-1-300x358.png)
Politique de confidentialité
Updated on 26/01/2026
PREAMBLE
As part of making the Application and/or the website available at the following address: https://o-tacos.com/fr/ (hereinafter referred to as the “Website”) to Users, and/or in connection with access to and/or use of the Application and/or the Website by the User, the company O’TACOS HOLDING INTERNATIONAL (simplified joint-stock company with share capital of €1,000, whose registered office is located at Cap Sud, 106 avenue Max Dormoy, 92120 MONTROUGE, registered with the Nanterre Trade and Companies Register under number 819 957 101) and the company O’TACOS CORPORATION (simplified joint-stock company with share capital of €1,000,000, whose registered office is located at Cap Sud, 106 avenue Max Dormoy, 92120 MONTROUGE, registered with the Nanterre Trade and Companies Register under number 809 849 615) collect and process the User’s personal data.
O’TACOS HOLDING INTERNATIONAL and O’TACOS CORPORATION (hereinafter collectively referred to as “O’TACOS” or “we”) act as data controllers within the meaning of the General Data Protection Regulation (GDPR)[1].
This Personal Data Protection Policy aims to inform you about the methods used to collect, process, use, share, and protect your personal data via the Application and/or the Website, the purposes pursued, and the rights you have regarding such data.
BY CREATING A PERSONAL ACCOUNT ON THE APPLICATION OR THE WEBSITE, BY CONNECTING TO THE APPLICATION OR THE WEBSITE, AND BY USING THEM, YOU ACCEPT THAT YOUR PERSONAL DATA WILL BE COLLECTED AND PROCESSED IN ACCORDANCE WITH THE PROVISIONS OF THIS PERSONAL DATA PROTECTION POLICY. IF YOU DO NOT AGREE WITH ITS TERMS, YOU MUST NOT CREATE AN ACCOUNT ON THE APPLICATION AND/OR THE WEBSITE NOR USE THEM.
This Personal Data Protection Policy is governed by French law. Notwithstanding the foregoing, if the User is a consumer whose habitual residence is located in a European Union country other than France, the mandatory provisions of the User’s country of residence shall apply.
In the event of a dispute relating to this policy, French courts shall have jurisdiction. Notwithstanding the foregoing, if the User is a consumer whose habitual residence is located in a European Union country other than France, the mandatory provisions of the User’s country of residence shall apply.
If a legislative or regulatory amendment, or a court decision, invalidates any clause of this Personal Data Protection Policy, the remaining clauses shall remain valid.
We may modify this Personal Data Protection Policy, in particular to comply with legislative, regulatory, case law, or technological developments. The version available on the Application and the Website is the version currently in force; the date of the latest update will be clearly indicated at the top of the policy.
Article 1: What is Personal Data?
Personal data (hereinafter referred to as “Personal Data”) means any information relating directly or indirectly to an identified or identifiable natural person (such as a name, surname, telephone number, location data, etc.).
Article 2: What information relates to the processing of personal data?
O’TACOS implements all Personal Data Processing activities in accordance with applicable regulations, including in particular:
- The General Data Protection Regulation (EU) No. 2016/679, effective since May 25, 2018; and
- The French Data Protection Act (Loi Informatique et Libertés) No. 78-17 of January 6, 1978, as amended.
Personal Data Processing carried out within the operation of the Website and the Application complies with the principles of fairness, lawfulness, and transparency. O’TACOS undertakes to provide clear, complete, and easily accessible information regarding how such processing is carried out.
The scope of use and management of the Website and the Application leads O’TACOS to carry out the Personal Data Processing activities detailed in the table below:
Application activity tracking management
Here is your content formatted as a clean English GDPR table ready to paste into a website, Word file, or privacy policy.
Purpose of Processing | Personal Data Provided to O’TACOS | Legal Basis for Processing | Retention Period |
|---|---|---|---|
Management of initial contact requests from Website users | First name, Last name, Email, Address | Legitimate interest of O’TACOS | Stored for 3 years after the last contact initiated by the Website user |
Management of loyalty account creation via the Application | First name, Last name, Email | Performance of a contract between O’TACOS and the Application User | Stored for 3 years after the User’s last interaction with the Application and/or Website |
Management of advanced profile creation via the Application | Gender, Date of birth, Postal code, Country, O’TACOS product preference(s), Favorite O’TACOS restaurant(s) | User consent | Stored for three (3) years from the User’s last interaction with O’TACOS or until consent withdrawal |
Management of customer payments via the Application | First name, Last name, Email, Restaurants where orders were placed, Ordered products | Performance of a contract between O’TACOS and the Application User | Stored for 10 years from invoice issuance |
Management of Click & Collect service via the Application or Website | First name, Last name, Email, Gender, Date of birth, Postal address, Favorite O’TACOS products, Favorite O’TACOS restaurants | Performance of a contract between O’TACOS and the Application or Website User | Stored for 3 years after the User’s last interaction with the Application and/or Website |
Management of O’TACOS Customer Service | First name, Last name, Order reference, IBAN | Legitimate interest of O’TACOS | Stored for the duration necessary to resolve the dispute. In case of litigation, retained for the entire legal procedure then deleted after exhaustion of legal remedies |
Regarding application activity tracking:
You may activate application tracking via your mobile device operating system (iOS/Android) to allow us to collect certain usage data.
This tracking is implemented for advertising purposes and relies exclusively on your consent, which may be withdrawn at any time through your device privacy settings.
For further information, please consult the official pages of your operating system.
Article 3: Where are your Personal Data stored?
O’TACOS may store your Personal Data and transmit it to data processors for the following purposes:
- Website and Application hosting management
- Management of initial contact requests
- Click & Collect service management
- Online payment management
- Satisfaction survey management
- Customer service management
- Franchise recruitment management
- Newsletter and promotional offer management
- IT resources and maintenance of the Website and Application
O’TACOS ensures verification of processors’ compliance with personal data protection regulations and implements appropriate contractual safeguards as required by applicable regulations.
O’TACOS may also share certain information internally with authorized personnel (employees, management, agents) and externally with authorized third parties pursuant to legal, administrative, or judicial obligations.
O’TACOS may transfer Personal Data outside the European Union where you consent to data use for statistical analysis, audience measurement, service improvement, newsletters, and promotional offers.
In the event of transfers outside the European Union, O’TACOS will apply appropriate regulatory safeguards by ensuring:
- Transfer to a country recognized as providing an adequate level of protection; or
- Execution of Standard Contractual Clauses (SCCs) approved by the European Commission; or
- Any other safeguard deemed appropriate under Article 46 of the GDPR.
Article 4: Personal Data of Minors
In France, minors under 15 years old may not create an account on the Application or Website. From age 15, minors may create an account independently.
In Italy, minors under 14 may not create an account. From age 14, minors may create an account independently.
In Belgium and Spain, minors under 13 may not create an account. From age 13, minors may create an account independently.
In Luxembourg, the Netherlands, Germany, and Switzerland, minors under 16 may not create an account. From age 16, minors may create an account independently.
If a parent or legal guardian becomes aware that their child has provided Personal Data without consent, they are invited to contact us according to Article 10 of this policy.
Necessary measures will be taken to delete such information in accordance with applicable regulations.
Article 5: How are your Personal Data secured?
O’TACOS undertakes to implement all appropriate measures to ensure the security of your Personal Data.
These commitments include implementing technical and organizational measures within the meaning of Article 32 of the GDPR to ensure confidentiality, integrity, and availability of Personal Data and an appropriate level of protection.
O’TACOS employees have been trained and made aware of personal data protection requirements.
In the event of a Personal Data breach affecting confidentiality, availability, or integrity, O’TACOS will notify the French Data Protection Authority (CNIL) and any competent supervisory authority in accordance with applicable regulations.
Article 6: What are your rights?
You may exercise your individual rights at any time, including:
- Access to your Personal Data in a clear and understandable format
- Rectification of inaccurate or incomplete data
- Erasure of Personal Data under applicable conditions
- Restriction of processing under applicable conditions
- Objection to processing based on legitimate grounds
- Data portability in a structured, machine-readable format
- Determination of the fate of your Personal Data after death
How to exercise your rights
By post:
O’TACOS CORPORATION
CAP SUD – 106 avenue Marx Dormoy
92120 MONTROUGE
O’TACOS HOLDING INTERNATIONAL
CAP SUD – 106 avenue Marx Dormoy
92120 MONTROUGE
By email:
data.collection@o-tacos.com
(subject line: “personal data”)
O’TACOS may request proof of identity when necessary.
Requests will be handled within thirty (30) days of receipt, extendable by sixty (60) additional days where necessary due to complexity.
If you believe your Personal Data processing violates the GDPR, you may lodge a complaint with a supervisory authority in your country of residence, workplace, or where the infringement occurred.
You may also file a complaint with the French Data Protection Authority (CNIL):
CNIL – Complaints Department
3 Place de Fontenoy – TSA 80715
75334 PARIS CEDEX 07
Online:
https://www.cnil.fr/fr/cnil-direct/question/844
https://www.cnil.fr/fr/plaintes
[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC.