Ovatable

Privacy Policy

Our privacy policy and how we use your data

Last updated: January 2026

Ovatable attaches particular importance to the confidentiality, security, and traceability of data processed in the context of its website, application services, and commercial activities. This policy explains how Ovatable collects, uses, retains, and protects personal data.

1. Who is the Data Controller?

The data controller is: Ovatable, SAS, La Grande Arche - Paroi Nord, 1 Parvis de la Defense 92044 PARIS LA DEFENSE. Email: dpo@ovatable.fr

2. Scope

This policy applies to: navigation on the site ovatable.fr; contact, demonstration, or information requests; management of prospects, clients, partners, and candidates; use of the Ovatable platform, in web or mobile version.

3. What Data Do We Collect?

Identification and Contact Data

Name, first name, company, position, email address, phone number, country, content of your message.

Commercial and Contractual Data

History of exchanges, demonstration requests, quotes, subscriptions, billing, support, customer account information.

Technical and Navigation Data

IP address, logs, browser, device, language, pages visited, cookies and trackers, timestamps, security information.

Reservation and Conversation Data

Depending on the features activated: guest names and contact details (phone number, email), reservation details (date, time, party size, special requests), records of conversations with the booking agent (phone calls, WhatsApp), associated transcriptions and metadata, action history, and audit logs.

Recruitment Data

CV, cover letter, professional experience, diplomas, and any information submitted as part of a job application.

4. Why Do We Process Your Data?

  • Respond to your contact, demonstration, or information requests;
  • Manage the commercial and contractual relationship;
  • Create and administer user accounts;
  • Provide, secure, maintain, and improve the platform;
  • Process reservations and guest conversations on behalf of restaurants using the booking agent;
  • Ensure traceability, audit, security, and prevention of abuse;
  • Manage billing, accounting, and legal obligations;
  • Send professional communications, invitations, or B2B marketing content where authorized;
  • Manage job applications;
  • Defend the rights and legitimate interests of Ovatable.

5. Legal Bases

The processing is based, as the case may be, on: the execution of pre-contractual measures or a contract; compliance with legal obligations; the legitimate interest of Ovatable; your consent, where required.

6. Controller or Processor?

For the website, prospecting, commercial relations, and service administration

Ovatable acts as data controller.

For operational data entrusted by clients on the platform

Ovatable acts in principle as a data processor, on instruction from its clients who are themselves data controllers, unless contractually stipulated otherwise. When a user wishes to exercise their rights regarding data processed by a client via the platform, it may be necessary to first contact the relevant client.

7. Data Recipients

Data may be accessible, within the scope of their responsibilities, to: the authorized Ovatable team; its technical, hosting, support, messaging, analytics, or payment service providers; its advisors and contractually bound partners; administrative or judicial authorities when required by law.

Ovatable ensures that any service provider processing data provides sufficient guarantees of security and confidentiality.

8. Where is Your Data Hosted?

Ovatable prioritizes hosting within the European Union or the European Economic Area. If a transfer outside the EEA were to occur, it would be governed by an appropriate legal mechanism compliant with applicable regulations.

9. How Long Do We Retain Your Data?

  • Contact requests and prospects: 3 years from the last contact;
  • Client data and contracts: 5 years from the end of the commercial relationship;
  • Billing and accounting: 10 years;
  • Job applications: 2 years after the last contact, unless opposed;
  • Technical logs and security: 12 months maximum, unless security necessity;
  • Cookies and trackers: according to their purpose, within applicable time limits;
  • User accounts: for the duration of the account, then intermediate archiving if necessary.

10. Security

Ovatable implements appropriate technical and organizational measures to ensure the confidentiality, integrity, availability, and traceability of data: access management, logging, backups, encryption where relevant, compartmentalization of rights, and monitoring of security incidents.

11. Your Rights

In accordance with applicable regulations, you have the following rights, depending on the case:

  • Right of access;
  • Right to rectification;
  • Right to erasure;
  • Right to restriction;
  • Right to object;
  • Right to data portability;
  • Right to withdraw your consent at any time when processing is based on it;
  • Right to define directives regarding the fate of your data after your death.

To exercise your rights: dpo@ovatable.fr or by mail to: Ovatable, La Grande Arche - Paroi Nord, 1 Parvis de la Defense 92044 PARIS LA DEFENSE.

In the event of an unresolved difficulty, you may file a complaint with the CNIL.

12. Artificial Intelligence and Professional Content

Ovatable's booking agent uses artificial intelligence to understand and respond to guest conversations by phone and WhatsApp. When these features are used:

  • They serve as an aid to reservation handling;
  • They do not replace human validation for sensitive requests;
  • They may produce results requiring verification;
  • They are configured according to the technical and contractual choices made by Ovatable and, where applicable, by its clients.

13. Updates

Ovatable may modify this policy at any time to take into account legal, technical, or operational developments. The online version shall prevail from its date of update.