Privacy Policy

Last Updated: March 18, 2026

SARL WESHOP ("we", "us", "our") operates the Nextik platform, a SaaS solution for hospitality and retail businesses. This Privacy Policy explains how we collect, use, and protect personal data when you use our services, including:

Restaurant reservations (including via Google Reserve)
Loyalty programs (membership, points, rewards, coupons)
Online ordering and food delivery
Digital wallet passes (Apple Wallet, Google Pay)

1. Data Controller

SARL WESHOP
SIRET: 81178562500039
Email: contact@nextik.fr
Phone: +33 1 48 46 12 88

2. Information We Collect

2.1 Account & Membership Data

Name, email address, phone number
Password (hashed, never stored in plaintext)
Date of birth (optional, for birthday rewards)
Postal address (optional, for delivery or business customers)
Business information: company name, SIRET, VAT number (business accounts only)

2.2 Reservation Data

Restaurant name, date, time, party size
Special requests or dietary requirements
Reservation status and history
Contact details for confirmation and reminders

2.3 Transaction Data

Order details (items, quantities, prices)
Payment references (we do not store full card numbers)
Points earned, redeemed, or adjusted
Balance top-ups and usage
Coupon issuance and redemption

2.4 Technical Data

IP address, browser type, device information
Digital wallet device tokens (for push notifications)
Cookies and session identifiers

3. How We Use Your Data

Purpose	Legal Basis (GDPR)
Process reservations and send confirmations/reminders	Contract performance
Manage your loyalty account (points, balance, coupons)	Contract performance
Process and fulfill food orders	Contract performance
Send digital wallet pass updates	Contract performance
Send marketing communications (with consent)	Consent
Birthday rewards and personalized offers	Legitimate interest
Fraud prevention and security	Legitimate interest
Comply with legal obligations (tax, accounting)	Legal obligation

4. Data Sharing

We share your data only when necessary:

Merchants: The restaurant or retailer you interact with receives your reservation, order, and membership data to provide their services.
Delivery platforms: UberEats, Deliveroo, Just Eat, or Panda receive order data when you place a delivery order through their platforms.
Google: When you book via Google Reserve, reservation data is exchanged with Google to manage your booking.
Payment processors: Yavin or Stripe process payments on our behalf. We do not store full card details.
Communication providers: Email and SMS providers (Bird) deliver transactional messages on behalf of merchants.

We never sell your personal data to third parties.

5. International Transfers

Your data is primarily stored in the European Union. Where data is transferred outside the EU (e.g., to cloud infrastructure providers), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs).

6. Data Retention

Account data: Retained while your account is active, then deleted within 12 months of account closure.
Reservation data: Retained for 2 years after the reservation date for dispute resolution.
Transaction data: Retained for 5 years to comply with French accounting obligations.
Marketing consent: Until you withdraw consent.

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

Access your personal data
Rectify inaccurate or incomplete data
Erase your data ("right to be forgotten")
Restrict processing in certain circumstances
Data portability - receive your data in a structured format
Object to processing based on legitimate interest
Withdraw consent at any time for consent-based processing

To exercise these rights, contact us at contact@nextik.fr. We will respond within 30 days.

You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French data protection authority.

8. Cookies

We use essential cookies for session management and authentication. We do not use third-party advertising cookies. Analytics cookies are only used with your consent.

9. Security

We implement appropriate technical and organizational measures, including:

Encryption of data in transit (TLS/HTTPS) and at rest
Password hashing with bcrypt
Access controls and authentication for all API endpoints
Regular security reviews

10. Google API User Data

When a merchant connects their Google account to Nextik, we access certain Google data through the Google APIs, only after their explicit consent on the Google authorization screen, and strictly within the limits described below.

10.1 Requested scopes and purposes

Scope	Data accessed	Purpose within Nextik
`userinfo.email` `userinfo.profile`	Email address, name and profile picture of the Google account	Identify the merchant, create or link their Nextik account, and enable Sign in with Google
`business.manage`	The merchant's Google Business Profile listings: contact details, opening hours, photos, posts and customer reviews	Synchronise store information from the Nextik dashboard, publish updates, and let the merchant read and reply to their customer reviews
`mapsbooking`	Booking requests sent by Google (Reserve with Google)	Receive, confirm, modify and cancel reservations made by customers from Google Search and Google Maps, and send the merchant's availability back to Google

We only request the scopes required by the features the merchant actually uses. No Google data is collected from end customers (consumers): only merchant Google accounts are involved.

10.2 Limited Use

Nextik's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we commit to:

use this data only to provide or improve the user-facing features described above;
not transfer this data to third parties, except as necessary to provide those features, for security purposes, or to comply with applicable law;
never use this data for advertising, ad profiling or resale purposes;
not allow humans to read this data, unless we obtain the merchant's express consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised;
never use this data to develop, improve or train generalised AI and/or machine learning models.

10.3 Retention, deletion and revocation

Google access and refresh tokens are stored encrypted on our servers located in the European Union and are used solely to call the Google APIs on the merchant's behalf. Google data we retrieve (business listing, reviews, bookings) is retained for the duration of the subscription and deleted within 30 days after the Google account is disconnected or the subscription is terminated.

The merchant can revoke our access at any time:

from the Nextik dashboard, under Settings › Google integrations;
or at myaccount.google.com/permissions.

Revoking access immediately stops any further collection of Google data and triggers deletion of the stored tokens.

For more details about this integration, see our Google integration page.

11. Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated via email or in-app notification. Continued use of our services after changes constitutes acceptance.

12. Contact

SARL WESHOP
SIRET: 81178562500039
Email: contact@nextik.fr
Phone: +33 1 48 46 12 88