Privacy Policy

1. Purpose and scope

This Privacy Policy explains how World Travel Club s.r.o. (the Company, MenuAI, we, us or our) processes personal data in connection with MenuAI websites, business accounts, guest-facing services, the partner programme and communications with us. Personal data means information relating to an identified or identifiable individual. Processing includes collecting, using, disclosing, storing and deleting that information.

This Policy applies to visitors, prospective customers, business owners and their representatives, authorised staff, partners and guests, to the extent that we process their personal data. The information relevant to you depends on the service and features you use. Visiting a public page does not mean that all categories of data described below are collected about you.

We distinguish our own processing as a controller from processing carried out on a venue’s instructions. A venue’s privacy notice governs the purposes it determines. This Policy supplements, rather than replaces, information provided at the point of collection and any applicable data processing agreement. It is not a contract for purchasing food or venue services.

Reading this Policy or continuing to use a service does not constitute consent to all processing. Where consent is required, it must be obtained separately for the relevant purpose. We process personal data subject to the General Data Protection Regulation (EU) 2016/679 (GDPR) and other applicable data protection requirements.

2. Who we are and how to contact us

The operator of MenuAI is World Travel Club s.r.o., company identification number (IČO) 07214073, with its registered office at Ostrčilovo náměstí 462/4, Nusle, 128 00 Praha 2, Czech Republic.

For questions about this Policy or to exercise your data protection rights, email team@menuai.pro or write to our registered office, marking your correspondence “MenuAI — Privacy”. The Company has not appointed a Data Protection Officer. The email above is our contact for privacy matters; it is not presented as a DPO appointment.

If your request concerns a particular venue, identify that venue and the relevant interaction where possible. Do not send passwords, payment card security codes or unnecessary sensitive information with your request.

3. Our role and the venue’s role

We act as a controller when we determine the purposes and essential means of processing, including administering our business relationships, MenuAI accounts and subscriptions, responding to enquiries, managing the partner programme, protecting our services and meeting our legal obligations. This can include personal data about an individual representing a company, even where the company itself is the customer.

A venue generally acts as controller for personal data used to handle its guest orders, reservations, delivery, events, customer relationships and loyalty programmes. Where we process that information solely to provide the venue with the service on its documented instructions, we act as processor. The venue must establish the lawful grounds for its processing, provide its own information to guests and give us lawful instructions.

A person’s status as a guest does not automatically make every processing activity a processor activity. For example, administration and security of a MenuAI account may involve our own controller responsibilities, while information associated with a venue’s order remains subject to the venue’s purposes and instructions. Roles must be assessed by the actual purpose, not merely by the type of user.

Where we act as processor, our assistance with requests, confidentiality, security, use of other processors and return or deletion of data are governed by the applicable data processing agreement and law. This Policy does not give us permission to reuse venue-controlled guest information for unrelated purposes.

4. Where personal data comes from

We receive information directly from you when you contact us, register, sign in, provide account or billing details, submit content or use an available feature. We also receive information from the venue or business that authorises your access, enters your booking or order, or manages the customer relationship concerned.

Connection and interaction information can be generated when your browser or device accesses a service. Depending on the feature, information may also come from a sign-in service you choose, a payment service, a partner referral, or an integration authorised by the relevant business. Such sources may provide identifiers, contact or transaction information necessary for the requested interaction, rather than unrestricted access to your other information.

Where we obtain data indirectly as controller, we provide the information required by law within the applicable period: normally no later than one month after obtaining it, and earlier where required by our first communication with you or first disclosure. Statutory exceptions apply only where their conditions are met. You may contact us to ask which source supplied your data.

5. Categories of personal data

Depending on your relationship with MenuAI and the functions used, the following categories may be processed. We do not require every category from every person.

• Identity, account and access data: name, email address, telephone number, account identifiers, profile image, preferred language, authentication and verification information, permissions and account status. Where a relevant guest feature allows it, an optional date of birth or profile preference may also be provided.
• Business and subscription information: the business you represent, your role, contact details, subscription and service history, communications and information needed to administer that relationship.
• Billing and financial records: billing name and address, registration or tax identifiers, country, currency, invoices, payment status, transaction references, payment method references and bank details where relevant to a payment, refund or partner payout. Tax evidence may include information establishing the customer’s location where required by the applicable rules.
• Guest and venue interaction data: menu selections, orders, reservations, delivery details, event participation, instructions, preferences, loyalty activity, reviews and service-related communications, according to the feature used and the venue’s instructions.
• Enquiry and support data: the contents of messages and attachments, name, email address and any telephone number or business information you choose to provide, together with correspondence needed to handle your request.
• Partner and attribution data: partner and referral identifiers, referral source and landing page information, eligible referrals, commission and payout records, and information used to assess disputed or abusive referrals.
• Device, connection and activity data: IP address or a derived identifier, browser and device information, language, timestamps, pages or features accessed, session information, referrer information, errors and security events. Not every interaction is necessarily recorded.
• Browser storage and communication preferences: identifiers and settings stored through cookies or similar technologies, consent or objection records where applicable, and choices about marketing or notifications.

6. Purposes and lawful grounds

A lawful ground is determined for each purpose and role. Our contract with a business does not automatically make processing about every employee or guest necessary for a contract with that individual. When we act as processor, the venue determines the lawful grounds and we process on its lawful instructions. For our controller activities, the following grounds apply as appropriate.

• Responding to enquiries and requests for a demonstration: taking steps at your request before entering a contract under Article 6(1)(b), where you would be the contracting individual; otherwise our legitimate interest under Article 6(1)(f) in responding to a relevant business enquiry and communicating with its representative.
• Providing accounts and administering subscriptions: Article 6(1)(b) where processing is objectively necessary for our contract with you; or Article 6(1)(f) for necessary administration of access and business relationships involving authorised representatives. The interests are providing the requested service, maintaining accurate account information and communicating with the appropriate people.
• Billing, accounting and compliance: Article 6(1)(c) for applicable tax, accounting and other legal obligations; Article 6(1)(b) for necessary contractual payment administration; and Article 6(1)(f) for establishing, exercising or defending legal claims where applicable.
• Security, service reliability and abuse prevention: Article 6(1)(f), for protecting accounts, users and services, investigating errors, preventing fraud and unauthorised access, and maintaining reliable operation. Article 6(1)(c) applies where a particular action is legally required. A security purpose does not justify collecting unlimited information.
• Partner programme administration: Article 6(1)(b) for an individual partner’s agreement, or Article 6(1)(f) for necessary administration involving a partner’s representatives, attribution disputes and fraud prevention. These grounds do not remove any separate requirement for consent to non-essential browser storage.
• Optional marketing and non-essential tracking: Article 6(1)(a) where consent is required. Where applicable law permits a particular direct marketing communication without prior consent, the relevant legitimate interest is communicating relevant business offers, subject to the applicable conditions and your right to object. Acceptance of account terms is not marketing consent.
• Individual privacy requests and regulatory matters: Article 6(1)(c) for complying with data protection duties and Article 6(1)(f) where necessary to document, establish or defend our legal position. Information obtained for identity verification is limited to what is reasonably necessary for the request.

Where we rely on legitimate interests, we must assess necessity and balance the relevant interests against your rights and reasonable expectations. You may request further information about that assessment and object as explained below. We do not rely on a general statement in this Policy as a substitute for that assessment.

Venue-controlled guests’ personal data is used only to serve the relevant venue and guest. We do not repurpose it to develop or improve services for unrelated venues. A new purpose would require its own lawful assessment and information before processing begins; this Policy is not advance permission for an unspecified future purpose.

7. Guest orders, venue services and loyalty

The venue or business owner is the seller of the food, goods and venue services offered to a guest. Guest payments go through the payment arrangements of that venue to the owner’s accounts. MenuAI does not receive the proceeds of those sales; MenuAI receives payment for its own platform subscriptions.

This separation of money flows does not mean that no personal data is processed. Order details, payment status or transaction references may be needed to provide the requested service. The venue and its payment service determine their respective responsibilities for the transaction, and their own privacy information also applies.

The venue determines how it uses guest information for fulfilment, reservations, delivery, loyalty and its own communications. Contact it about the underlying purchase, its customer records or its marketing. If you contact us about information we process only for that venue, we will identify the appropriate route and assist in accordance with our obligations rather than independently changing the venue’s records without authority.

When a venue links a guest account to an order or loyalty programme, the information made available must be appropriate for that relationship. An account relationship does not by itself authorise unrestricted sharing with other venues.

8. Allergies, dietary preferences and sensitive information

An allergy or dietary instruction may reveal health information, religious beliefs or other specially protected data. Such information requires the additional protection and lawful conditions applicable to special categories of personal data.

Where a venue collects this information for a requested meal, event or other service, it must identify an appropriate ground under Article 6 and, where the information falls within a special category, a valid condition under Article 9 GDPR. Contractual necessity or a legitimate interest alone is not an Article 9 condition. Where explicit consent is relied on, it must be specific and obtained through an appropriate separate process.

We process such venue-controlled information only within the relevant service and instructions, rather than for general guest profiling or cross-venue recommendations. Provide only what is needed for the requested service; do not submit medical records, identity documents or other unnecessary sensitive material in general contact or support messages.

You may ask the venue about its use of this information and any applicable consent withdrawal. Withdrawal does not affect prior lawful processing, but the venue may be unable to provide a particular personalised service without necessary information. It should explain any such consequence without making unrelated processing a condition of service.

9. Cookies, referral attribution and similar technologies

Websites and account services use browser technologies for functions such as maintaining a session, protecting access, remembering settings and carrying referral context. Referral information can include a partner code and an identifier for the referral interaction. The current website’s referral identifiers have a browser lifetime of up to 120 days. This is a browser-storage period, not a promise that every related business or commission record is deleted after 120 days.

Whether a technology requires consent depends on its actual purpose and the applicable rules. Calling a cookie “functional” or relying on legitimate interests for later data processing does not make non-essential storage exempt from prior consent. Analytics, advertising and other non-essential technologies must remain subject to the consent requirements that apply to them.

Where consent is the ground, you may refuse it or withdraw it without affecting earlier lawful processing. Use the consent controls offered for the relevant site or service. If you cannot find the relevant control, contact team@menuai.pro for assistance. Consent is specific to the purposes and information presented when it is requested; this Policy is not itself a request for consent.

Browser settings can block or delete stored information, although this may affect sign-in or settings and does not necessarily delete records already lawfully held by a controller. A choice on one domain may not automatically apply to a different domain. Information supplied with a particular consent request must explain the actual purposes, recipients and applicable choices.

10. Personalisation and automated processing

Available guest features can use selections, preferences and relevant interactions to present menu suggestions or personalisation for the venue and guest concerned. Where these activities evaluate a person’s preferences, they may constitute profiling for data protection purposes.

Menu suggestions are intended to assist a guest’s choice, not to make a decision with legal or similarly significant effects about that person. Nevertheless, the legal assessment depends on what a feature actually does and its effects, not its label. If a processing activity falls within Article 22 GDPR, the responsible controller must establish the applicable conditions, provide meaningful information about the relevant factors and consequences, and implement the required safeguards.

Where Article 22 applies, relevant safeguards can include obtaining human intervention, expressing your point of view and contesting the decision. Contact us about our controller activities or the venue about its decisions. We do not treat a general description of recommendations as a waiver of these rights.

11. Who may receive personal data

Access and disclosure must be limited to what is necessary for the particular purpose. Depending on the service and role, recipients may include the following categories.

• The venue or business you interact with, its authorised staff and service participants where their involvement is necessary to handle your request, order, delivery, reservation or account access.
• Providers supporting service operation, website content delivery, communications, identity verification, security, payment administration and customer support, to the extent they need the relevant information for those functions.
• Payment service providers, banks and financial institutions involved in your transaction, subscription or partner payout; these organisations may have their own controller obligations.
• Partners, only for information necessary to administer their referrals, commissions and related disputes; participation in a referral programme does not itself authorise unrestricted disclosure of guest records or message contents.
• Professional advisers and authorities where necessary for legal, accounting, regulatory, audit or dispute-related purposes and subject to the applicable legal conditions.
• A prospective or actual successor in a business reorganisation or transfer, only where a lawful basis and appropriate confidentiality and data protection safeguards apply. Any resulting change of controller must be addressed through the information required by law.

An organisation’s role depends on its actual activities. Not every recipient is our processor. Where a provider processes data on our behalf, an appropriate processing arrangement is required. Where we act for a venue, engagement of further processors must follow the authorisation and other requirements of the applicable agreement and law.

We do not sell personal data. You may request information about recipients of your own data and the applicable safeguards. Confidentiality of commercial arrangements does not remove an individual’s statutory right to information; any legally required disclosure must be handled through the appropriate lawful process.

12. Processing locations and international transfers

Personal data may be processed within the European Economic Area (EEA) and, depending on the services and recipients involved, outside it. The processing locations relevant to an interaction depend on the particular recipient and service, including any access from another country.

A transfer subject to Chapter V GDPR must meet its requirements in addition to having a lawful processing ground. Depending on the recipient and circumstances, this may involve a relevant European Commission adequacy decision or appropriate safeguards such as the applicable Standard Contractual Clauses, together with any required assessment and supplementary measures.

Exceptions for specific situations must not be used as a routine substitute for appropriate transfer arrangements. You may contact us to ask about the locations and transfer safeguards relevant to your data and to obtain a copy or explanation of applicable safeguards, with lawful redactions where necessary.

13. How long data is kept

Retention is determined by the purpose, our role, applicable statutory requirements and the need to establish, exercise or defend legal claims. We do not apply one universal period to all personal data, and closing an account does not necessarily require or permit immediate deletion of every associated record. The following criteria distinguish the main record types.

• Account and business relationship records: while needed to provide and administer the account or relationship, followed only by retention justified by unresolved obligations, a legal requirement or an applicable claims period. A possible future reactivation does not justify indefinite retention.
• Invoices, tax evidence and accounting records: for the statutory period applicable to the particular document or obligation. The relevant period and its starting point depend on the record, transaction and applicable accounting or tax rules.
• Enquiries and support correspondence: while handling the matter and afterwards where necessary to document its resolution, meet an obligation or address a reasonably relevant dispute. Message content should not be kept merely because storage is available.
• Security and activity records: for a period proportionate to detecting and investigating relevant incidents and protecting services, with longer preservation only where a specific incident, legal duty or claim justifies it.
• Referral and partner records: the browser identifier lifetime is described above; contractual attribution, commission, payment and tax records have separate retention needs determined by their purpose and legal requirements.
• Venue-controlled guest records: according to the venue’s lawful instructions and applicable agreement, including the arrangements for ending the service, returning data or deleting it, unless a legal requirement prevents deletion.
• Privacy requests and consent-related records: for as long as necessary to demonstrate the handling of the request, the relevant choice or compliance with the applicable obligation, without retaining unnecessary supporting information.

When retention is no longer justified, information must be deleted or rendered genuinely anonymous. Pseudonymisation, partial masking or removal from an active interface is not automatically anonymisation or complete erasure. Retained archival or recovery copies must remain protected and must not be used to bypass a valid restriction or deletion requirement.

You may ask for the retention period or the criteria applicable to your information. Where we cannot delete a record because of a legal obligation or a justified continuing purpose, we must explain the relevant reason rather than promise that account closure has erased everything.

14. Protection of personal data

We apply technical and organisational measures appropriate to the risks, taking account of the nature, scope, context and purposes of processing. Relevant controls include restricting access to authorised purposes, authentication and permission checks, protection of communications and measures to prevent misuse.

No service can guarantee absolute security. If a personal data breach occurs, the responsible controller and processor have duties to assess it, cooperate where applicable and make the notifications required by law. Where we act as processor, the venue must receive the assistance and incident information required by the applicable arrangement; where we act as controller, our own notification duties apply.

Use appropriate care with your account and contact us if you suspect unauthorised access. Your security precautions do not remove our own legal responsibilities.

15. Your data protection rights

Subject to the conditions of applicable law, you have the following rights. Their scope depends on the processing and lawful ground; they are not all unconditional rights to every record.

• Information and access: ask whether your personal data is processed, receive the information required by law and obtain access to and a copy of the relevant personal data, while respecting the rights and freedoms of others.
• Rectification: ask for inaccurate information to be corrected and incomplete information to be completed, taking account of the purpose of processing.
• Erasure: ask for deletion where a statutory ground applies, for example where information is no longer needed or processing is unlawful. Exceptions can apply, including a legal retention duty or the need to establish, exercise or defend legal claims.
• Restriction: ask for processing to be restricted in the circumstances provided by law, including certain disputes about accuracy or lawfulness, or while an objection is assessed. Restricted information may still be stored and used only as permitted by law.
• Portability: where processing is automated and based on consent or a contract, receive the personal data you provided in a structured, commonly used, machine-readable format and request transmission to another controller where technically feasible. This is subject to the rights of others and the statutory scope of the right.
• Objection: object on grounds relating to your particular situation to processing based on legitimate interests. The controller must stop that processing unless it demonstrates compelling overriding grounds or the processing is necessary for legal claims. You may object to direct marketing at any time, including profiling related to that marketing, without having to provide a particular reason.
• Withdrawal of consent: withdraw consent at any time where it is the ground for processing. Withdrawal must be as easy as giving consent and does not affect the lawfulness of earlier processing. Other processing with a separate lawful ground may continue.
• Automated decisions: exercise the protections applicable to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, subject to Article 22 and its exceptions and safeguards.
• Complaint and judicial remedy: complain to a competent supervisory authority and seek a judicial remedy as provided by law, without having to waive either route by contacting us.

16. How to exercise your rights

Send your request to team@menuai.pro or our registered office. Explain what you are requesting and provide enough information to locate the relevant relationship, such as the account email or venue concerned. You do not need to cite a particular legal provision or purchase a service to make a request.

Where we have reasonable doubts about identity or authority, we may request only the additional information reasonably necessary to verify it. We must not disclose another person’s information to an unauthorised requester. A representative may need to demonstrate authority to act on your behalf.

For our controller activities, we respond without undue delay and normally within one month of receiving the request. Where the law permits an extension because of complexity or the number of requests, the period may be extended by up to two further months; we must inform you within the first month and explain the reasons.

Requests are generally handled free of charge. A reasonable fee or refusal is possible only where permitted by law, including a demonstrably manifestly unfounded or excessive request. If we refuse to act, we must explain the reasons and the available complaint and judicial routes within the applicable period.

Where the venue is controller and we are processor, the venue is responsible for the substantive response. We will assist in the appropriate way under our obligations. Referring a request to the responsible venue does not remove our duties for any separate controller processing of our own.

17. Required information and your choices

Information is required only where needed for the particular service or a legal obligation. For example, account access requires appropriate identification and authentication information, invoicing may require billing and tax details, and a contact enquiry requires a name, email address and message. Telephone number and business type are optional in the website contact form.

If you do not provide information necessary for a requested function, that function or our response may not be possible. Optional profile details and consent-based marketing must not be treated as universally necessary for account access. Where a law requires particular information, the relevant requirement and consequence must be explained in the context concerned.

A service or security message, invoice or response to your enquiry is distinct from an optional promotional message. You may object to direct marketing or withdraw the relevant consent through an available unsubscribe mechanism or by contacting us. A marketing opt-out does not necessarily stop messages necessary to administer an existing service or meet a legal duty.

18. Children and young guests

Our business subscription services are intended for business use. A child visiting a venue or viewing a menu is a different situation from a person contracting for a business subscription. We therefore do not state that all guest-facing services categorically exclude every person below a single age threshold.

Where a service offered directly to a child relies on consent, the applicable national age requirements and any requirement for authorisation by a holder of parental responsibility must be respected. The venue must also assess its responsibilities for the guest services and data it controls. Children’s information must not be used for unrelated purposes merely because it was supplied during a venue interaction.

If you believe a child’s information has been processed unlawfully, contact us or the relevant venue. We will assess the matter within our role, including any required restriction, deletion or other corrective action. A parent or representative may need to establish their authority, taking account of the child’s own rights.

19. Other services and links

A payment service, external sign-in service, social network or website you choose to visit may process information under its own notice. Following a link or using that service may disclose connection information or the information you choose to submit. Providers delivering website content may also receive connection data needed to deliver the requested resource.

Our responsibility for selecting or using a recipient where applicable is not removed by a general reference to another organisation’s notice. Conversely, this Policy cannot determine the independent processing of a venue or external provider. Review the information relevant to the interaction and contact the responsible controller about its own purposes.

20. Supervisory authorities and complaints

You may contact us to raise a concern, but you do not have to contact us before lodging a complaint with a competent supervisory authority. Under the GDPR, this can in particular be the authority in the Member State of your habitual residence, place of work or the alleged infringement.

The Czech supervisory authority is Úřad pro ochranu osobních údajů (Office for Personal Data Protection). Its official website, https://uoou.gov.cz/, provides current contact details and information on submitting a complaint. The right to complain does not exclude a judicial remedy or any other right provided by applicable law.

21. Changes to this Policy

We may update this Policy to reflect changes in services, processing or legal requirements. A published version must identify its applicable update or effective date. Where a material change requires additional information, we will provide it through an appropriate channel before the relevant new processing begins, as required by law.

A revised notice does not retrospectively legitimise unlawful processing or replace consent where consent is required. If we propose a different purpose, we must assess compatibility or establish another applicable ground and provide the necessary information. Continued use alone is not consent to every new purpose.

22. Language versions and further information

All language versions of this Policy are intended to describe the same processing and rights. If you notice a discrepancy or need an explanation in an accessible form, contact team@menuai.pro. No language provision in this Policy limits mandatory rights or the obligation to provide information in a clear and understandable form.

For all enquiries about this Policy, the controller contact remains World Travel Club s.r.o., IČO 07214073, Ostrčilovo náměstí 462/4, Nusle, 128 00 Praha 2, Czech Republic; email: team@menuai.pro.