Privacy Policy
Last updated: 20 October 2026
At Gastro Lab we value your privacy. This policy explains what personal data we collect, for what purpose, for how long, and what rights you have. It complies with the European General Data Protection Regulation (GDPR) and the new Swiss Federal Act on Data Protection (nFADP).
1. Data controller
Adrian F. Tureatca, trading as Gastro Lab, Speicherstrasse 21, 9000 St. Gallen (Switzerland). Contact for data protection matters: adrian@gastrolabacademy.com.
2. Personal data we collect
2.1 At registration
Full name, email address, and password. The password is stored hashed with PBKDF2; it is never saved in plain text.
2.2 When creating the company (Manager)
Restaurant or establishment name, country, and optionally additional billing data.
2.3 When adding employees
The Manager provides the name, email, and professional role of each employee. The employee receives a temporary password and, on first login, must change it.
2.4 Usage data
Course progress, evaluation results, issued certificates, login date and time.
2.5 Payment data
Bank card data is processed directly by our certified payments partner, which also acts as merchant of record for the transaction, and is not stored on Gastro Lab servers. We retain only a transaction identifier and the tax data necessary for invoicing.
2.6 Waiting list
If you join the waiting list, we store your name, your email, your phone number if you give it, the language you sign up in, the country you connect from (worked out by our network provider from your connection) and a code calculated from your IP address with a salted hash; the IP itself is not stored. We use them to let you know when we open and to prevent mass sign-ups from a single connection. The legal basis is your consent, which you give by ticking the box on the form. We keep them until you ask us to delete them: write to adrian@gastrolabacademy.com and we will erase them.
2.7 Website visits
Every page you open is recorded as a visit: the day, the page, the language, the country you connect from, a visitor code and, if you are signed in, your user identifier. The visitor code is calculated with a salted hash from your IP address, your browser and the day; it changes every day, so it can count distinct visitors within a day but cannot follow you from one day to the next. Neither the IP nor the browser data are stored separately, and no cookie of our own is used for this. When you are signed in, your session also records the last page opened and the time, so we can see who is online; that record disappears when you sign out. Visits by the administrator are not counted. The purpose is to know how much each page is used and to improve the service (legitimate interest). Visits are kept until you ask us to delete them: write to adrian@gastrolabacademy.com.
2.8 AI question assistant
If you are a manager and use the assistant to create questions, the text you type and the documents you upload (for example a menu or your service rules) are sent to our hosting provider’s artificial intelligence service, which reads them and suggests questions. Neither the text nor the documents are stored: only the questions you approve are saved, together with the fact that the assistant suggested them, the model that wrote them and the name of the document they come from. Please do not include other people’s personal data in those documents. The legal basis is the performance of the contract.
3. Purposes of processing
- Provide the contracted service (access to courses, evaluations, certificates).
- Manage the account and the team (in the case of Managers).
- Issue verifiable personalized certificates.
- Operational communications related to the contract.
- Invoicing and compliance with accounting and tax obligations.
- Service improvement based on aggregated usage analysis.
4. Legal basis
- Performance of the contract (registration and service provision).
- Consent (analytical cookies and non-operational commercial communications).
- Legitimate interest (product improvement, fraud prevention).
- Legal obligation (invoicing, accounting retention).
5. Data retention
Account data is retained while the account remains active. After cancellation, accounting and tax data is retained for six years, in accordance with Swiss accounting obligations. Payment data is retained according to applicable tax legislation.
6. Recipients and transfers
We share personal data only with technology providers necessary for the provision of the service:
- Hosting, content delivery network and artificial intelligence provider. The database is located in Western Europe; some processing, such as that of the question assistant, may take place on servers in other countries.
- Our certified payments partner (PCI DSS compliant), which also acts as merchant of record for the transaction.
- Transactional email provider, for operational notices.
Some of these providers may process data outside the EU and Switzerland, including in the United States. In that case the transfer is based on an adequacy decision or on standard contractual data protection clauses. If you have any question about what data we process or where it is processed, write to adrian@gastrolabacademy.com before you register or log in and we will get back to you.
7. User rights
Pursuant to the GDPR and the nFADP, you have the following rights:
- Access to your personal data.
- Rectification of inaccurate data.
- Deletion of data (right to be forgotten).
- Objection to processing.
- Restriction of processing.
- Data portability.
- Withdrawal of consent at any time, without retroactive effect.
To exercise any of these rights, please write to adrian@gastrolabacademy.com indicating the right you wish to exercise.
8. Security
We apply reasonable technical and organizational measures to protect your data: password hashing with PBKDF2, end-to-end HTTPS connections, role-based access controls, and periodic infrastructure security reviews.
9. Minors
The service is aimed at hospitality industry professionals over 16 years of age. We do not knowingly collect data from minors. If you detect that a minor has provided data without authorization, please contact us so that we can proceed with its deletion.
10. Complaints
If you consider that the processing of your data does not comply with regulations, you may file a complaint with the Federal Data Protection and Information Commissioner (PFPDT/FDPIC) in Switzerland, or with the EU data protection authority corresponding to your place of residence.
11. Changes to the policy
Any modification will be notified by email at least thirty days before its entry into force. The current version will always be available on this same page.
12. Contact
For any matter related to data protection, please write to adrian@gastrolabacademy.com.