Everything your customers look for, in one place.

This Privacy Notice describes how TocTocMenu ("Provider", "we") collects, uses and protects the personal data of Users (restaurant owners) and End Customers who view the digital menus published via the Platform at https://www.toctocmenu.it. Processing complies with Regulation (EU) 2016/679 ("GDPR").

1. Data Controller

The Data Controller is TocTocMenu, reachable for any privacy-related matter at support@toctocmenu.it. No Data Protection Officer (DPO) is mandatorily appointed under Art. 37 GDPR; requests should be sent to the same address.

2. Personal data we collect

To provide the Service we process the following categories of data:

Regarding End Customers of the restaurant (people scanning the QR to view the menu), we do not collect direct identifying data. Only anonymous or pseudonymised technical data (IP, browsing information) needed to render the page correctly is processed.

3. Purposes of processing

• Service delivery: creating and managing the account, publishing digital menus, generating QR codes, offering Platform features.
• Payment management: processing monthly or annual subscriptions via PayPal and keeping the history of transactions and expirations.
• Customer support: responding to enquiries sent via the contact form or email.
• Security: preventing fraud, abuse, unauthorised access and protecting the Platform.
• Legal obligations: fulfilling tax, accounting and regulatory duties.
• Service communications: notices about subscription expiry, Platform updates, changes to the Terms.
• Platform improvement: aggregated and anonymous statistical analysis of Service usage.

4. Legal basis

We process your data on the following legal bases:

• Performance of a contract (Art. 6.1.b GDPR): to deliver the Service, manage the account and payments;
• Legal obligations (Art. 6.1.c GDPR): for invoicing and tax record-keeping;
• Legitimate interest (Art. 6.1.f GDPR): for Platform security, fraud prevention and non-promotional service communications;
• Consent (Art. 6.1.a GDPR): for any non-technical cookies and marketing communications, always revocable.

5. Recipients of data

We do not sell, rent or disclose your data. Data may be shared with third parties acting as autonomous controllers or processors, strictly for the purposes above:

• PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processing;
• Hosting providers — for data storage and Platform availability;
• Email providers — for transactional and support communications;
• Third-party automatic text-reading service — only if you use “Import from photo”: the menu photos you upload are sent to the service solely to read their text (dish names, descriptions, prices);
• Public authorities — within the limits of law.

6. Data transfers outside the European Union

Some providers (notably PayPal) may process data in countries outside the EU. Such transfers rely on appropriate legal safeguards under the GDPR, including Standard Contractual Clauses approved by the European Commission or adequacy decisions.

7. Retention period

• Account and content: for the entire duration of the subscription and up to 12 months after termination, unless otherwise requested by the User.
• Tax and accounting data: for 10 years, as required by Italian law.
• Technical and security logs: for a maximum of 12 months.
• Support communications: for the time needed to handle the request and a reasonable period thereafter for record-keeping.

8. Cookies

The Platform uses only technical cookies essential to the Service (keeping the login session, CSRF token, language preference). These cookies do not require consent under Art. 122 of the Italian Privacy Code. We do not use profiling cookies or third-party advertising trackers on management pages.

9. Your rights

At any time and free of charge you may exercise the following rights under Articles 15–22 GDPR:

• Access to your personal data;
• Rectification of inaccurate or incomplete data;
• Erasure ("right to be forgotten"), within legal limits;
• Restriction of processing;
• Portability of your data in a structured, machine-readable format;
• Objection to processing based on legitimate interest;
• Withdrawal of consent at any time, without affecting the lawfulness of prior processing;
• Complaint to the Italian Data Protection Authority (www.garanteprivacy.it).

Requests should be sent to support@toctocmenu.it; we will respond without undue delay and in any event within 30 days.

10. Security

We adopt appropriate technical and organisational measures to protect data from unauthorised access, loss or destruction: encrypted HTTPS connections, hashed passwords, CSRF tokens on forms, access controls on uploaded files, periodic backups and continuous system updates.

11. Minors

The Service is intended for adult business operators. We do not knowingly process data of minors under 16. If we become aware of any inadvertent processing, we will delete the data.

12. Changes to this Notice

We reserve the right to update this Notice at any time to reflect legal changes or new Platform features. The updated version will be published on this page with the latest revision date prominently shown. Material changes will be communicated by email.

13. Contact

For any question or request regarding the processing of personal data please write to support@toctocmenu.it.