Skip to content
Ombrelo
Start

Draft — needs review by a lawyer before publication. Fields in brackets, e.g. [Company name], must be filled in.

Privacy policy

Last updated:

We keep as little data as possible. The guest on the sunbed does not create an account and does not give a name or email to order. Here we explain what we process, why, for how long, and what rights you have under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Greek Law 4624/2019.

Language. This is an English translation of the Greek original, provided for convenience. If the two versions differ or conflict, the Greek version prevails.

Contents
  1. 1.Who is responsible for the data
  2. 2.Contact details
  3. 3.Data of a business’s guests
  4. 4.Data of owners and staff
  5. 5.Visitors to this website
  6. 6.Purposes and legal bases
  7. 7.Processing with artificial intelligence
  8. 8.Who receives data
  9. 9.Transfers outside the EEA
  10. 10.How long we keep data
  11. 11.Security
  12. 12.Your rights
  13. 13.Complaint to the data protection authority (ΑΠΔΠΧ)
  14. 14.Children
  15. 15.Changes to this policy

1. Who is responsible for the data

Ombrelo has two different roles, depending on the data:

  • Data of a business’s guests. When a guest opens a business’s menu from the QR code, orders, pays or makes a booking, the controller is the business (e.g. the beach bar). Ombrelo is the processor: it processes the data on the business’s behalf and according to its instructions, under the Data processing agreement (Article 28 GDPR). For requests about this data, contact the business first; if they come to us, we will forward them and help the business respond.
  • Account and website data. For the data of the owners and staff who use the dashboard, for the subscription and invoicing, and for visitors to this website, the controller is Ombrelo.

2. Contact details

[Company name], Greek tax ID (ΑΦΜ) [ΑΦΜ], [Address]. For personal data matters: [email]. Data protection officer (DPO): [name and email, or “no DPO appointment required”].

3. Data of a business’s guests

This is what we process on behalf of the business when someone uses its menu:

CategoryWhat exactly
Anonymous device identifierA random code created on the phone (local storage), so that the guest can see their orders and the spot’s bill stays correct. It contains no name, email or phone number.
OrdersProducts, quantities, options, notes (e.g. “no ice”), spot (e.g. umbrella C7), time, status, amount.
Language and countryThe language the guest chose or that their phone shows (cookie bo_locale). With the order we also keep the country of the phone's language setting (e.g. “de-AT” → Austria), only when the phone shows one, for the business's overall statistics.
Menu usageAnonymous events such as “opened dish X”, “used the allergen filter” or “searched the menu and N dishes were found”, linked only to the anonymous identifier, for the business’s statistics. The business only sees what kind of thing was asked for, never what the guest wrote. The allergen filter choices are also stored on the device.
Phone number or browser notification (optional)Only if the guest asks to be notified by SMS, WhatsApp or a browser notification when the order is ready.
PaymentsAmount, tip, bill splitting, status and transaction ID. Payment is made through Stripe: the card number goes directly to Stripe and we never see it.
Bookings (if the business uses them)The name and phone number or email that the guest gives for the booking, date, spot and prepayment.
Ratings and commentsThe rating and whatever the guest writes after the order.
Texts processed by AIMessages to the AI waiter, and order notes that are translated for the staff (see section 7).
Technical dataIP address and browser type, for security and protection against abuse (rate limiting). They are not used for tracking or advertising.

We do not ask the guest for a name, email or location in order to order, and we do not build a profile of them.

4. Data of owners and staff

  • Account: name, email, password (stored only as a bcrypt hash; we cannot see it), role. If you sign in with Google, we receive from Google only your email address and the confirmation that it is yours, never your password or your contacts.
  • Business details: venue name and address, location on the map, time zone, menu, settings.
  • Tax and invoicing: legal name, tax ID, tax office, invoicing address and email, subscription and payment history (through Stripe).
  • Shifts: names and working hours of the staff, if the business uses shifts. These are entered by the business, which is also their controller.
  • Activity logs: logins and important changes (e.g. who changed a price), for security and support.
  • Communication: whatever you write to us when you ask for help.

5. Visitors to this website

On the public pages we count visits with Umami, without cookies and without storing the IP address: the page, where you came from, the type of browser and device, the language and the country. The legal basis is our legitimate interest in knowing how the website is used (Article 6(1)(f) GDPR). [Provider: Umami Cloud or our own installation, and where the data is hosted] We use no advertising tools. The server briefly keeps technical logs (IP address, time, page) for security. See also the Cookie policy.

6. Purposes and legal bases

PurposeLegal basis
Providing the Service to businesses (accounts, menus, orders, screens, map)Performance of a contract (Article 6(1)(b) GDPR)
Guests’ orders, payments and bookings, on behalf of the businessThe business, as controller, relies on performing the order or booking that the guest requests (Article 6(1)(b))
Notification by SMS, WhatsApp or browser when the order is readyThe guest’s consent (Article 6(1)(a)), which can be withdrawn at any time
Invoicing subscriptions and tax obligationsLegal obligation (Article 6(1)(c))
Security, prevention of fraud and abuse, rate limitingLegitimate interest (Article 6(1)(f))
Support and quality control, including our staff’s logged access to accounts (see the Terms of use)Performance of a contract and legitimate interest
Improving the Service with aggregate statisticsLegitimate interest; you can object
Updates to businesses about the subscription and the ServicePerformance of a contract; for newsletters, legitimate interest with the option to unsubscribe

We do not sell data, we do not show advertising and we do not take decisions based solely on automated processing that have legal effects for you.

7. Processing with artificial intelligence

For translating the menu and notes, reading menus from a photo, the AI waiter, the AI manager and the AI advisor, we use models from Anthropic (Claude). We send only the text needed each time: the menu, the guest’s message, or aggregate sales and stock figures. We do not send payment details or phone numbers.

Under its commercial terms, Anthropic does not use this data to train its models and deletes it after a limited period [confirm the provider’s terms and retention period]. The AI’s answers are an aid and may contain mistakes.

8. Who receives data

  • Sub-processors that help us run the Service (hosting, Stripe, Anthropic, SMS/WhatsApp provider, myDATA provider). The full list is in the Data processing agreement.
  • The Open-Meteo weather service receives only the venue’s coordinates, not personal data.
  • The business itself, for its guests’ data.
  • Public authorities, only when the law requires it (e.g. ΑΑΔΕ, the Greek tax authority, for tax documents).

9. Transfers outside the EEA

Some providers (e.g. Anthropic, Stripe) may process data in the US. Transfers are based on the adequacy decision for the EU–US Data Privacy Framework, where the provider is certified, or on standard contractual clauses (Article 46 GDPR) with supplementary measures where needed.

10. How long we keep data

DataHow long we keep it
Anonymous identifier and cart on the deviceOn the guest’s device, until they clear their browser data
Orders, payments and bookingsAs long as the business keeps its account, and where required for tax reasons up to [5 years]
Phone number or notification subscriptionDeleted [30 days] after the order
Messages to the AI waiter[90 days]
Ratings and commentsAs long as the business keeps its account
Anonymous menu usage events[13 months], then only in aggregate
Owner and staff accountsFor as long as the subscription lasts, and up to [90 days] after deletion
Subscription invoicesAs long as tax law requires
Security logs and the support access log[12 months]

11. Security

  • Encrypted connection (HTTPS/TLS) on every page and every request.
  • Passwords stored only as a cryptographic hash (bcrypt).
  • Roles and permissions: each staff member sees only what they need, and each business only its own data.
  • Our staff’s access to accounts is logged and read-only by default.
  • Card details do not pass through our servers.
  • Rate limiting on the public endpoints of the Service, and backups.

12. Your rights

You have the right:

  • to know what data of yours we process and to get a copy (Article 15),
  • to ask for correction (Article 16) or deletion (Article 17),
  • to ask for the processing to be restricted (Article 18),
  • to receive your data in a machine-readable format (Article 20),
  • to object to processing based on legitimate interest (Article 21),
  • to withdraw your consent at any time, without affecting what was done before.

Write to us at [email]. We reply within one month. If you are a guest of a business, the request goes to the business; if it comes to us, we will forward it. Because we do not know your name, you may need to give us the order code or make the request from the same device, so that we can find your data (Article 11).

13. Complaint to the data protection authority (ΑΠΔΠΧ)

If you believe your rights are being violated, you can lodge a complaint with the Hellenic Data Protection Authority (ΑΠΔΠΧ), 1–3 Kifisias Avenue, 115 23 Athens, Greece, www.dpa.gr. We would appreciate it if you wrote to us first, so that we can try to resolve it.

14. Children

The Service is aimed at businesses. We do not knowingly ask for data from children under 15. Selling alcohol to minors is prohibited, and it is the business’s responsibility to check.

15. Changes to this policy

If something important changes, we will inform businesses by email or in the dashboard and change the date at the top of this page.