (email used, IP address and whether it succeeded). Legal basis: legitimate interest in security (Art. 6.1.f GDPR). They are deleted after one day.
When a diner scans the QR code, the system records:
In the menu analytics, the diner's IP address is not stored: only an HMAC hash computed with a daily salt that is destroyed on rotation is kept (irreversible; re-identification is not possible).
However, as on any web server, the server access logs do contain the IP address. They are kept for 14 days for security purposes: automatically detecting and blocking abusive access attempts to the management panel. After that period they are deleted.
Legal basis: legitimate interest of the service provider (Art. 6.1.f GDPR) to improve the service. Processing is anonymous and does not require prior consent.
Retention: 24 months from the date of the record.
| Processor | Role | Location |
|---|---|---|
| Hetzner Cloud GmbH | VPS hosting where Qarta runs | Germany (EU) |
| Brevo (Sendinblue SAS) | Delivery of the service emails (form notice, welcome, passwords, invitations and billing notices) | France (EU) |
| Stripe Payments Europe, Ltd. | Processing of restaurant subscription payments (not diners'): billing and subscription data | Ireland (EU) |
| Google Ireland Limited | Google Analytics on the Qarta website, only if you accept analytics (not on the menus) | Ireland (EU) |
We do not share your data with third parties for advertising purposes.
All processors are in the EU. If any of them uses providers outside the European Economic Area (Google may do so for analytics), it does so with the GDPR safeguards: the EU-US Data Privacy Framework where applicable, or the European Commission standard contractual clauses.
You may exercise your rights of access, rectification, erasure, objection, restriction, and portability by writing to proyectos@asesmarket.com with the subject "GDPR Rights Request" and a copy of your identity document.
If you believe our processing infringes data protection law, you may lodge a complaint with the Spanish Data Protection Authority (AEPD) at aepd.es.
We make no automated decisions and do not build profiles with your data.
The public menu ({slug}.cartas.asesmarket.com) uses no cookies of any kind. The administration panel uses a strictly necessary session cookie to authenticate the administrator — no tracking or advertising.
The menu stores in the diner's browser (local storage, not a cookie): the language they selected, so the menu opens in that language next time. It identifies no one, is never sent to us, and the diner can remove it by clearing the site data in their browser.
The user guide (/ayuda) does not use cookies either: it only remembers in the browser whether you prefer light or dark mode.
The Qarta website (cartas.asesmarket.com) uses Google Analytics only if you accept it in its cookie notice; before that it sets none. Full details in the cookie policy (in Spanish).
While the diner browses the menu, the “My selection” list is also kept in their browser (session storage): it is not sent anywhere and is deleted when the tab is closed.
We do not use advertising pixels. If we ever add another tool that requires it, we will ask for your permission first.
All communications are encrypted with TLS 1.2/1.3. Passwords are stored with bcrypt (cost 12). Database access is local and not exposed to the internet.