Privacy Policy

1. Introduction

Brasata (“we”, “our”, or “us”) operates the brasata.com website and related services. We are committed to protecting and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws of Curaçao.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights regarding your data. By using our platform, you acknowledge that you have read and understood this policy.

2. Data We Collect

When you register, create a business listing, leave a review, or contact us, we may collect:

• Full name and email address
• Phone number
• Business details (name, address, category, photos, opening hours)
• Payment and billing information
• Business-verification information, including identity-document details, a selfie or liveness check, verification results, and fraud-prevention signals
• Business documents used to show that an applicant is authorized to register or act for a business
• Profile photos and content you upload
• Reviews, ratings, and comments

2b. Information Collected Automatically

When you access our platform, we automatically collect:

• IP address and approximate geographic location
• Browser type, version, and operating system
• Device type and screen resolution
• Pages visited, time spent, and navigation paths
• Referring website or search terms
• Cookies and similar tracking identifiers

3. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience, analyze usage, and deliver relevant content. Cookies are small text files stored on your device.

You can manage your cookie preferences at any time through our cookie consent banner or your browser settings. Disabling certain cookies may affect the functionality of our platform.

• Strictly Necessary Cookies: Essential for the platform to function, including authentication and security. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with our platform, allowing us to improve functionality and content.
• Functional Cookies: Remember your preferences such as language settings and display options.
• Marketing Cookies: Used to deliver relevant advertisements and measure campaign effectiveness.

4. How We Use Your Data

We process your personal data for the following purposes:

• Providing, maintaining, and improving our platform and services
• Processing account registration and managing your profile
• Facilitating business listings, reviews, reservations, orders, and other customer commitments
• Processing one-time prepaid business package payments to Brasata through a payment processor, using the payment and account data needed to complete the transaction and send related billing confirmations
• Recording information about customer payments made directly to an independent business where needed to support the transaction
• Verifying identity and authority to act for a business before enabling reservations, orders, and other customer commitments
• Sending service-related communications (e.g., account updates, security alerts)
• Sending promotional communications with your explicit consent
• Analyzing usage patterns to improve user experience
• Detecting and preventing fraud, abuse, and security threats
• Complying with legal obligations

4b. Legal Bases

Depending on the activity and applicable law, we process data to perform our contract with you, comply with legal obligations, pursue legitimate interests such as platform security and fraud prevention, or based on consent where consent is required. You may withdraw consent at any time, but that does not affect processing already carried out or processing supported by another lawful basis.

5. Third-Party Data Sharing

We do not sell your personal data. We may share your information with the following categories of third parties:

• Identity Verification: Didit processes identity documents, selfie or liveness data, and verification signals to perform business-applicant KYC checks for Brasata.
• Payment Processing: Payment providers process payments to Brasata and the payment and account data needed to complete them. Brasata does not store full card details.
• Other Service Providers: Cloud hosting, email delivery, and analytics providers that help us operate the platform.
• Listed Businesses: When you make a reservation, place an order, create another customer commitment, or send an inquiry, relevant information is shared with that independent business.
• Legal Authorities: When required by law, regulation, or legal process, or to protect the rights, safety, and property of Brasata and its users.
• Other Users: Your public profile information, reviews, and ratings are visible to other platform users.

5b. Service Provider Safeguards

All third-party service providers are contractually obligated to protect your data and may only process it for the specific purposes we authorize.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Account data is retained for the duration of your active account. Verification decisions, audit records, authority evidence, and billing records may be retained after account closure where needed for fraud prevention, disputes, or legal and accounting obligations. When those purposes no longer apply, we delete or anonymize the data. After account deletion, we may retain anonymized data for analytics purposes and certain records as required by law for up to 7 years. Identity-verification and payment providers also retain data under their own legal obligations and published retention practices.

7. Data Security

We maintain technical and organizational measures intended to reduce the risk of unauthorized access to or loss of personal data. No method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

You are responsible for keeping your account credentials confidential and for the information you choose to submit through the platform. Do not share login details, and do not enter sensitive information such as government identification or full payment card numbers into free-text fields.

8. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data (“right to be forgotten”).
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format and transfer it to another service.
• Right to Object: Object to processing of your data for direct marketing or based on legitimate interests.
• Right to Withdraw Consent: Withdraw previously given consent at any time, without affecting the lawfulness of processing before withdrawal.

9. International Data Transfers

Your data may be transferred to and processed in countries outside Curaçao and the European Economic Area (EEA), including where an identity-verification, payment, or other service provider uses infrastructure in another country. Where applicable, we use recognized transfer safeguards such as adequacy decisions or Standard Contractual Clauses.

10. Children’s Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. We encourage you to review this page periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: