Privacy Policy

Last updated: 29 July 2026

This Privacy Policy explains how ProntoMenu ("ProntoMenu", "we", "us") processes personal data when you use our QR ordering and payment service (the "Service") to order and pay for items at a participating venue, and when you visit the ProntoMenu website - the platform's own pages on our domain, including its contact form (the "Site"). We process your data in accordance with Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. Data Controller

The data controller for the processing described here is PRONTO CHARGE SRL, Corso d'Italia, 29, 00198 Rome (RM), Italy, VAT/P.IVA 18262301007. You can contact us about privacy matters at info@prontocharge.it or on WhatsApp at +39 352 077 7880 (WhatsApp only). We have not appointed a Data Protection Officer; the contact above handles all data requests.

The venue that prepares and hands over your order is a separate controller for the in-venue fulfilment of that order. This policy covers only the data processed through the ProntoMenu platform.

2. What data we collect

  • Order data: the items you select, quantities, prices, the service charge, your pickup number, order identifier and the related timestamps (created, paid, collected, expired).
  • Payment data: payments are processed by Stripe on its own hosted checkout. Stripe collects your card details and may collect your name, email and billing information. We do not receive or store your full card number; we receive confirmation of payment and limited transaction metadata (for example a Stripe session reference and amount).
  • Technical data: when you load the Service, our hosting and infrastructure providers automatically process technical information such as your IP address, device and browser type, and server log data, for security and to deliver the page.
  • Usage data: how the menu and the Site are browsed - pages and sections viewed, items shown and tapped, cart actions, scroll and timing information - collected under a random session identifier stored for the duration of the browser tab only and deleted when the tab is closed. To recognize related sessions during the same UTC day, the server also creates a pseudonymous code using a secret-key hash of the IP address, browser user-agent and date. The code changes each day and is not stored on your device. The raw IP address and user-agent used to create it are not stored in the analytics database. IP addresses are also used in transit to derive an approximate location (city level) and to protect the Service. Device information is stored only in reduced form: general type, operating system and browser. This data is used for operational event views and aggregate statistics, not to discover your civil identity or for advertising. On the public ProntoMenu homepage only, normalized page, tap, scroll and sampled pointer positions are also sent to thatlev.com so its project portfolio can show one continuous pseudonymous visit. This does not run on venue menus, order pages, sign-in, admin or ops pages, and no form values or typed keys are sent.
  • Contact form data (business inquiries):if you use the Site's contact form to ask us about putting your venue on ProntoMenu, we collect what you submit - your name, your business name and, where you provide them, city, phone number, email address and comments - together with the approximate location (city level), general device type and language described under usage data.

We do not ask you to create an account, and we do not collect your name, email, phone number or marketing preferences through the ordering Service. Contact details reach us only if you choose to submit the Site's contact form.

3. Why we use your data and our legal basis

  • To provide the ordering and payment service (take, process and let the venue fulfil your order) - performance of a contract, Art. 6(1)(b) GDPR.
  • To process payments and prevent fraud- performance of a contract and our and Stripe's legitimate interests, Art. 6(1)(b) and 6(1)(f) GDPR.
  • To comply with tax, accounting and other legal obligations - Art. 6(1)(c) GDPR.
  • To keep the Service secure, debug issues and prevent abuse - our legitimate interests, Art. 6(1)(f) GDPR.
  • To measure and improve how the Service and the Site are used (audience measurement and product analytics) - our legitimate interest, Art. 6(1)(f) GDPR.
  • To respond to business inquiries submitted through the Site's contact form (contact you about putting your venue on ProntoMenu) - steps taken at your request prior to entering into a contract, Art. 6(1)(b) GDPR, and our legitimate interest in following up commercial inquiries, Art. 6(1)(f) GDPR.

4. Cookies

The Service uses technically necessary cookies and similar storage required to make ordering and checkout work. It also uses a first-party session identifier for audience measurement; this identifier is deleted when you close the tab. The daily server-side pseudonymous code described above is not written to cookies, local storage or session storage. We do not use profiling or advertising cookies, and these identifiers are not used to follow you across different days or unrelated websites.

5. Who we share data with

We share data only as needed to run the Service, with providers acting as our processors under data processing agreements, and with the venue fulfilling your order:

  • The venue - receives your order details and pickup number so it can prepare and hand over your order.
  • Stripe - payment processing.
  • Vercel - application hosting and image delivery.
  • Neon - database hosting for order records.
  • Telegram- if you submit the Site's contact form, a notification containing your inquiry is delivered to our staff as a message via the Telegram Bot API (Telegram Messenger Inc.), which may process data outside the EEA. The inquiry is also stored in our own database (Neon), which remains the primary record.

We do not sell your personal data and do not share it for third-party marketing.

6. International data transfers

Some of our providers (including Stripe and Vercel) are based in, or store data in, the United States, and certain infrastructure is hosted outside the European Economic Area. Where data is transferred outside the EEA, it is protected by appropriate safeguards under Chapter V GDPR, such as the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework. You can request a copy of the relevant safeguards using the contact details above.

7. How long we keep data

We keep order and transaction records for as long as needed to provide the Service and to meet our legal obligations - in particular, Italian accounting and tax rules generally require records to be kept for up to 10 years (Art. 2220 of the Italian Civil Code). Technical log data is kept for a shorter period needed for security and troubleshooting. Aggregate usage events are retained for up to 25 months and then deleted. Contact-form inquiries are kept for up to 24 months from our last contact with you about them, and then deleted.

8. Your rights

Under the GDPR you have the right to access your data and to request its rectification or erasure, to restrict or object to processing, to data portability, and to withdraw any consent at any time (Art. 15-22 GDPR). To exercise these rights, contact us at info@prontocharge.it.

You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma; garanteprivacy.it).

9. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects for you.

10. Age of users

The Service is intended for adults. Where it is used to order alcoholic drinks, it must only be used by persons who are 18 or older. The venue may verify your age and refuse service as required by law.

11. Changes to this policy

We may update this Privacy Policy from time to time. The current version, with its "last updated" date, is always available at this page.

12. Contact

For any question about this policy or your data, contact us at info@prontocharge.it or on WhatsApp at +39 352 077 7880 (WhatsApp only).

← Back to menu