Privacy Policy

This policy explains how TORPEDO BITS, S.L. processes the personal data of users of www.recipetor.com, of people who ask about Recipetor, and of its customers. It is drawn up under Articles 12, 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Spanish Ley Orgánica 3/2018 (LOPDGDD).

Did you book a table at a restaurant through Recipetor?
If your data was collected when you booked on the page of a restaurant that uses Recipetor, the controller is the restaurant, not Torpedo Bits. Please read that restaurant's privacy notice and contact it directly. Our role is explained under "In what capacity does Torpedo Bits process your data?".

In short

The controller is TORPEDO BITS, S.L., a Spanish company based in Palma. You can write to us at info@recipetor.com.
We collect browsing data, the contact details you give us and the data of the contractual relationship.
We do not send you marketing without your consent, which you can withdraw at any time.
Analytics cookies are only switched on if you accept them in the banner.
We do not sell your data. We share it only with the providers needed to deliver the service, listed below.
You have the right to access your data, correct it, erase it and object to its processing. We reply within one month.

Who processes your data? · In what capacity? · What data do we collect? · Why, and on what legal basis? · Do you have to give it to us? · Who do we share it with? · Does it leave the EU? · How long do we keep it? · How do we protect it? · Do we use cookies? · Do we collect children's data? · What are your rights? · How do you exercise them? · How do you make a complaint? · Can this policy change?

Who processes your data?

The data controller is TORPEDO BITS, S.L., NIF B72848617, registered office at C/ Nuredduna 22, 1-3, 07006 Palma, Illes Balears (Spain), entered in the Commercial Register of the Balearic Islands, Volume 2981, Folio 95, Section 8, Sheet PM-95535, Entry 1.
For anything concerning your personal data you can write to info@recipetor.com.

In what capacity does Torpedo Bits process your data?

Torpedo Bits processes personal data in two distinct capacities.

As a controller, for the data of site users, of people who ask for information or a trial, and of restaurant customers within the contractual relationship. These are the processing activities described in this policy.

As a processor (Article 28 GDPR), for the data of restaurant guests who book through Recipetor, which we process on behalf of and on the instructions of the restaurant, which is the controller. In particular the booking data (name, phone, email, date, party size, area, special occasion, requests and, if the guest states them, allergies or intolerances), the IP address and browser used to book, and the notifications sent by email or WhatsApp.

In those cases we do not decide the purposes, we do not use the data for our own ends and we do not disclose it to third parties beyond what the Data Processing Agreement signed with the restaurant provides. The providers involved are listed in the annex to the Terms and conditions of service.

What data do we collect?

Browsing data.
When you visit the site we collect your IP address, HTTP header information (referrer and user agent), browser and device type, operating system, date and time of access and pages visited. With your consent we use Google Analytics 4 to measure how the site is used.

Data you give us.
First name, surname, email, phone, restaurant name and the content of the enquiry you send us through the contact or trial forms. To protect the forms from spam, on submission the anti-spam system analyses certain technical characteristics of your browser without storing them.

Contractual data.
For restaurant customers: account data (email, name, phone, address), tax and billing data, payment data, credentials and API keys, service usage data, support requests (including any images attached) and the restaurant data published on the booking page. Full card details never pass through our servers: they are handled directly by Stripe.

Why do we process your data, and on what legal basis?

To run the site securely, preventing abuse, spam and fraud.
Legal basis: our legitimate interest (Article 6(1)(f) GDPR). The technical cookies needed for this do not require consent.

To answer your enquiries about information or a trial and to handle the pre-contractual stage.
Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).

To deliver the service: account registration and approval, running the service, support, invoicing, collection and recurring payments.
Legal basis: performance of the contract (Article 6(1)(b) GDPR) and, for tax and accounting obligations, a legal obligation (Article 6(1)(c) GDPR).

To measure and analyse how the site is used.
Legal basis: your consent, given through the cookie banner (Article 6(1)(a) GDPR), which you can withdraw at any time.

To tell our customers about similar services.
Legal basis: our legitimate interest (Article 6(1)(f) GDPR), under Article 21.2 of Spanish Law 34/2002 (LSSI-CE). Every message lets you object simply and free of charge.

To send you marketing communications, if you give us your consent.
Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

To establish, exercise or defend legal claims.
Legal basis: our legitimate interest (Article 6(1)(f) GDPR).

Do you have to give us your data?

The data needed to answer your enquiries and deliver the service is essential: without it we cannot help you. Providing data for analytics or marketing is optional and does not affect your use of the site or of the service.

We do not sell or publish your personal data. We share it only with the providers needed to deliver the service, who act as processors under Article 28 GDPR unless stated otherwise:

MA-NO Web Design and Development, S.L., a company in the same group — development, managed hosting, technical maintenance, support, receipt of form enquiries and handling of subscription collection;
DigitalOcean, LLC — servers and storage in Frankfurt (Germany);
Hetzner Online GmbH — servers of the email sending gateway (Finland);
Mailjet SAS — backup email delivery;
Cloudflare, Inc. — content delivery network, security and bot verification (Turnstile);
Objectis Ltd (CookieScript) — management of the cookie banner and preferences;
Google Ireland Ltd. / Google LLC — Google Tag Manager and Google Analytics 4;
Stripe Payments Europe, Ltd. — card payments and recurring charges;
BENFATTO, S.L. — WhatsApp channel and booking synchronisation, for customers who switch these features on;
professionals and advisers who carry out administrative, accounting, tax and legal work on our behalf;
public authorities, in the cases provided for by law.

Is your data transferred outside the European Union?

Some providers (Google, Cloudflare, Stripe) belong to groups headquartered in the United States and may process data outside the European Economic Area. Those transfers take place on the basis of the adequacy decision for the EU-U.S. Data Privacy Framework or, failing that, the European Commission's Standard Contractual Clauses (Articles 45 and 46 GDPR).

How long do we keep your data?

Browsing and statistical data: as set out in the Cookie policy, and in any case for no more than 14 months.
Enquiries that do not lead to a contract: for as long as it takes to deal with them, and then for no more than 12 months.
Contractual relationships: for the whole duration of the relationship and then for the limitation periods and the periods required by civil and tax law.
Marketing communications: until you withdraw your consent or object.

How do we protect your data?

We apply the technical and organisational measures of Article 32 GDPR: encrypted communications (HTTPS), passwords stored encrypted, access control, blocking of repeated failed log-ins and backups. If a breach poses a high risk to your rights, we will tell you without undue delay (Article 34 GDPR).

Do we use cookies?

Yes. We use technical cookies and, only with your consent, analytics cookies. You will find the details and how to change your preferences in the Cookie policy.

Do we collect children's data?

No. The service is aimed at professionals, not at children under 16, and we do not knowingly collect their data.

What are your rights?

Under Articles 15 to 22 GDPR you can exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw your consent at any time without affecting the lawfulness of processing carried out before you did so.

How can you exercise your rights?

Write to info@recipetor.com, or by post to TORPEDO BITS, S.L., C/ Nuredduna 22, 1-3, 07006 Palma (Spain), stating which right you wish to exercise. We may ask you to verify your identity.

If your request concerns a booking made at a restaurant, we will pass it on to the restaurant, which is the controller, and help it to answer you.

Exercising your rights is free of charge. We will reply within one month, which may be extended by two further months in complex cases.

Who can you complain to?

You can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), which is the lead supervisory authority because the controller is established in Spain. You may also complain to the supervisory authority of the EU country where you live or work, for example the Garante per la protezione dei dati personali (www.garanteprivacy.it) in Italy.

Can this policy change?

Yes. We may amend it to reflect changes in the law or in the service. The version in force is the one published on this page. If the changes are substantial, we will let you know.

Last updated: 1 October 2026