Privacy & Cookie Policy

1. Who we are

Taptop Tech SARL (“Menukits”, “we”, “us”) operates the Menukits website and platform. For processing activities where we determine the purposes and means of processing, Taptop Tech SARL acts as data controller.

Controller contact: hello@taptop.lu. Registered office: 117 Val des Bon-Malades, L-2121 Luxembourg, Luxembourg.

2. Scope of this Policy

This Policy explains how personal data are handled when you visit menukits.eu, contact us, create or use a Menukits merchant account, interact with our sales/support teams, purchase products, or use a guest-facing Menukits experience. Where Menukits processes guest or restaurant data solely on instructions from a restaurant customer, Menukits generally acts as processor and the restaurant remains the controller for that processing.

3. Personal data we may process

• Identity and business contact data: name, restaurant/company, role, email address, telephone number and business address.
• Account data: login identifier, authentication/security information, plan, permissions and account activity.
• Commercial and billing data: subscription, order, invoice, payment-status and transaction information. Full card details should normally be handled by the payment provider rather than stored by Menukits.
• Restaurant content: menu information, dish content, images and metadata where they can be linked to an identifiable person.
• Guest/order data: information submitted through a restaurant’s Menukits interface, such as name, contact details, pickup/order details or requests, depending on the restaurant’s configuration.
• Support and communications data: messages, requests, feedback and records of interactions with Menukits.
• Technical data: IP address, browser/device information, security logs, timestamps, identifiers and diagnostic information.
• Cookie and analytics data: where permitted and, for non-essential technologies, after valid consent where required.

4. Purposes and legal bases

Where we rely on legitimate interests, we consider whether those interests are overridden by the rights and interests of the individuals concerned.

5. When Menukits acts as processor

A restaurant customer may use Menukits to process personal data relating to its guests, staff or end users. For such processing, the restaurant normally determines why the data are processed and Menukits processes the data on documented instructions. The Menukits Data Processing Agreement governs this processor relationship.

6. Recipients and service providers

We may disclose personal data to service providers that support hosting, infrastructure, payments, communications, customer support, analytics, security or AI-assisted features, and to professional advisers or public authorities where legally required. Service providers handling personal data for us are subject to appropriate contractual and data-protection obligations.

The list above reflects the principal service providers currently identified for Menukits. Additional providers will be added where they process personal data on behalf of Menukits.

7. International data transfers

Where personal data are transferred outside the European Economic Area, we will use a lawful transfer mechanism where required, such as an adequacy decision, the European Commission Standard Contractual Clauses or another mechanism recognised under the GDPR, together with supplementary measures where appropriate. Details of relevant transfer safeguards will be made available on request where required by law.

8. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with applicable legal, accounting and tax obligations. Account and service data may be retained for the duration of the customer relationship and for a reasonable period after termination where necessary for account closure, support, security, dispute resolution or legal claims. Billing, invoice and transaction records may be retained for the period required under applicable Luxembourg accounting and tax laws. Security logs, support records and cookie-consent records are retained only for as long as reasonably necessary for operational, security, compliance and evidentiary purposes. When personal data are no longer required, they are deleted, anonymised or otherwise securely disposed of in accordance with applicable law.

9. Your GDPR rights

Subject to the conditions and limitations of the GDPR, individuals may have the right to access their personal data, rectify inaccurate data, request erasure, restrict processing, object to certain processing, receive portable data, and withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Requests may be sent to hello@taptop.lu. We may need to verify identity before responding. Where Menukits processes data solely on behalf of a restaurant, we may refer the request to the relevant restaurant or assist it in responding.

10. Complaints

You may lodge a complaint with the Luxembourg supervisory authority: Commission nationale pour la protection des données (CNPD). You may also have the right to complain to another competent supervisory authority in the EU/EEA depending on your circumstances.

11. Security

We implement technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures are selected with regard to risk and may include access controls, authentication, encryption in transit, backups, logging, vulnerability management and supplier controls as appropriate. No online system can be guaranteed to be completely secure.

12. Children

Menukits is a business and restaurant technology service and is not directed to children as account customers. Guest-facing restaurant menus may be viewed by people of all ages, but Menukits does not intentionally seek to collect children’s personal data beyond what is necessary for a restaurant-configured transaction or service.

13. Cookies and similar technologies

Menukits may use cookies, local storage and similar technologies. Under Luxembourg rules, cookies that are strictly necessary for providing a service expressly requested by the user may be used without prior consent. Non-essential cookies or similar technologies generally require prior consent.

13.1 Cookie categories

• Strictly necessary: authentication, security, session continuity, load balancing, consent storage or functions necessary to provide a requested service.
• Preferences: optional settings that remember choices where they are not strictly necessary.
• Analytics: measurement of site or product usage. Non-essential analytics should not be activated before consent where consent is required.
• Marketing / advertising / social tracking: technologies used to profile users, measure campaigns or support targeted advertising. These require consent where applicable.

13.2 Your cookie choices

Where non-essential cookies are used, the Menukits consent interface should allow users to accept, reject or choose by purpose before those technologies are activated. Refusing non-essential cookies must not prevent access to core website functions that do not depend on them. Users must be able to withdraw consent as easily as they gave it, for example through a persistent “Cookie settings” link.

The CNPD recommends that cookie consent generally not be treated as valid for more than 12 months before it is requested again, unless changes require an earlier refresh.

13.3 Current cookie list

The cookies and similar technologies currently used by Menukits, including their provider, purpose, category and duration, are described in the Cookie Settings interface available on menukits.eu. This information may be updated when our website configuration or service providers change. Non-essential technologies will be activated only in accordance with the consent choices presented to the user where consent is required.

14. AI-assisted features

Where Menukits uses AI-assisted services to translate, classify, improve or generate content, we will seek to limit personal data sent to such services to what is necessary for the requested function. Where an external AI provider processes personal data on our behalf, it should be assessed and contractually managed as a processor/subprocessor as appropriate. Customers should avoid entering unnecessary personal data into free-text AI fields.

15. Changes to this Policy

We may update this Policy to reflect legal, technical or operational changes. The current version and effective date will be published on menukits.eu. Material changes may also be communicated through the account interface or by email where appropriate.

16. Contact

For privacy questions or rights requests, contact: hello@taptop.lu.