Privacy Policy & Legal Notice

Last updated: 27 June 2026

1. Data controller

In compliance with the General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD), the user is informed that the personal data collected through this platform will be processed by:

  • Controller: MenuQR (hereafter, "the platform")
  • Contact: Via the contact form on the website
  • Purpose: Provision of the digital menu service and order management for restaurants

2. Data we collect

Depending on the service you use, we collect the following personal data:

2.1. Restaurant data (controllers of their own customers' data)

  • Owner's full name
  • Email address
  • Contact phone
  • Restaurant name and address
  • Business logo and images
  • Kitchen-screen access PIN

2.2. Restaurant customer data

  • Table number (linked to the scanned QR)
  • Contents of the order placed
  • Notes or comments about the order (including allergies)
  • Time of the order

Restaurant customers do not need to register or create an account to place an order. We do not collect names, email addresses or payment data from diners.

3. Purpose of processing

Your personal data is collected and processed for the following purposes:

  • Service management: To let restaurants create and manage their digital menu, receive orders and notifications and manage the kitchen screen.
  • Communication: To send notifications of new orders and customer calls to the restaurant.
  • Technical support: To handle queries, incidents and requests from restaurants.
  • Service improvement: To analyse platform usage in order to improve and optimise it.
  • Billing: To manage subscriptions and payments (via Stripe or PayPal, without storing banking details).

4. Legal basis for processing

Processing of your data is based on the following legal grounds:

  • Performance of a contract: Provision of the digital menu and order-management service (art. 6.1.b GDPR).
  • Consent of the data subject: For the use of non-essential cookies and marketing communications (art. 6.1.a GDPR).
  • Legitimate interest: For the improvement and analysis of the platform (art. 6.1.f GDPR).
  • Legal obligations: Billing and tax obligations (art. 6.1.c GDPR).

5. Data retention

Data will be kept for as long as necessary to fulfil the purpose for which it was collected and to determine any liabilities arising from that purpose and the data processing:

  • Restaurant data: For the duration of the contractual relationship and, once ended, for the limitation period of legal obligations (maximum 5 years).
  • Customer orders: Kept for as long as needed for service management and, subsequently, for the applicable legal period.

6. Data recipients

Your data will not be transferred to third parties, except by legal obligation or to properly provide the service:

  • Payment providers: Stripe and PayPal for subscription management (we do not store banking data).
  • Hosting providers: Base44 (hosting platform).
  • Notifications: WhatsApp (via links) and Telegram for order notifications.

7. User rights

Under the GDPR, you have the following rights regarding your personal data:

  • Access: You may request information about what data of yours we are processing.
  • Rectification: You may request the correction of inaccurate or incomplete data.
  • Erasure (right to be forgotten): You may request the deletion of your data when no longer necessary.
  • Restriction of processing: You may ask us to restrict the processing of your data.
  • Portability: You may request to receive your data in a structured, readable format.
  • Objection: You may object to the processing of your data for direct marketing purposes.

To exercise any of these rights, you can contact us through the contact form on the website. We will reply within a maximum of 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

8. Cookies

This platform uses its own and third-party cookies to ensure the proper functioning of the service:

  • Technical cookies (necessary): They allow navigation and the basic functioning of the platform (session and order management). User consent is not required.
  • Analytics cookies: Used to collect anonymous statistics about platform usage (Google Analytics).

By accepting the cookie banner, you consent to the use of analytics cookies. You may withdraw your consent at any time. For more information, see our cookie policy.

9. Minors

The platform's services are aimed exclusively at people over 18 (restaurants) and their customers (diners). We do not knowingly collect data from minors. If a restaurant uses the platform, it is responsible for ensuring its customers comply with applicable regulations.

10. Security measures

We implement appropriate technical and organisational measures to protect your personal data, including:

  • SSL/TLS encryption on all communications.
  • Secure storage with restricted access.
  • Secure authentication for access to the admin panel.
  • Periodic security reviews.

11. Contact

For any enquiry about this privacy policy or the processing of your personal data, you can contact us through the contact form on the website.

Last revision: 27 June 2026. This policy may be updated periodically; we recommend reviewing it from time to time.

← Back to MenuQR