Data Processing Agreement

eMeni — digital menu, ordering and venue management

Effective from: the day of publication on emeni.rs
Last updated: 13 October 2026

This is a translation. In case of discrepancy, the Serbian version prevails.

1. Parties and conclusion of the agreement

This agreement is concluded between:

• the Controller — a hospitality venue, i.e. a legal entity or sole trader that registers on and uses the eMeni platform to provide services to its guests (the “Controller” or the “venue”), and
• the Processor — NKZ labs doo, Bulevar Peka Dapčevića 72, 11042 Belgrade (Voždovac), Serbia, company registration no. 22332775, tax ID (PIB) 115958360 (the “Processor” or “eMeni”).

The agreement is concluded electronically, in accordance with Art. 45(9) of the Serbian Law on Personal Data Protection (Official Gazette of RS no. 87/2018, the “ZZPL”), when the Controller indicates its acceptance of this agreement while registering on the eMeni platform. A Controller that started using eMeni before this agreement was published accepts it by continuing to use the service.

This agreement forms part of the contractual relationship for the use of the eMeni platform and remains in force for as long as that relationship lasts.

2. Definitions

For the purposes of this agreement:

• “Personal data” means any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
• “Data subject” means a natural person whose personal data is processed on the eMeni platform (a guest, a member of the venue’s staff, etc.).
• “Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, alteration, consultation, use, disclosure by transmission, dissemination, restriction, erasure or destruction.
• “Controller” means the person who, alone or jointly with others, determines the purposes and means of processing personal data.
• “Processor” means the person who processes personal data on behalf of the controller.
• “Sub-processor” means a person who processes personal data on behalf of the processor, with the controller’s authorisation.
• “Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

3. Subject matter, nature and duration of processing

The subject matter of this agreement is the processing of personal data carried out by the Processor on behalf of and on the instructions of the Controller, by providing the services of the eMeni platform: a digital menu available via QR code, ordering, kiosk, waiter app, kitchen display, pickup screen, delivery, loyalty program, guest ratings, admin portal and the supporting infrastructure.

Processing is mostly automated and includes collecting, recording, storing, displaying, forwarding and erasing data to the extent required by the features the Controller has enabled.

Processing lasts for as long as the Controller uses the eMeni platform; when it ends, section 13 applies.

4. Data subjects and categories of data

The following data subjects are covered: the venue’s guests, members of the Controller’s loyalty program, and staff or other users the Controller authorises to work on the platform.

Depending on the features the Controller enables, the following categories of data may be processed:

• name and/or nickname, phone number and e-mail address;
• table number or location within the venue;
• order data (menu items, quantities, notes, time, status);
• delivery address and location;
• loyalty program data (date of birth, gender, purchase history, points, rewards, coupons and benefits), where the Controller provides for it;
• guest ratings, survey answers and comments;
• staff account data (name, role, username, activity records in the system);
• technical data (IP address, device and browser data, app version, access logs for security and system stability).

The Controller may specify other categories of data by written instruction, provided they are strictly necessary for the defined purposes and the Controller has an appropriate legal basis for processing them.

5. Purposes of processing

The purposes of processing are determined by the Controller. Data is processed in particular for:

• access to the digital menu and receiving, processing and fulfilling orders;
• identifying the table or location of the order and delivering orders;
• communicating with the guest about the status of the order;
• running the loyalty program and guest ratings, where enabled by the Controller;
• recording and displaying order history and reports for the Controller;
• preventing abuse and protecting the integrity of the system;
• fulfilling the Controller’s legal obligations.

The Processor processes data solely to perform its contractual obligations to the Controller and does not use it for its own purposes. Should the Processor infringe the ZZPL by determining the purposes and means of processing, it would be considered a controller in respect of that processing.

6. Processing on instructions

The Processor processes personal data only on documented written instructions from the Controller, including with regard to transfers of data to other countries or international organisations, unless it is required to do so by law. In that case, the Processor will inform the Controller of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

The settings the Controller enters into the eMeni platform (enabled features, fields the guest fills in, loyalty program rules, etc.) are considered its written instructions.

In accordance with Art. 46 ZZPL, the Processor and any person authorised by the Controller or the Processor to access the data may not process the data except on instructions from the Controller, unless required to do so by law.

If the Processor considers that an instruction from the Controller infringes the ZZPL or other data protection rules, it will inform the Controller without delay.

7. Data location and access

Data is stored on cloud infrastructure within the European Union (Microsoft Azure — Germany).

Access to data is granted only to authorised persons, to the extent strictly necessary to perform the contractual obligations and maintain the system.

8. Sub-processors

By this agreement, the Controller gives the Processor a general written authorisation to engage sub-processors, in accordance with Art. 45 ZZPL. On the date this agreement is published, these are:

• Microsoft (Azure) — hosting and database, Germany (EU);
• e-mail and SMS delivery providers;
• Google (maps and Google sign-in) and other sign-in providers (Meta, Microsoft), when the guest chooses to sign in that way.

The Processor shall inform the Controller (by e-mail or by a notice in the admin portal) of any intended addition or replacement of a sub-processor, giving the Controller the opportunity to object to such changes.

When engaging a sub-processor, the Processor shall ensure, by a written contract or other legally binding act, that the sub-processor assumes the same data protection obligations as the Processor. If the sub-processor fails to fulfil its obligations, the Processor remains liable to the Controller for the performance of those obligations in accordance with the ZZPL.

9. Confidentiality and authorised persons

The Processor ensures that every natural person authorised to process personal data has committed to confidentiality or is under a statutory obligation of confidentiality. Access to data is limited to authorised persons who need it to perform their tasks (“need to know”).

10. Technical, organisational and staffing security measures

The Processor takes all necessary measures in accordance with Art. 50 ZZPL, taking into account the nature, scope, context and purposes of processing and the risks to the rights and freedoms of data subjects. These measures include, among others:

• protection of premises, equipment and software used to process personal data;
• prevention of unauthorised access to personal data;
• pseudonymisation and encryption of personal data, where applicable and technically feasible;
• ongoing confidentiality, integrity, availability and resilience of processing systems and services;
• the ability to restore availability of and access to data in a timely manner in the event of a physical or technical incident;
• regular testing, assessment and evaluation of the effectiveness of technical, organisational and staffing security measures.

11. Personal data breach

In the event of a personal data breach within the Processor’s area of responsibility, the Processor shall notify the Controller without undue delay and no later than 72 hours after becoming aware of it. The notification contains, to the extent the information is available:

• a description of the nature of the breach;
• the categories and approximate number of data subjects and records concerned;
• a description of the likely consequences;
• the measures taken or proposed to address the breach and mitigate its adverse effects;
• the Processor’s contact details.

The Processor assists the Controller in acting in a timely manner under the ZZPL, including notifying the Commissioner and the data subjects, taking into account the nature of processing and the information available to it.

12. Assistance to the Controller

Taking into account the nature of processing, the Processor assists the Controller, through appropriate technical, organisational and staffing measures, in fulfilling its obligations to respond to data subject requests under Chapter III ZZPL, and its obligations regarding security of processing, data breaches and impact assessments.

If a data subject sends a request to the Processor, the Processor will forward it to the Controller without delay and act on its instructions. At the Controller’s request, the Processor deletes or anonymises the personal data in orders, so that it can no longer be linked to a person.

13. Deletion or return of data at the end of processing

When the use of the eMeni platform ends, and as decided by the Controller, the Processor shall:

• delete all personal data and all copies of it, or
• return all personal data to the Controller,

unless the law requires the data to be retained.

14. Information, audits and demonstrating compliance

The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations under the ZZPL and this agreement, and allows for and contributes to audits carried out by the Controller or a person it authorises, with reasonable prior notice and in a manner that does not compromise the security of other platform users’ data.

15. Obligations of the Controller

The Controller is responsible for the existence of a legal basis and the lawfulness of the purposes of processing, and for informing its guests and staff in accordance with the ZZPL. The Controller warrants that the instructions it gives the Processor comply with the law.

16. Contact

For any questions about this agreement and data protection:

NKZ labs doo
E-mail: app@emeni.rs
Phone: +381 64 650 1598

17. Amendments and final provisions

The Processor may amend this agreement to comply with the law or with changes to the service. It informs the Controller of amendments by e-mail or by a notice in the admin portal at least 15 days before they apply; if the Controller does not object and continues to use the service, the amendments are deemed accepted.

Matters not governed by this agreement are subject to the ZZPL and other laws of the Republic of Serbia. For venues in the European Union, this agreement also serves as the contract referred to in Art. 28 of the EU General Data Protection Regulation (GDPR).

Belgrade, 13 October 2026

NKZ labs doo, Belgrade