Last updated: 2026-06-25
This Privacy Policy explains how Best Eats ® (Best Eats ®) collects, uses and protects the information of Users of the Platform. Best Eats ® is a free service that lets people discover and vote for the best dish at each restaurant in Portugal. We respect your privacy and are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act (CCPA/CPRA), Brazil's LGPD, Quebec's Law 25, the Swiss FADP, and other applicable local laws.
You must be at least 16 years of age to use our Service. We do not knowingly collect or process personal data from individuals under 16.
1.1 This document uses the same terminology as our Terms of Service. This Privacy Policy governs the collection, use and storage of Information obtained from Users through the use of our Site.
1.2 Information about Users is divided into personally identifiable Information and non-personally identifiable Information depending on whether it can identify the User as a specific person.
1.3 Best Eats ®, located at Portugal, has the position of "Controller" as defined in the GDPR (and the equivalent role of "business" under the CCPA/CPRA, "controller" under the UK GDPR, and "operator" under Quebec Law 25) and is responsible for compliance with the principles relating to the processing of personal data. We can be contacted at [email protected].
Under GDPR Article 6, we process your personal data based on the following legal grounds:
- Contract performance (Article 6(1)(b)) — to create your account and provide the voting and ranking features of the Service;
- Legitimate interest (Article 6(1)(f)) — to improve our Service, keep rankings fair, prevent abuse and ensure security;
- Consent (Article 6(1)(a)) — for optional features such as non-essential cookies and analytics;
- Legal obligation (Article 6(1)(c)) — to comply with applicable legal requirements and lawful requests.
You have the right to withdraw consent at any time where processing is based on consent.
3.1 We collect only what is necessary to provide the Service. Categories of personal Information collected include:
- Email address
- Username and public display name
- Profile data received from third-party OAuth providers (Google) — limited to what you authorize during the sign-in flow (typically name, email address and profile picture)
- IP address
- The votes you cast and the dishes you pick
- Any restaurant or dish submissions and other content you contribute
(A) Account and Authentication Data
3.2 We use Google Sign-In (OAuth) to authenticate you. When you sign in with Google we receive basic profile information (name, email address and profile picture) limited to what you authorize. We do not receive your Google password. We use this data to create and secure your account and to send you account, security and service notifications.
3.3 We use a third-party data processor for transactional email delivery. This processor acts as a data processor within the meaning of the GDPR, while we remain the data controller, and operates under appropriate Data Processing Agreements (DPAs) and recognised cross-border safeguards.
(B) Username and Public Profile
3.4 Your username, display name and your public voting activity (such as the dishes you have voted for) may be visible to other Users on your public profile and within rankings. Do not include information in your username or display name that you do not want to be public.
(C) IP Address
3.5 We log IP addresses on a need-to-know basis (sign-in, account creation, voting) to protect the integrity of the Site and our databases. IP addresses help us with abuse and fraud prevention (for example, detecting vote manipulation), service optimization, security and legal compliance.
(D) Votes and Contributions
3.6 The votes you cast, the dishes you pick and any restaurant or dish submissions you make are stored to provide and aggregate the rankings, to enforce the rule of one vote per user per restaurant, and to prevent abuse and maintain ranking integrity.
3.7 We do not sell or share personal Information in the senses defined by the CCPA/CPRA. Information is used for internal purposes only and processed in compliance with the GDPR and applicable local laws. We comply with legal requirements and lawful court orders.
4.1 The Site automatically collects general technical data when a User or automated system accesses the Site. This data is stored in server log files and includes:
- Browser type and version
- Operating system of the accessing device
- Referrer website (the site from which you arrived)
- Sub-pages accessed within our domain
- Date and time of access
- Approximate region derived from IP address
- Screen resolution and device type
- Language preferences
- Other technical data necessary for system security
4.2 This non-personal information is collected to deliver the correct content, optimize user experience, improve performance, maintain security, generate aggregate statistics, prevent abuse and comply with legal requirements.
4.3 Anonymous server log data is stored separately from personal data where feasible.
5.1 Storage and security. Servers and backups are operated by our infrastructure providers. We use industry-standard encryption at rest and in transit and restrict access to authorized personnel only.
5.2 International transfers. Some of our service providers (for example, authentication, mapping and content-delivery providers) are located in the United States or other countries outside the European Economic Area (EEA), the United Kingdom or Switzerland. Cross-border transfers are made only:
- to countries covered by an adequacy decision of the European Commission, the UK government or the Swiss Federal Council; or
- under the European Commission's Standard Contractual Clauses (SCCs); or
- under the UK International Data Transfer Addendum to the SCCs (or the IDTA, where applicable); or
- under the Swiss-specific addendum to the SCCs.
5.3 Records of processing. Records are maintained as required by GDPR Article 30.
6.1 Account data.
- Active accounts: data retained while the account is active.
- Deleted accounts: personal data removed within 30 days; backups may retain data for up to 90 days for disaster recovery before complete removal.
6.2 Anonymization. We may anonymize rather than completely delete certain operational data (such as aggregate vote counts) to preserve the integrity of rankings, prevent abuse and prevent banned-User circumvention.
6.3 Anonymization methods. Personal identifiers are removed, data is transformed into non-reversible hashes where appropriate, and behavioral data is aggregated statistically.
6.4 Non-account data.
- Security logs: 90 days
- Analytics data: anonymized after 14 days
6.5 Inactive accounts. Accounts inactive for 3 years or more may be deleted after notice to the registered email address.
7.1 You have the following rights regarding your personal data:
- Right of access (Article 15) — confirmation of processing, access to your personal data and information about purposes, categories and recipients.
- Right to rectification (Article 16) — correction of inaccurate or incomplete data.
- Right to erasure / "right to be forgotten" (Article 17) — deletion when the data is no longer necessary, you withdraw consent, you object to processing without overriding grounds, or processing was unlawful.
- Right to restriction (Article 18) — temporary limitation of processing.
- Right to portability (Article 20) — receive your data in a structured, machine-readable format and transmit it to another controller where technically feasible.
- Right to object (Article 21) — to processing based on legitimate interests.
- Right to withdraw consent — at any time where processing is based on consent.
7.2 To exercise any of these rights, email [email protected] from the email address registered on your account. We respond within 30 days (extendable by 2 additional months for complex requests). We may request additional information to verify your identity. There is no fee for standard requests; we may charge a reasonable fee or refuse manifestly unfounded or excessive requests.
7.3 Automated decision-making. Best Eats ® does not use solely-automated decision-making that produces legal or similarly significant effects on you in the sense of GDPR Article 22. We do run automated abuse and fraud-detection signals on account creation, sign-in and voting activity (for example, rules that detect vote manipulation and may place an account under review). You have the right to contest the outcome of such a signal and to obtain human review by contacting [email protected] or [email protected].
7.4 Complaint right. You have the right to lodge a complaint with your local data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD). EU users can find the relevant authority at https://edpb.europa.eu/about-edpb/board/members_en. UK users may contact the Information Commissioner's Office (ICO). Swiss users may contact the FDPIC.
In addition to the GDPR rights described above, you may have additional or equivalent rights depending on your country or state of residence. Where these rights overlap with GDPR rights, exercising one is sufficient.
8.1 California, Virginia, Colorado, Connecticut, Utah and other US states
If you are a resident of California, you have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Residents of other US states with comparable consumer-privacy laws have substantially similar rights:
- Right to know what personal information we collect, the categories of sources, the purposes of collection, and the categories of recipients.
- Right to access a copy of the personal information we hold about you, in a portable format.
- Right to delete your personal information, subject to legal exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of "sale" or "sharing" of personal information. Best Eats ® does not sell or share personal information for cross-context behavioral advertising.
- Right to non-discrimination — we will not deny the Service or provide a different level of quality because you exercised a privacy right.
We do not knowingly sell or share the personal information of consumers we know to be under 16.
8.2 United Kingdom
The UK GDPR and the Data Protection Act 2018 mirror the EU GDPR rights described in §7. UK residents may complain to the Information Commissioner's Office (https://ico.org.uk).
8.3 Brazil — LGPD
Residents of Brazil have rights under the Lei Geral de Proteção de Dados (Lei nº 13.709/2018) that substantially mirror the GDPR rights. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD).
8.4 Quebec — Law 25
Residents of the Province of Quebec, Canada have rights under An Act respecting the protection of personal information in the private sector (as amended by Law 25), including the right to access, correct, withdraw consent and request portability. Complaints may be filed with the Commission d'accès à l'information (CAI).
8.5 Switzerland
Residents of Switzerland have rights under the revised Federal Act on Data Protection (revFADP), including access, rectification, deletion and portability. The competent authority is the Federal Data Protection and Information Commissioner (FDPIC).
8.6 Other jurisdictions
Residents of Australia (Privacy Act 1988 / APPs), Singapore (PDPA), and other jurisdictions with comparable frameworks may exercise similar access, correction and complaint rights by contacting [email protected].
9.1 We use cookies and similar technologies to maintain session information, remember your preferences, analyze Site traffic, improve performance, provide security features and enable essential functionality.
9.2 Cookie types.
- Essential cookies (always active) — session management, security features, user authentication. Disabling them prevents you from using the Site.
- Functional cookies (optional) — language preferences, theme settings and UI customization.
- Analytics cookies (optional) — usage statistics and performance monitoring, loaded only with your prior consent where required.
9.3 You can manage cookie preferences through your browser settings or, where offered, through a cookie consent banner.
9.4 Do Not Track and Global Privacy Control. Industry consensus on how websites should respond to raw "Do Not Track" signals has not been finalised, so Best Eats ® currently does not respond to raw DNT signals. We honour the Global Privacy Control (GPC) browser signal where applicable.
10.1 Operational processors.
- Authentication. Google Sign-In (OAuth) — used to authenticate you and obtain basic profile data you authorize. Google's own privacy policy applies to its processing.
- Maps and places. Google Maps Platform and Google Places — used to display maps and to look up restaurant locations and details. Google's own privacy policy applies to its processing.
- Email delivery. A transactional email provider — used to send account, security and service emails under a Data Processing Agreement.
- Hosting and content delivery. Our infrastructure providers and Cloudflare — used to host the Service and deliver it securely and reliably.
10.2 We do not use advertising, retargeting or conversion-tracking pixels.
10.3 External links. We are not responsible for external websites linked from the Site. Users should review the privacy practices of any external service before submitting information.
10.4 Data Processing Agreements. Third-party processors operate under signed DPAs (or equivalent contractual safeguards), comply with the GDPR and applicable local laws, and implement appropriate security measures.
11.1 We send service-related communications (security alerts, important updates and policy changes) on the basis of contract performance and legal obligation. If we ever offer optional newsletters or product announcements, we send them only to Users who have opted in, with an easy opt-out at every contact.
11.2 You can manage notification settings in your account, or opt out of optional communications at any time by emailing [email protected]. Opting out of optional communications does not affect essential service and security communications.
12.1 Technical security. SSL/TLS encryption in transit, encryption at rest for sensitive data, regular security reviews and monitoring.
12.2 Organizational security. Role-based access controls, data handling procedures and an incident response plan.
12.3 Data breach procedures. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and notify affected Users without undue delay.
12.4 Your responsibilities. Keep your account secure and review your account activity regularly. While we implement robust measures, no method of transmission or storage is 100% secure.
Our Service is not intended for individuals under 16. We do not knowingly collect personal data from anyone under 16. If we become aware that we have collected such data we will delete the account and associated data. If you believe we have collected data from someone under 16 please contact [email protected] immediately.
If Best Eats ® is involved in a merger, acquisition, asset sale or insolvency, your personal data may be transferred to the successor entity. You will be notified by email and through a prominent notice on the Site, the new entity will be bound by this Privacy Policy (or you will be notified of changes), and you may delete your account before the transfer.
15.1 We may update this Privacy Policy from time to time. For material changes we will notify you by email and update the "Last updated" date. For minor changes we will update the "Last updated" date; continued use constitutes acceptance.
15.2 We encourage you to review this Privacy Policy periodically.
- General privacy inquiries: [email protected]
- Data Protection Officer: [email protected]
- Security and data-breach reports (urgent): [email protected]
- Legal: [email protected]
- Support: [email protected]
- Postal address: Best Eats ®, Portugal
By using the Service you acknowledge that you have read and understood this Privacy Policy.