Privacy Policy
eMeni — digital menu, ordering and venue management
Effective from: the day of publication on emeni.rs
Last updated: 13 October 2026
This is a translation. In case of discrepancy, the Serbian version prevails.
1. Summary
- eMeni is software that lets hospitality venues (restaurants, cafés, bars) offer a digital QR-code menu, ordering, self-order kiosks, a waiter app, a kitchen display, delivery, a loyalty program and guest ratings.
- When you order at a venue, that venue is primarily responsible for your data. eMeni processes that data on the venue’s behalf and only on its instructions.
- For our own website emeni.rs, for cookies and analytics in the app.emeni.rs application, and for our business relationship with venues, eMeni is the controller.
- We do not sell your data or use it for advertising.
- Data is stored on Microsoft Azure infrastructure in Germany (EU).
- You have the right to access, rectify and erase your data and other rights, and the right to lodge a complaint with the Commissioner (www.poverenik.rs).
2. Who we are and how to contact us
NKZ labs doo, Belgrade (Voždovac) (limited liability company)
Company registration no.: 22332775
Tax ID (PIB): 115958360
Registered address: Bulevar Peka Dapčevića 72, 11042 Belgrade (Voždovac), Serbia
E-mail: prodaja@emeni.rs
Phone: +381 64 650 1598
Data protection e-mail: app@emeni.rs
(“eMeni”, “we”, “us”)
3. Our two roles: processor and controller
The Serbian Law on Personal Data Protection (Official Gazette of RS No. 87/2018, “ZZPL”) and the EU General Data Protection Regulation (GDPR) distinguish between:
- the controller — who decides why and how personal data is processed, and
- the processor — who processes personal data on the controller’s behalf.
| Situation | Controller | eMeni’s role |
|---|---|---|
| Viewing the menu, ordering at the venue, calling a waiter, kiosk | the venue | processor |
| Delivery and takeaway orders (including those received via Wolt, Glovo, Mr D) | the venue (the delivery platform is a separate controller for its own users) | processor |
| The venue’s loyalty program, coupons and discounts | the venue | processor |
| Ratings and surveys after a visit | the venue | processor |
| Venue staff accounts (admin portal, waiter app, kitchen display) | the venue | processor |
| Guest user account on app.emeni.rs (login, favourites, saved addresses) | eMeni | controller |
| Cookies and analytics in our apps | eMeni | controller |
| The emeni.rs website and communication with us (e-mail, phone) | eMeni | controller |
| Contracts, billing and support for venues using eMeni | eMeni | controller |
Note on guest accounts: a guest account works across all venues that use eMeni, so eMeni is the controller for the account itself, while the venue is the controller for orders placed with it.
If you are a guest of a venue, please contact the venue to exercise your rights regarding orders, loyalty and ratings (the venue’s contact details are available in the app or on your receipt). You may also contact us — we will forward your request to the venue without delay and help it respond.
4. The emeni.rs website
emeni.rs is an informational product website.
- It uses no cookies, no analytics and no tracking tools, and has no forms.
- Like any web server, ours automatically logs technical request data: IP address, time, requested page, browser and operating system. We use these logs only for security and proper operation of the site (legitimate interest), keep them only as long as needed for security and proper operation, then delete them, and do not combine them with other data. The website and apps run on Microsoft Azure infrastructure in Germany (EU).
- If you e-mail prodaja@emeni.rs or call us, we process the data you give us (name, e-mail, phone number, venue name, message content) to reply and, if you wish, prepare an offer (steps prior to entering into a contract / legitimate interest). We keep it while the conversation is ongoing and, if you do not become a customer, for at most two years after the last contact.
- Links to app.emeni.rs lead to the application described in sections 5 and 6.
5. Guest data in the app (app.emeni.rs, kiosk)
Which data is processed depends on which features the venue has enabled. Data is provided by you, generated by your use of the app, or entered by venue staff.
| Category | Examples | Purpose |
|---|---|---|
| Order data | items, quantities, notes, time, table number or location in the venue, payment method, status | receiving and fulfilling the order, order history, status tracking |
| Delivery and takeaway data | name, phone number, address, map location, delivery note | delivery, contacting you about the order |
| User account (if you log in) | first and last name, e-mail, profile photo; if you log in with Google, Facebook or Microsoft we receive only these basic details from that service | login, favourite venues and products, saved addresses, history |
| Loyalty program | customer profile at the venue, coupons, discounts, status (e.g. VIP), redeemed coupons | granting and redeeming the venue’s benefits |
| Ratings and surveys | star rating, answers, comment, linked receipt | feedback to the venue |
| Notifications | browser (push) notification subscription | order status notifications |
| Technical data | IP address, device identifier, device and browser type, app version, access and error logs | operation, security and stability of the system, abuse prevention |
The venue may, by written instruction, specify additional data where necessary for the purpose and where the venue has a legal basis for it.
Automated processing. The system automatically displays the menu, forwards orders to the venue and sends confirmations and status notifications. eMeni does not make automated decisions that produce legal effects concerning you. Discounts, loyalty status and similar rules are set by the venue.
6. Cookies and local storage (app.emeni.rs)
The emeni.rs website uses no cookies. The app.emeni.rs application uses cookies and browser local storage (localStorage) as follows.
Strictly necessary (the app does not work without them; no consent required):
| Name | Type | Purpose | Duration |
|---|---|---|---|
udid |
cookie (emeni.rs domain) | anonymous device identifier linking pending orders to the device | 365 days |
cookieConsent |
localStorage | remembers your cookie choice | until you clear it |
language |
localStorage | selected language | until you clear it |
shoppingBag, pendingOrders_* |
localStorage | basket and pending orders | until you clear it |
qrCode, saveQrCode |
localStorage | last scanned venue / table | until you clear it |
deliveryDetails |
localStorage | delivery details so you don’t re-enter them | until you clear it |
favorites |
localStorage | favourite products | until you clear it |
| login data | localStorage | keeping you logged in | until logout |
| notification and install settings | localStorage | remembering your choices | until you clear it |
Analytics (only with your consent):
| Service | Provider | What it does |
|---|---|---|
| Google Analytics | aggregate usage statistics (e.g. menu views, waiter calls) |
These services are not loaded until you click “Accept”. You can change your choice at any time via the “Cookie settings” link at the bottom of the app; withdrawal takes effect from the next page load.
Third-party services loaded when you use them: Google Maps (choosing a delivery address), login with Google, Facebook or Microsoft. In that case your browser communicates directly with that service, which sees your IP address and browser data.
7. Legal bases
Under Art. 12 ZZPL and Art. 6 GDPR:
- performance of a contract or pre-contractual steps — orders, delivery, user account, contract with the venue;
- legal obligation — accounting and tax obligations (e.g. fiscalisation), requests from competent authorities;
- legitimate interest — system security and stability, abuse prevention, replying to enquiries, server logs;
- consent — analytics cookies, push notifications; you may withdraw consent at any time without affecting the lawfulness of prior processing.
Where the venue is the controller, the venue is responsible for choosing the legal basis for processing its guests’ data.
8. Who receives your data
We do not sell data. We share it only where necessary:
- with the venue where you order — it sees your order, delivery details, loyalty data and ratings;
- with service providers (sub-processors) bound by data protection agreements:
- Microsoft Azure — hosting and database (Germany, EU);
- Google (Analytics, Maps, login), Microsoft (login), Meta (Facebook login);
- e-mail and SMS delivery providers (confirmations, login codes, order notifications);
- browser vendors’ push services (for notifications);
- Telegram and WhatsApp, if you choose to receive order notifications that way;
- the venue’s fiscal system, when the venue issues a fiscal receipt through eMeni;
- with delivery platforms (Wolt, Glovo, Mr D) — we receive from the platform the data needed for the order (the customer’s name, phone number and address); we send the platform only the venue’s status and its offer, never guest data;
- with competent authorities, where required by law.
Venues authorise sub-processors by general or specific written authorisation; we inform them of every change, and they may object.
9. Transfers outside Serbia
The main database is located in Germany (EU). EU countries are considered to provide an adequate level of protection under the ZZPL.
Some providers (Google, Microsoft, Meta) may process data in the USA or other countries. Such transfers rely on your explicit consent (analytics cookies) and on the performance of a service you initiated yourself (signing in with a Google, Facebook or Microsoft account, notifications via Telegram or WhatsApp). For users in the EU, they also rely on the EU–US Data Privacy Framework and on those providers’ standard contractual clauses.
10. How long we keep data
| Data | Period |
|---|---|
| Orders, delivery details, loyalty and ratings | see below the table |
| Guest user account | while the account exists; after deletion we erase it without delay, except data the law requires us to keep |
| Transaction and invoice data | periods required by accounting and tax law |
| Technical and security logs | as long as needed for security and proper operation |
| Analytics (Google Analytics) | according to the Google Analytics settings, at most 14 months |
| E-mail and phone enquiries | while the conversation is ongoing, at most two years after the last contact |
| Venue customer data | term of the contract plus statutory periods |
We keep order, loyalty and rating data for as long as our cooperation with the venue lasts, unless the venue sets a shorter period.
At the request of a guest or the venue, we delete or anonymise the personal data in an order (name, phone number, address, e-mail), so the order can no longer be linked to a person. Anonymised data is kept only for the venue’s statistics and reports. Guest requests concerning data we process on a venue’s behalf are handled in agreement with the venue.
When the cooperation ends, we delete the personal data or return it to the venue, as the venue decides, unless the law requires us to keep it longer.
11. Your rights
Under the ZZPL (Arts. 26–38) and GDPR (Arts. 15–22) you have the right to:
- know whether we process your data and obtain a copy;
- have inaccurate data rectified or incomplete data completed;
- have your data erased;
- restrict processing;
- receive your data in a structured, machine-readable format (portability);
- object to processing based on legitimate interest;
- withdraw consent at any time;
- not be subject to a decision based solely on automated processing that produces legal effects.
How to exercise your rights: write to app@emeni.rs. For data we process on a venue’s behalf, we forward your request to the venue without delay. We respond without undue delay and within 30 days at the latest; this may exceptionally be extended (by up to 60 days under the ZZPL, or two months under the GDPR), in which case we will inform you. We may ask you to verify your identity. Exercising your rights is free of charge.
You can request deletion of your account at app@emeni.rs; we delete it without delay and within 30 days at the latest.
Complaints. If you believe your data is processed unlawfully, you may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), Bulevar kralja Aleksandra 15, 11000 Belgrade, Serbia, www.poverenik.rs. If you live in the EU, you may also contact the supervisory authority in your country (e.g. the Garante per la protezione dei dati personali in Italy or the Datenschutzbehörde in Austria).
12. Children
eMeni is not intended for children under 15 to create an account or give consent. We do not knowingly collect children’s data without parental consent. If we learn that we have received such data, we delete it.
13. Security
We apply technical, organisational and personnel measures in line with Art. 50 ZZPL (Art. 32 GDPR), proportionate to the risk, in particular:
- encrypted connections (HTTPS) and, where applicable and technically feasible, pseudonymisation and encryption of data;
- access limited to authorised persons on a need-to-know basis, bound by confidentiality;
- protection of equipment and software and prevention of unauthorised access;
- ensuring confidentiality, integrity, availability and resilience of systems, and quick recovery after an incident;
- regular testing and evaluation of the effectiveness of these measures.
Data breaches. If a breach affects data we process on a venue’s behalf, we notify the venue without undue delay and no later than 72 hours after becoming aware of it, and help it notify the Commissioner and affected individuals. Where we are the controller, we notify the Commissioner and you as required by the ZZPL.
14. For venues (controllers)
When a venue uses eMeni, eMeni processes the data of the venue’s guests and staff as a processor under Arts. 45 and 46 ZZPL (and Art. 28 GDPR for venues in the EU). The relationship between the venue and eMeni is governed by the Data Processing Agreement, which the venue concludes electronically by accepting it when registering on the eMeni platform. In short, eMeni:
- processes data only on the venue’s documented written instructions, including on transfers to other countries, unless required otherwise by law (in which case it informs the venue in advance, unless prohibited on important grounds of public interest);
- does not use the data for its own purposes; if it determined the purposes and means of processing itself, it would be considered a controller for that processing;
- promptly informs the venue if it believes an instruction infringes the law;
- engages sub-processors only with the venue’s general or specific written authorisation, informs the venue of changes and imposes the same data protection obligations on them, remaining liable to the venue for their performance;
- ensures that persons with access to the data are bound by confidentiality;
- assists the venue with guest requests, security of processing and data breaches;
- deletes or returns the data at the end of the service, at the venue’s choice;
- makes available to the venue the information needed to demonstrate compliance and allows audits as set out in the agreement.
The venue is responsible for the legal basis, lawful purpose and for informing its guests and staff.
15. Changes to this policy
We may update this policy when our services or the law change. The date of the last update is shown at the top. We notify venues of material changes by e-mail, and users by publishing them on this page.
16. Governing law
This policy is governed by the ZZPL and other laws of the Republic of Serbia and, for processing to which it applies, by the GDPR.
Belgrade, 13 October 2026
NKZ labs doo, Belgrade