Privacy Policy

The data controller for the Enefsis platform is:

For any privacy-related enquiries, please contact us at support@enefsis.com.

We collect different categories of personal data depending on whether you are a registered business client or a guest visiting a client's NFC-powered page.

Business Clients

When you create an Enefsis account and manage your digital presence through our dashboard, we collect:

• Full name and email address
• Business name, city, and restaurant type
• Payment information (processed by Stripe — we do not store raw card data)
• Menu content, opening hours, and other page configuration you provide
• Account activity logs (page saves, logins)

Guests (NFC landing page visitors)

Analytics data is collected only with your explicit consent. If you decline the cookie consent banner, no tracking data is stored. If you accept, we collect:

• Anonymous visitor ID (randomly generated, stored in your browser only)
• Device type (mobile or desktop)
• Tap / page-view events with timestamp
• Table number (if present in the NFC link)
• Button clicks (e.g. Google Review, Instagram, Call Waiter)
• Menu item views
• Browser language preference
• Country derived from IP address (IP is not stored)

You may request deletion of your data at any time by contacting support@enefsis.com, unless retention is required by law.

We share data with the following sub-processors solely to operate the service. All processors are bound by Data Processing Agreements. Transfers to the United States are covered by Standard Contractual Clauses (SCCs) approved by the European Commission.

As a data subject under the General Data Protection Regulation you have the following rights:

• Right of access (Art. 15) — obtain a copy of all personal data we hold about you
• Right to rectification (Art. 16) — have inaccurate or incomplete data corrected without undue delay
• Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten") where no legal obligation requires us to retain it
• Right to restriction of processing (Art. 18) — ask us to suspend processing of your data in certain circumstances
• Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format and transfer it to another controller
• Right to object (Art. 21) — object at any time to processing based on legitimate interests; we will cease unless we can demonstrate compelling legitimate grounds
• Right to withdraw consent (Art. 7(3)) — withdraw any previously given consent at any time; withdrawal does not affect the lawfulness of prior processing

To exercise any of these rights, email us at support@enefsis.com. We will respond within 30 days of receipt.

You also have the right to lodge a complaint with the Austrian supervisory authority:

Enefsis uses browser localStorage rather than traditional HTTP cookies. The table below explains what is stored and why.

The following localStorage keys are used on NFC landing pages:

• enefsis_cookie_consent — records your consent choice (accepted or declined)
• enefsis_visitor_id — randomly generated anonymous ID for session analytics (written only after consent is accepted)
• enefsis_lang — your selected display language

Withdrawing consent: clear your browser's site data for the relevant domain (Settings → Privacy → Clear browsing data, or equivalent). This removes all stored keys and resets consent — the banner will reappear on your next visit.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the service after changes are posted constitutes acceptance of the updated policy. For material changes, we will notify registered clients by email.