Privacy Policy

1. Who we are

SIA INMENU ("inmenu", "we", "us") runs inmenu.eu, a digital QR menu and table-ordering service for restaurants, cafes and bars. We are the controller of the personal data described in this policy, except where section 4 says we act on behalf of a venue.

• Company: SIA INMENU
• Registration no.: 40203619690
• Address: Bikernieku iela 220-59, Riga, LV-1079, Latvia
• Email: [email protected]

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR).

Last updated: 9 October 2026.

2. Whose data this policy covers

This policy applies to three groups of people:

• Website visitors: anyone who visits inmenu.eu or the demo menu, or contacts us.
• Venue customers: restaurants, cafes, bars and their staff who register for, pay for or use an inmenu subscription and the inmenu dashboard.
• Guests: people who use a venue's inmenu menu to view it, order at the table or for delivery, or call a waiter. For guests, the venue decides how their data is used (see section 4).

Links in a menu to other services, such as a venue's social media pages or a delivery app, are covered by those services' own privacy policies.

3. What data we collect and why

We collect only the data we need to run the website and provide inmenu to venues. The table shows each type of data, why we use it and the GDPR legal basis.

Card details are entered directly with Stripe, our payment provider. We never see or store full card numbers.

You don't have to give us your data, but without the account details in the table we can't open an account or provide the service. We don't make decisions about you based only on automated processing.

4. Guests who use a venue's menu

When you use a venue's inmenu menu, the venue decides what guest data is collected and why. Under GDPR the venue is the controller and inmenu is its processor: we handle guest data only on the venue's instructions and under a data processing agreement with the venue.

On the venue's behalf we handle:

• your name, surname, phone number and email address
• the table number from the QR code, or your delivery address for delivery orders
• the items you order and your choices (for example size), notes you add, the order time and status
• "Call waiter" requests
• technical data needed to show the menu: IP address, browser and device type, chosen language and the cart cookie

Guests don't need an account. We pass orders and waiter calls to the venue in its dashboard and through the Telegram chat the venue has connected. We don't use guest data for our own marketing and we don't sell it. We may use anonymous, aggregated statistics, such as the number of orders, to improve inmenu.

If you have a question about your order data or want to use your rights, contact the venue first. We will help the venue respond.

5. Cookies

We use essential cookies to run the website, the dashboard and the menus: for example to keep you logged in, remember your language and hold a guest's cart. Stripe also sets essential cookies on payment pages to prevent fraud. Essential cookies don't need consent.

We use analytics cookies from Google Analytics and Semrush only if you agree. We don't use advertising cookies. You can change or withdraw your choice at any time in the cookie settings on our website or in your browser.

Our Cookie Policy explains the types of cookies we use in more detail.

6. Who we share data with

We don't sell personal data. We share it only with service providers that help us run inmenu, and only as much as each one needs. They act on our instructions under contracts that protect your data.

We may also share data:

• with venues, for guest orders placed through their menu (section 4)
• with authorities, courts or auditors when the law requires it, or to protect our rights
• with a buyer or successor if inmenu or its assets are sold or merged; they must follow this policy

7. Transfers outside the EEA

Our server is with Hostinger in the EU. Some providers, such as Cloudflare, Google, Semrush, Stripe and Telegram, may process data outside the European Economic Area (EEA). When that happens, we rely on one of these safeguards:

• a European Commission adequacy decision, including the EU–US Data Privacy Framework for certified US companies
• the European Commission's Standard Contractual Clauses

When a venue connects Telegram, order notifications pass through Telegram's servers, and Telegram processes them under its own privacy policy. You can ask us for a copy of the safeguards we use.

8. How long we keep data

We keep personal data only as long as we need it for the purposes in this policy or as the law requires. Then we delete it or make it anonymous.

We may keep data longer if we need it to handle a legal claim or a request from an authority.

9. How we protect data

We use technical and organisational measures that fit the risk, including:

• encrypted connections (HTTPS) for the website, dashboard and menus
• passwords stored only in hashed form
• access to personal data only for people who need it for their work
• regular software updates, backups and protection against attacks

No system is completely secure. If a data breach happens, we will notify the Data State Inspectorate and, where the risk to you is high, inform you directly, as the GDPR requires.

10. Your rights

Under the GDPR you have the right to:

• Access: get a copy of the personal data we hold about you
• Rectification: correct data that is wrong or incomplete
• Erasure: ask us to delete your data, unless the law requires us to keep it
• Restriction: ask us to limit how we use your data
• Portability: receive data you gave us in a machine-readable format, or have it sent to another company
• Objection: object to processing based on our legitimate interest, and to direct marketing at any time
• Withdraw consent: at any time, without affecting processing before you withdrew it

Venue customers can view and update most account data in the dashboard. For anything else, email [email protected]. We reply within one month and may ask you to confirm your identity first. Using your rights is free.

You can also complain to the Latvian data protection authority, the Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Riga, LV-1050, [email protected], www.dvi.gov.lv, or to the authority in your EU country.

11. Children

inmenu is a service for businesses, and venue accounts are for adults only. Anyone can view a venue's menu, but we don't ask guests their age and don't knowingly collect children's data beyond what is needed to show the menu and pass an order to the venue. If you think a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy when our service or the law changes. We will publish the new version on this page with a new "Last updated" date. If a change is significant, we will tell venue customers by email or in the dashboard before it takes effect.

13. Contact us

For questions about this policy or your personal data:

• Email: [email protected]
• Post: SIA INMENU, Bikernieku iela 220-59, Riga, LV-1079, Latvia