Privacy Policy
Last updated: 6 August 2026
At Gastro Lab we value your privacy. This policy explains what personal data we collect, for what purpose, for how long, and what rights you have. It complies with the European General Data Protection Regulation (GDPR) and the new Swiss Federal Act on Data Protection (nFADP).
1. Data controller
Gastro Lab, domiciled in Switzerland. Contact for data protection matters: adrian@gastrolabacademy.com.
2. Personal data we collect
2.1 At registration
Full name, email address, and password. The password is stored hashed with PBKDF2; it is never saved in plain text.
2.2 When creating the company (Manager)
Restaurant or establishment name, country, and optionally additional billing data.
2.3 When adding employees
The Manager provides the name, email, and professional role of each employee. The employee receives a temporary password and, on first login, must change it.
2.4 Usage data
Course progress, evaluation results, issued certificates, login date and time.
2.5 Payment data
Bank card data is processed directly by our certified payments partner and is not stored on Gastro Lab servers. We retain only a transaction identifier and the tax data necessary for invoicing.
3. Purposes of processing
- Provide the contracted service (access to courses, evaluations, certificates).
- Manage the account and the team (in the case of Managers).
- Issue verifiable personalized certificates.
- Operational communications related to the contract.
- Invoicing and compliance with accounting and tax obligations.
- Service improvement based on aggregated usage analysis.
4. Legal basis
- Performance of the contract (registration and service provision).
- Consent (analytical cookies and non-operational commercial communications).
- Legitimate interest (product improvement, fraud prevention).
- Legal obligation (invoicing, accounting retention).
5. Data retention
Account data is retained while the account remains active. After cancellation, accounting and tax data is retained for six years, in accordance with Swiss accounting obligations. Payment data is retained according to applicable tax legislation.
6. Recipients and transfers
We share personal data only with technology providers necessary for the provision of the service:
- Cloudflare as hosting and CDN provider. Processing is performed on infrastructure located in the EU and Switzerland.
- Our certified payments partner (PCI DSS compliant).
- Resend, as transactional email provider, for operational notices.
All providers have standard data protection clauses and guarantee a level of protection equivalent to that required by European and Swiss regulations.
7. User rights
Pursuant to the GDPR and the nFADP, you have the following rights:
- Access to your personal data.
- Rectification of inaccurate data.
- Deletion of data (right to be forgotten).
- Objection to processing.
- Restriction of processing.
- Data portability.
- Withdrawal of consent at any time, without retroactive effect.
To exercise any of these rights, please write to adrian@gastrolabacademy.com indicating the right you wish to exercise and attaching a copy of a document proving your identity.
8. Security
We apply reasonable technical and organizational measures to protect your data: password hashing with PBKDF2, end-to-end HTTPS connections, role-based access controls, and periodic infrastructure security reviews.
9. Minors
The service is aimed at hospitality industry professionals over 16 years of age. We do not knowingly collect data from minors. If you detect that a minor has provided data without authorization, please contact us so that we can proceed with its deletion.
10. Complaints
If you consider that the processing of your data does not comply with regulations, you may file a complaint with the Federal Data Protection and Information Commissioner (PFPDT/FDPIC) in Switzerland, or with the EU data protection authority corresponding to your place of residence.
11. Changes to the policy
Any modification will be notified by email at least thirty days before its entry into force. The current version will always be available on this same page.
12. Contact
For any matter related to data protection, please write to adrian@gastrolabacademy.com.