Legal document

Privacy and cookie policy

Last updated: 20 October 2026 · Version 2.0

This is a translation for convenience. In case of discrepancy, the Italian version prevails.

1. Data controller and contacts

The data controller is Vito Vecchio, who provides the service under the NDEFY brand (“NDEFY”, “we”).

• Registered address: [full address to be added]
• VAT number / Tax code: [to be added]
• Certified email (PEC): [to be added]
• Privacy email: privacy@ndefy.com · General enquiries: info@ndefy.com

Given the size and nature of its activities, NDEFY is not required to appoint a Data Protection Officer under Art. 37 GDPR. You can use the contacts above for any request.

2. Who decides on the data: NDEFY and the venues

NDEFY is a platform that venues (restaurants, bars, hotels, shops and other businesses: the “Clients”) use to manage NFC and QR tags, digital menus, orders, deliveries, bookings, requests, loyalty programmes and WhatsApp messages with their guests.

• NDEFY is the controller of the data of Clients and the people who represent them (account, billing, support), of visitors to ndefy.com and of aggregated technical statistics on how the service works.
• The venue is the controller of its guests' data collected through NDEFY. NDEFY processes it as a processor under Art. 28 GDPR, only on the venue's instructions and under the data processing agreement included in the Terms and conditions.

If you are a guest of a venue and want to exercise your rights, you can contact the venue directly; if you write to us, we will forward the request to the venue without delay and help it reply.

3. What data we process

3.1 Clients and their staff

• Identification and contact data: first and last name, email, phone, role, name and address of the venue.
• Tax and administrative data: company name, VAT number, e-invoicing code or certified email, quote and subscription details.
• Access and security data: one-time sign-in codes sent by email, active sessions (device and dates), log of operations (audit log).
• Uploaded content: menus, photos, prices, allergens, translations, pages, texts of preset messages.
• Payment data: handled by Stripe; NDEFY never sees or stores full card numbers.

3.2 Visitors to ndefy.com

The website is static: it uses no forms, analytics or advertising tools. Cloudflare's servers, which host it, process the technical data needed to deliver the pages and protect them from attacks (IP address, date and time, browser) for the strictly necessary time. If you email us, we process the data you send us in order to reply.

3.3 Tag statistics

When a tag is opened we record only the date and time, the device category (for example phone or computer), the country reported by Cloudflare and the referring site's domain, if available. We do not store the IP address or device fingerprints, and this information does not identify who tapped the tag.

4. Purposes and legal bases (data for which NDEFY is controller)

Providing the data needed for the contract is mandatory: without it we cannot activate the service.

5. Venue guests' data (NDEFY as processor)

Depending on the services the venue switches on, NDEFY processes on its behalf:

• Table orders and home deliveries: items ordered, notes, amounts, payment status; for deliveries also name, phone and delivery address.
• Bookings: name, contacts, date, party size, preferences and notes.
• Loyalty programme: name, phone, email and date of birth if recorded by the venue, stamps or points collected, rewards redeemed, consent to receive promotions.
• WhatsApp messages: phone number, profile name, content of the messages exchanged with the venue, delivery and read status.
• Online payments: handled by Stripe on the venue's behalf; NDEFY receives only the outcome and amount.
• Preferred language chosen on the menu, stored only in the guest's browser.

The legal bases are set by the venue: usually performance of a contract (order, delivery, booking) and, for promotional messages and the loyalty programme, the guest's consent, which can be withdrawn at any time by replying “STOP” to the message or by asking the venue. NDEFY only allows promotional messages to be sent to contacts for whom the venue has recorded consent.

6. Providers and recipients

We do not sell or hand over personal data. We share it only with the providers we need to deliver the service, appointed as processors or sub-processors:

Data may also be received by advisers (accountant, lawyer) bound by confidentiality and by authorities where required by law. The up-to-date list of sub-processors is available on request.

7. Transfers outside the European Union

Some providers are based in the United States. Transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, for certified providers, or on the standard contractual clauses approved by the Commission (Art. 46 GDPR), with additional security measures such as encryption in transit and at rest. You can ask us for a copy of the safeguards applied.

8. How long we keep data

• Account data and content: for the whole term of the contract; after termination we archive it for 90 days so it can be exported or restored, then we delete it.
• Accounting and tax records: 10 years, as required by Art. 2220 of the Italian Civil Code.
• Tag statistics and operation history: for the period set by the venue's plan, then deleted automatically.
• Sign-in codes: a few minutes; sessions: at most 30 days of inactivity and 90 days in total.
• Guests' data: for the time decided by the venue; on termination it is returned or deleted following the venue's instructions.
• Technical logs of infrastructure providers: for the short periods set by their services.

9. Security

We apply appropriate technical and organisational measures (Art. 32 GDPR): encrypted HTTPS connections, AES-GCM encryption of Wi-Fi passwords and messaging channel tokens, passwordless sign-in with one-time codes, roles and permissions per person and per location, isolation of data between venues, a log of operations, archiving instead of immediate deletion, and database backups. In the event of a personal data breach we will notify the supervisory authority and, where necessary, the people and venues concerned, within the times set by Arts. 33 and 34 GDPR.

10. Your rights

Under Arts. 15–22 GDPR you can ask at any time for:

• access to your data and a copy of it;
• correction of inaccurate data or completion of incomplete data;
• erasure, when there is no longer a reason to keep it;
• restriction of processing;
• portability, in a structured, machine-readable format;
• to object to processing based on legitimate interest and, always, to direct marketing;
• to withdraw consent, without affecting earlier processing.

Write to privacy@ndefy.com: we reply within one month, extendable by two months for complex cases. We may ask you to confirm your identity. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the authority of the EU country where you live or work.

11. Cookies and similar technologies

ndefy.com sets no profiling cookies and no third-party cookies for statistics or advertising. Cloudflare may set technical security cookies (for example __cf_bm, lasting 30 minutes) to tell people from bots: they are strictly necessary and do not require consent (Art. 122 Italian Privacy Code and the Italian DPA's guidelines of 10 June 2021).

The NDEFY app and the pages opened by tags use only technical tools:

Because we use only technical tools, we do not show a consent banner. You can still delete or block cookies in your browser settings: some features, such as staying signed in, may stop working. Payments take place on Stripe pages, which apply their own cookie policy.

12. Minors

The service is intended for professionals and is not aimed at children under 14. Underage guests can browse menus and pages without providing data; for the loyalty programme and promotional messages the venue must collect consent only from people aged at least 14 (Art. 2-quinquies Italian Privacy Code).

13. Automated decisions and artificial intelligence

NDEFY makes no decisions based solely on automated processing that produce legal or similarly significant effects on people (Art. 22 GDPR). Artificial intelligence features, if switched on by the venue, are used to translate menu texts and to reply to chats, handing over to a person when needed; translated texts are labelled as such and the venue can check and edit them. The “Complete your order” suggestions are based on aggregated, anonymous sales, not on individual profiles.

14. Changes to this policy

We may update this policy because of changes to the service or the law. The date at the top shows the latest version; for significant changes we will notify Clients by email or in the app at least 15 days in advance.

See also the Terms and conditions of service, which include the data processing agreement for venues.