Privacy Policy

Last updated: 2026-03-12

Introduction

Wavy QR ("we", "us", "our"), operated by DIMITRIOS DASKALAKIS CHRISTOS, respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard information when you use our platform — whether you are a venue operator (business user) or a guest scanning a QR code.

Who We Are

Wavy QR is a hospitality SaaS platform that provides digital menu management, QR-based ordering, and service request tools for restaurants, hotels, beach bars, resorts, cafes, and other hospitality venues. Our registered address is S.VOLANI 24 Chania, Crete, Greece. You can reach us at support@wavytech.gr .

Guest Data — What We Do NOT Collect

When a guest scans a QR code at a venue, we prioritize privacy by design:

No account is created. No name, email, phone number, or personal information is collected from guests.
No guest data is stored. Your session is temporary and tied only to the specific venue and service point (table, room, sunbed, etc.).
Session tokens expire automatically after a configurable period (default approximately 4 hours).
No cross-venue or cross-table tracking occurs. Your activity at one venue is never linked to activity at another.

In short: guests use Wavy QR anonymously. We do not build guest profiles, track browsing history across venues, or share any guest information with third parties.

Venue Operator Data — What We Collect

When you register as a venue operator (business account), we collect the information necessary to provide our services:

Account information: name, email address, business name, and role within the organization.
Store information: venue name, type, location details, operating hours, currency, tax settings.
Menu content: menu items, descriptions, prices, images, allergen tags, and modifier configurations that you create.
Order data: order details, status, timestamps, and payment method labels (cash, card, online, room charge). We track payment status but do not process payments or store financial/card details.
Team data: email addresses and role assignments for staff members you invite to your account.

How We Use Your Data

We use venue operator data exclusively to:

Provide, operate, and maintain the Wavy QR platform and its features.
Send real-time notifications about orders and service requests.
Communicate with you about your account, service updates, and support requests.
Improve our platform based on aggregated, anonymized usage patterns.

Payment Data

Where online card payment is available through the Service, payment transactions are processed by a PCI DSS-compliant third-party payment provider. DASKALAKIS DIMITRIOS CHRISTOS does not collect, store, or have access to your full credit or debit card details. The payment provider may collect card information, billing details, and transaction identifiers necessary to process your payment. For details on how the payment provider handles your data, please refer to their own privacy policy.

Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. We may share data only with:

Service providers who help us operate the platform (hosting, email delivery, payment processing), bound by data processing agreements.
Participating venues — only the order data necessary for fulfilment (items ordered, special instructions, service point) is shared with the venue you are ordering from. No guest personal data is included.
Law enforcement or regulatory authorities when required by applicable law.

Data Security

We implement industry-standard security measures to protect your data:

Enterprise-grade tenant isolation — one venue's data is never accessible to another venue.
Server-side price verification — menu prices displayed to guests cannot be manipulated client-side.
Encrypted data transmission and secure authentication for all business accounts.

Cookies

The Wavy QR guest web app uses only essential session cookies required for the ordering experience to function. We do not use advertising or tracking cookies on the guest-facing app. Our marketing website (wavytech.gr) may use analytics cookies, for which we will request your consent.

Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

Right of access — request a copy of the personal data we hold about you.
Right to rectification — request correction of inaccurate data.
Right to erasure — request deletion of your personal data.
Right to data portability — request your data in a structured, machine-readable format.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

Children's Privacy

Wavy QR business accounts are intended for use by individuals aged 18 and over. The guest QR experience does not collect any personal data from any user, including children.

Changes to This Policy

We may update this privacy policy from time to time. We will notify registered business users of significant changes via email. The "last updated" date at the top of this page reflects the most recent revision.

Contact Us

If you have questions about this privacy policy or wish to exercise your data rights, please contact us at support@wavytech.gr or write to DASKALAKIS DIMITRIOS CHRISTOS, S.VOLANI 24 Chania, Crete, Greece.