Consumer and End User Privacy Policy

Legal document

Privacy information for consumers, end customers and webapp users.

Version 1.0 Last update date: June 6, 2026 Effective date: [●]

1. Data controller

This information describes how Dishup S.r.l., with registered office in [●], tax code and VAT number [●], PEC [●], e-mail privacy [●] ("Dishup"), processes the personal data of end customers who use the Dishup webapp, site, customer accounts, wallets, notifications and other digital features ("Customer" or "User").

Dishup processes some data as an independent data controller. Restaurants, bars, clubs and other businesses that use Dishup ("Restaurateurs") process other data as independent data controllers for the sale, administration, preparation, delivery, assistance, taxation and management of the relationship with the Customer.

When Dishup processes data on behalf of the Restaurateur, Dishup acts as data processor under the agreement entered into with the Restaurateur. This information concerns the processing carried out by Dishup as an independent data controller, unless otherwise indicated.

2. When this policy applies

This information applies when the Customer:

visit or use the Dishup web app or pages /dine;
create or use a customer account;
log in through Google, Apple or other supported providers;
consult menus, open sessions, send orders or pay;
use wallets, vouchers, local credit, dishband or similar tools;
receives operational or push notifications;
requests assistance from Dishup;
exercise privacy rights or send communications to Dishup.

For processing activities carried out by the Restaurateur, the Customer must also consult the Restaurateur's privacy policy.

3. Personal data processed

Dishup may process the following categories of data:

Identification and contact data: name, surname, display name, email, telephone, language, avatar, account identifiers.
Authentication data: provider used, provider identifier, technical tokens, sessions, refresh token, access log, device.
Order and session data: restaurant, table, session, items ordered, quantity, notes, order status, payment status, receipts, collection, delivery, operational history.
Payment data: technical payment identifiers, amounts, currency, outcome, provider, latest non-sensitive information returned by the payment provider. Dishup does not store your complete card number.
Wallet data and local credit: technical balances, top-ups, expenses, refunds, vouchers, QR presentation, movements, history and audit.
Tax data: if entered, name or company name, address, tax code, VAT number, PEC, recipient code and data necessary for the invoice or receipt.
Notification data: preferences, push tokens, browser endpoints, push status, read status, click status, device status, and user agent status.
Technical data: IP address, logs, browser, operating system, device identifiers, security events, technical cookies and similar tools.
Assistance data: requests, messages, attachments, evidence, contact and response history.
Voluntary data: order notes, food preferences or other information entered by the Customer.

The Customer must avoid entering unnecessary sensitive data. If you communicate allergies, intolerances, health information or specific dietary requirements, such data may be transmitted to the Restaurateur to manage the order.

4. Purpose and legal bases

Dishup processes data for the following purposes:

Purpose	Legal basis
Creation and management of customer accounts	Execution of the contract or pre-contractual measures
Authentication, login, token refresh and account security	Execution of the contract; legitimate interest in security
Consultation of menus, sessions, orders and operational status	Execution of the contract; legitimate interest in correct provision
Digital payments and technical reconciliation	Execution of the contract; legal obligations; legitimate anti-fraud interest
Wallets, vouchers, local credit and movements	Execution of the contract; legal obligations; legitimate anti-fraud interest
Operational notifications on orders, payments, receipts and collection	Execution of the contract; legitimate operational interest
Browser push notifications	Consent or browser settings, where required
Assistance, complaints and dispute management	Execution of the contract; legitimate interest; legal obligations
Security, fraud prevention, abuse, chargebacks and audits	Legitimate interest; legal obligations
Tax, accounting, legal obligations and defense of rights	Legal obligations; legitimate interest
Product improvement and aggregate statistics	Legitimate interest, where data is minimized or aggregated
Dishup direct marketing, if any	Consent or legitimate interest to the extent permitted
Non-technical cookies and tracking	Consent, where required

5. Relationship with restaurateurs

The restaurateur is normally an independent controller for:

sale and administration of food and drinks;
order preparation, collection, delivery and assistance;
information on ingredients, allergens, prices and availability;
issuing receipts, invoices and commercial documents;
management of commercial reimbursements, product complaints and healthcare obligations;
restaurant loyalty programs, vouchers or promotions, where activated.

Dishup can transmit to the Restaurateur the data necessary to manage the order, session, payment, invoice, collection or local credit.

6. Recipients of the data

The data can be communicated to:

Restaurateurs where the Customer interacts or orders;
payment providers, including Stripe and related banks/circuits;
cloud, hosting, database, security and monitoring providers;
email, push notification, messaging and support provider;
tax or billing providers, if activated;
authentication providers, such as Google or Apple;
legal, tax, accounting and auditor consultants;
authorities, law enforcement agencies or public entities in the cases provided for by law;
technical suppliers appointed as processors or sub-processors, where applicable.

The updated list of the main supplier categories can be requested from [●].

7. Non-EEA Transfers

Some suppliers may process data outside the European Economic Area. In such cases Dishup uses appropriate safeguards under the GDPR, such as adequacy decisions, standard contractual clauses, additional measures where necessary or other legitimate bases.

8. Retention

Dishup retains data for the time necessary for the purposes indicated. Indicatively:

account data: for the duration of the account and subsequent technical/administrative period;
order, payment, wallet and tax data: for the period necessary for legal, tax, accounting obligations, disputes, chargebacks and defense;
technical and security logs: for a period proportionate to the risk and audit needs;
push token and preferences: as long as active or until revoked/deactivated;
assistance requests: for the time necessary to manage the request and document the outcome;
data processed on consent: until revoked, unless retention is necessary for other legal bases.

The precise retention times are defined in the internal policies and may vary based on legal obligations, disputes, fraud, security or technical needs.

9. Rights of the data subject

The Customer may exercise, within the limits of the GDPR, the rights of access, rectification, erasure, restriction, objection and portability, revocation of consent and complaint to the supervisory authority.

Inquiries can be sent to [●]. Dishup may request information necessary to verify the applicant's identity.

For processing activities carried out by the Restaurateur as an independent controller, Dishup can refer the Customer to the competent Restaurateur.

10. Account deletion

The Customer can request deletion of the account using the available functions or by writing to [●].

Deletion does not result in the immediate removal of data that Dishup or the Restaurants must retain for legal obligations, payments, disputes, taxation, security, audits, assistance or defense of rights.

The use of cookies and similar tools is described in Cookie Policy. Non-technical cookies and tracking tools subject to consent are used only according to the preferences expressed by the Customer, unless otherwise required by law.

12. Complaints

The Customer may lodge a complaint with the Italian Data Protection Authority or with the competent authority of their Member State. Before filing a complaint, Customer may contact Dishup at [●] to allow for internal verification.

13. Changes

Dishup may update this policy. The changes will be published on the platform or communicated in an appropriate manner when relevant.

Privacy PolicyConsumers andEnd Users