B2B Privacy Policy

Last updated: 13 October 2026

1. Data Controller

DELITBEE ESPAÑA S.L.
Tax ID (CIF): B01823822
Registered address: Calle Lleida 17-10, 46009, Valencia (Spain)
Contact email: privacy@delitbee.com

DELITBEE acts as Data Controller with respect to the data of the professionals and companies that contract the service, and as Data Processor with respect to the data of the Restaurant’s end customers (governed by the DPA – Data Processing Agreement).

2. Who are considered B2B users?

This policy applies to:

• Restaurants that contract Delitbee SaaS
• Restaurant chains and groups
• Resellers that distribute the SaaS
• Connected platforms
• Personnel authorized by the Restaurant (employees or managers)
• Users of the administrative panel or the Delitbee Gestor app

3. Data we process

3.1. Source of the data

The personal data processed by DELITBEE comes from:

• The B2B user themselves when contracting the service or using the platform
• Group companies, resellers or authorized partners
• Integrations activated by the Restaurant itself

3.2. Professional contact data

• First and last name
• Corporate email
• Telephone
• Business address

3.3. Tax and billing data

• Tax ID (CIF/NIF)
• Company name
• Tax address
• IBAN (where applicable)
• Invoice history

3.4. Panel access data

• Access credentials
• Authentication tokens
• Roles and permissions
• Activity history (logs)

3.5. Financial data

• Fees
• Settlements
• Payments processed through Stripe Connect, with DELITBEE acting as technology intermediary
• Transaction history

3.6. Technical and usage data

• IP address
• Browser
• Device
• Server logs
• Operational activity records
• Error and performance data

3.7. External integrations

If the Restaurant activates integrations with third parties (Brevo, Comeback, etc.), the data necessary for synchronization will be processed:

• Customer emails
• Customer telephone numbers
• First and last names
• Basic order data and history
• Loyalty information
• Campaign results

4. Purposes of the processing

DELITBEE processes B2B data in order to:

1. Manage the contractual relationship
2. Provide the SaaS service, including:
   • Own online channel
   • Stores, kiosks, table ordering
   • Administrative panel
   • Delitbee Gestor app
3. Provide technical support
4. Issue invoices and manage payments
5. Send service-related communications
6. Comply with tax and legal obligations
7. Security, fraud prevention and internal audits
8. Product improvement and internal analytics

5. Legal basis for the processing

The processing is based on:

• Performance of the contract (Art. 6.1.b GDPR)
• Compliance with legal obligations (tax and accounting)
• Legitimate interest in security, service improvement and fraud prevention
• Consent, in the case of voluntary commercial communications

6. Disclosure of data to third parties

DELITBEE only shares B2B data with:

6.1. Technology providers

• Google Cloud Platform (hosting)
• Stripe (Stripe Connect payments)
• Brevo, Comeback (if integrations are activated)
• Anthropic (Claude artificial intelligence assistant for contract, sales and support management)
• Slack (internal communication and document management)
• Analytics, logging and security tools

All of them act as Data Processors.

6.2. Public authorities

Where there is a legal obligation.

6.3. Group companies (if any)

For internal operational purposes.

7. International transfers

Transfers outside the EEA take place when:

• Stripe is used (United States)
• Firebase/Google Cloud is used (United States)
• Anthropic is used (United States)
• Slack is used (United States)
• External integrations are activated

The following apply:

• Standard Contractual Clauses (SCCs)
• Advanced security measures
• Impact assessments where necessary

8. Data retention

• Contractual data: for the duration of the relationship + 5 years
• Billing: 5 years (legal obligation)
• Technical logs: 12–36 months
• Support tickets: duration of the case + 12 months
• Access data: 12 months after cancellation

9. Rights of the B2B user

You may exercise the following rights:

• Access
• Rectification
• Erasure
• Restriction
• Portability
• Objection

By sending an email to: privacy@delitbee.com

DELITBEE may request additional information to verify the identity of the requester.

Requests will be answered within a maximum period of 30 days, in accordance with the GDPR.

9.1. Right to lodge a complaint with the supervisory authority

If you consider that the processing of your personal data infringes the regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es

10. Service cancellation and account deletion

The B2B user may request cancellation and deletion of their account by writing to privacy@delitbee.com from the associated email address.

Erasure will be carried out in accordance with the legal retention periods set out in this policy.

DELITBEE may request additional information to verify the identity of the requester.

11. Security

DELITBEE applies technical and organizational measures such as:

• TLS encryption
• Role-based access control
• Rotating tokens
• Log auditing
• Anti-fraud systems
• Redundancy and backups

12. Third-party links and services

The DELITBEE platform may include links to third-party websites or allow the activation of external services and integrations. DELITBEE is not responsible for the content or privacy policies of such third parties, to which their own terms and policies apply.

The B2B user is responsible for reviewing and, where applicable, accepting the privacy policies of the third-party services they decide to activate or use through the platform.

13. Changes to this policy

Any relevant change will be notified to the Restaurant’s contact email or by means of a notice in the administrative panel.