Privacy policy

1. Who HaiLa is

HaiLa Tech SRL, with its registered office at str. Vlaicu Pârcălab 63, Chișinău MD-2012, Republic of Moldova, operates the HaiLa platform.

For questions about data protection you can contact us at dpo@haila.md.

If HaiLa formally designates a data protection officer in accordance with the law, that officer’s contact details will be published here.

2. How responsibilities are divided between HaiLa and restaurants

HaiLa is a software platform that connects users with restaurants and gives restaurants tools for managing requests, bookings and their relationship with guests. Depending on the type of information and on how it is used, HaiLa and the restaurant may have different roles.

2.1. Data managed by HaiLa

HaiLa acts mainly as an independent controller for the data needed to manage the user’s relationship with the HaiLa platform:

• phone number;
• first name;
• email, if provided;
• HaiLa account;
• history of requests made through HaiLa;
• favourite restaurants;
• preferences stated in connection with bookings;
• history of interactions with the platform;
• data needed for authentication and security;
• certain information about activity on the platform and use of it;
• information about no-shows, cancellations or other events needed to operate and protect the HaiLa ecosystem.

HaiLa determines the purposes for which this data is used within the HaiLa service and is responsible for complying with the legal requirements that apply to this processing.

2.2. Data managed by the restaurant

The restaurant is responsible, as an independent controller, for its direct relationship with the people it serves. This category includes:

• data received from HaiLa for managing a booking;
• data the guest gives directly to the restaurant;
• bookings entered manually by staff;
• phone bookings;
• guests without a booking (walk-in);
• information about tables and visits;
• data used in its own CRM systems;
• information about its own loyalty programmes;
• history of the commercial relationship with the guest;
• the venue’s internal notes about interactions with the guest.

2.3. Data shared between HaiLa and the restaurant

To manage a request or a booking, certain data is shared between HaiLa and the restaurant:

• the guest’s first name;
• phone number;
• date and time of the booking;
• number of people;
• preferences relevant to the booking;
• booking status;
• cancellation;
• attendance or no-show;
• information needed for communication about the booking.

From the moment a restaurant receives the data needed to manage the guest, it becomes responsible for the processing carried out for the purposes of its own relationship with the guest. Likewise, when the restaurant sends HaiLa information needed for the platform to operate (for example confirmation of the booking, cancellation, the guest’s arrival or a no-show), HaiLa may use that information for the platform’s own legitimate purposes.

If, for a particular flow, HaiLa and the restaurant jointly determine the purposes and means of the processing, their respective responsibilities will be set out by contract in accordance with the rules applicable to joint controllers.

2.4. CRM and the restaurant’s internal notes

Some HaiLa features allow the restaurant to enter internal information in the guest’s profile. This information is intended mainly for operational use by the venue, for example:

• table preferences;
• seating preferences;
• operational information about previous visits;
• notes needed to prepare a future visit.

For such information, it is mainly the restaurant that determines the purpose and content of the processing. To the extent that HaiLa only hosts and processes this data on the restaurant’s instructions and does not use it for its own purposes, HaiLa acts as a processor.

Restaurants are advised to enter only information that is objective, relevant and necessary for providing the service. Discriminatory or excessive comments, and sensitive information that is not necessary for the relationship with the guest, must not be entered.

3. What data we collect

3.1. Account data

• phone number;
• first name;
• last name or its initial, if provided;
• email address, if provided;
• language preferences;
• account settings.

3.2. Data about bookings and requests

• the restaurant selected;
• the date and time requested;
• number of people;
• request status;
• booking status;
• cancellation;
• confirmation;
• arrival;
• no-show;
• table or seating preferences;
• comments relevant to the request.

3.3. Data about activity in HaiLa

• restaurants searched for;
• filters used;
• restaurants viewed;
• favourites;
• interactions with recommendations;
• pages and features used.

3.4. Technical data

• IP address;
• browser type;
• operating system;
• technical identifiers;
• security logs;
• session information;
• information needed to prevent fraud and abuse.

4. Location data

In the HaiLa apps, if you grant the necessary permission, we may use location to show relevant restaurants nearby and for certain features of the service. Depending on your settings, we use an approximate location or a city-level location.

Location in the HaiLa apps: if you allow location access and "Approximate location" is on (Settings → Privacy & data, on by default), the app shares your position with HaiLa, rounded to a grid of about 500 m. It is attached to app activity events and to booking requests; with a booking it is kept as a risk signal, linked to your account. Your exact position never leaves your phone for this purpose.

If "Approximate location" is off, or location access is not allowed, the apps use only a city-level location: the city derived from your IP address, or the city you are browsing.

On the website, location is city level by default: the city derived from your IP address, or the city you are browsing. If you ask the site to use your location (in Search, on the towns page or on a booking) and you have accepted analytics, the site attaches your position, rounded to a grid of about 500 m and with its accuracy and age, to your activity events for the next 30 minutes. Your exact position never leaves your browser for this purpose, and without analytics the rounded position is not sent either.

One exception, in the apps and on the website: "Tell me when to leave" on a booking sends your exact position once, to work out the route to the restaurant. It is not stored; only the travel time is kept with the booking.

This exact position is sent to Google’s routing service, which works out the travel time.

5. Where we get data from

We obtain data:

• directly from you;
• from your HaiLa account;
• from your interaction with the platform;
• from the restaurant, when it updates the status of a booking;
• from the restaurant, when it enters a booking or an interaction in the system;
• from the restaurant’s integrated systems;
• from the technical providers used to operate the platform.

6. What we use data for and on what legal basis

7. Data passed to the restaurant

When you send a request to a restaurant, HaiLa passes to the restaurant only the information needed to manage the request and the relationship with the guest:

• first name;
• phone number;
• number of people;
• date and time;
• preferences related to the booking;
• other information needed to prepare for the visit.

The restaurant may use this data to manage the booking, to contact the guest about the booking, to prepare the table, to manage the visit, to meet its legal obligations and to manage its relationship with the guest.

The restaurant may not use data received through HaiLa for direct marketing unless there is a valid legal basis for doing so.

If you have a HaiLa account, the restaurants you book with also see your total number of no-shows on HaiLa and the average of the ratings that restaurant teams have given you after visits, as a number, without their comments. A team’s comments and notes stay with its restaurant. These figures are not public and are not used to decline any request automatically: each restaurant decides for itself. If a no-show or a rating is wrong, you can ask us to check and correct it at dpo@haila.md. Alongside these figures, restaurants also see an internal reliability indicator built only from facts: visits that took place, late cancellations and no-shows. It is not public either, and if a fact is wrong you can ask for it to be corrected.

If the restaurant has a loyalty programme active in HaiLa, you can choose to take part. You can switch your participation off later, and a new booking does not switch the programme back on after you leave. Loyalty is separate from consent to promotional messages: taking part in the programme does not mean consenting to them. You can see your progress in your HaiLa account.

8. Bookings entered directly by the restaurant

The restaurant may enter directly in HaiLa:

• phone bookings;
• bookings received through its own website;
• guests without a booking (walk-in);
• other direct interactions with guests.

In such cases, the restaurant is mainly the controller of the data entered. HaiLa may process this information on the restaurant’s behalf in order to provide the software service, in accordance with the applicable agreement.

9. Caller ID

For restaurants that activate the Caller ID feature, the phone number associated with a call received by the restaurant may be used to identify an existing record in the venue’s CRM. The feature serves to:

• identify an existing record;
• display relevant information;
• start a booking;
• pre-fill the phone number.

Caller ID does not involve intercepting or recording the content of the call.

The incoming call log (the number, the time, the guest record found and how the call ended) is kept only for as long as is necessary for operational, security and audit purposes, and is then deleted automatically, in accordance with the retention policy.

The restaurant is responsible for the use of the feature in its own relationship with the guest.

10. Preferences and sensitive information

Please do not enter in the free-text fields sensitive information that is not needed for the booking. Such information may concern, for example:

• accessibility;
• allergies;
• diet;
• other special needs.

If such information is necessary for the service requested, it will be used only to the extent needed to handle the request and in accordance with the applicable legal basis.

Your date of birth, allergies, dietary preferences and occasions belong to you, not to a single restaurant. When you record them in your account, or when the team of a restaurant you have booked with records them, they appear in your guest record at every restaurant you have booked with through HaiLa, so that you do not have to repeat them each time. Only the teams of those restaurants and HaiLa can see them. You can ask us at any time to correct or delete them.

Restaurants are instructed to avoid entering in their internal notes sensitive data that is not necessary.

11. Recommendations and personalisation

HaiLa may use information such as:

• restaurants searched for;
• favourites;
• restaurants viewed;
• history of interactions;
• city;
• stated preferences.

This information may be used to adapt the order and relevance of the restaurants and recommendations displayed. This personalisation does not normally produce legal effects or similarly significant effects on the user. Where the processing is based on legitimate interest, you may exercise your right to object.

12. Marketing and promotional communications

Operational messages

Operational messages are part of the service you asked for:

• sign-in codes (OTP);
• confirmations;
• cancellations;
• changes;
• reminders;
• information needed for the booking.

The sign-in code is the only message HaiLa sends by SMS.

Marketing messages

Marketing messages may be:

• promotions;
• commercial recommendations;
• campaigns;
• newsletters;
• promotional communications by push notification or email.

The marketing channels used are push notifications and email, each with its own separate consent. HaiLa does not send marketing messages by SMS.

Marketing communications are sent only if there is a valid legal basis, and you can opt out of them at any time.

13. Who may receive the data

To the extent necessary, your data may be disclosed to:

• the relevant restaurant;
• authorised HaiLa staff;
• hosting providers;
• email providers;
• analytics providers, if you have accepted;
• security providers;
• map and routing providers, when you use those features;
• public authorities, where there is a legal obligation.

The sign-in code sent by SMS is sent by Google’s authentication service. The providers are listed, by name, in section 14.

In its live view of the website and the apps, HaiLa’s team sees the first name and last initial of a signed-in visitor (for example “Maria C.”) and nothing else from the account: no phone number, no email. The name shows only while you are on the site or in the app, and is kept only on the record of that visit, which expires 10 minutes after your last activity and is then deleted automatically, usually within a day. On the website this happens only if you have accepted analytics.

Google Analytics (Google Ireland Limited) receives page views and a random visitor id, and only if you accept analytics cookies. Google may process that data outside Moldova.

Google reCAPTCHA (Google) checks, when you ask for a sign-in code by phone, that the request comes from a real browser. It is a security measure, and it is never used for advertising.

When you tap "Tell me when to leave", your position is sent to Google (Google Maps Platform, Routes API) to work out the route to the restaurant, and Google processes it under its own privacy policy.

HaiLa does not sell personal data to third parties for advertising purposes.

14. Technical providers

HaiLa may use specialised providers for cloud hosting, authentication, email, push notifications, analytics, maps and routing, machine translation, error diagnostics, security and abuse prevention. These providers process data only to the extent needed to provide the service in question and in accordance with the applicable contracts.

Where a provider acts as a processor, HaiLa uses providers that offer sufficient guarantees as to appropriate technical and organisational measures.

The providers that receive or process guests’ data are:

Apple and Google, when you choose to sign in with their account, are independent controllers, not processors of HaiLa.

The till system belongs to the restaurant and to the providers it has chosen. It is a recipient chosen by the restaurant, not a provider of HaiLa.

15. International transfers

Some technical providers may process data outside the Republic of Moldova. When we make an international transfer, we use the mechanisms provided for by the applicable legislation, such as a decision on the adequacy of the level of protection, appropriate contractual safeguards, standard contractual clauses or other mechanisms permitted by law.

The data is hosted with Google Cloud in the European Union, and part of the server-side processing takes place in the United States of America, on the basis of the standard contractual clauses in Google’s data processing terms.

You can ask for further information about the applicable mechanisms at dpo@haila.md.

16. How long we keep data

17. Deleting your HaiLa account

You can ask for your HaiLa account to be deleted. Deleting your account does not automatically mean deleting all the information kept separately by restaurants.

A restaurant may have its own legal basis for keeping certain information about its relationship with you. For data managed independently by a restaurant, you may need to contact the restaurant directly.

18. How we protect data

We use technical and organisational measures such as:

• encryption of communications;
• access control;
• authentication;
• separation of roles;
• logging of access and events;
• backups;
• security monitoring;
• continuity measures;
• incident procedures.

No information system can guarantee absolute security.

19. Security incidents

HaiLa has procedures for identifying, assessing and managing incidents involving personal data. Where the law requires it, HaiLa will notify the competent authority without undue delay and, where possible, within the applicable statutory time limit.

20. Your rights

Under the conditions laid down by law, you have the following rights:

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability, under the conditions laid down by law;
• the right to object;
• the right to withdraw consent, where consent is the basis for the processing;
• the rights relating to certain automated decisions;
• the right to lodge a complaint with the CNPDCP.

21. How to exercise your rights

You can use the functions available in your HaiLa account or contact us at dpo@haila.md. We may ask for additional information to verify identity where there are reasonable doubts.

We respond to requests without undue delay and, normally, within one month of receipt. In complex cases, the time limit may be extended under the conditions laid down by law.

22. If your request concerns data managed by a restaurant

If the request concerns data for which the restaurant is an independent controller (for example internal notes, its own CRM, its own loyalty programme or the guest history created directly by the restaurant), HaiLa may forward the request to the restaurant or refer you to it.

If HaiLa acts as a processor for that data, it will support the restaurant in meeting its obligations.

23. Cookies and analytics

We use essential technologies for authentication, security, keeping preferences and the operation of the service. Non-essential analytics is activated only in accordance with your choices and our Cookie Policy.

Optional analytics is Google Analytics 4 (Google Ireland Limited). It sets the _ga and _ga_* cookies and sends page views to Google together with a random visitor id. It loads only after you accept it in the cookie banner, never before.

HaiLa also measures visits itself, to see how the site is used in real time and to improve it. It sets no cookie: it uses a random identifier kept in your browser. With it we record the pages you open and what you do on them (for a search, only its length, never the text you type), the restaurant you are looking at or whose menu you are reading at the table, the language, a campaign label if you arrived from one, and the approximate city worked out from your IP address, which we do not store. If you ask the site to use your location, we also record the area of about 500 m around you for 30 minutes; if you are signed in, your first name and last initial; and if you book, the booking the visit led to. Measurement starts only after you accept analytics, the same choice as for Google Analytics, and stops as soon as you withdraw that choice (which also deletes the identifier) or turn on Do Not Track in your browser. The record of a visit expires 10 minutes after your last activity, each page and action after 24 hours, and the link between a search and a booking after 48 hours; expired data is deleted automatically, usually within a day. Only anonymous counts are kept longer.

Google reCAPTCHA is a security check that protects sign-in from abuse. It loads only when you ask for a sign-in code by phone, not on every visit, and it is never used for advertising.

We use no advertising cookies and no cross-site advertising trackers.

The list of cookies and similar technologies, with the purpose and duration of each, is in the Cookie Policy. You can change or withdraw your choice at any time in “Cookie settings”, in the footer of every page.

24. Children’s data

HaiLa is not intended for independent use by children who are not of the age required to validly enter into the relevant legal relationship or to give the consent required under the applicable legislation.

If we learn that we have collected a child’s data without an appropriate legal basis, we will take steps to delete the data or to regularise the processing.

25. Changes to this policy

We may update this Policy when we change the HaiLa services, introduce new features, change the relevant providers, when the legal requirements change or when we change the way we process data.

If the change is significant, we will inform users by appropriate means.

26. Supervisory authority

You have the right to lodge a complaint with the National Centre for Personal Data Protection of the Republic of Moldova (CNPDCP).

27. Contact

HaiLa Tech SRL, str. Vlaicu Pârcălab 63, Chișinău MD-2012, Republic of Moldova.

Email for data protection: dpo@haila.md

General contact: hello@haila.md