zvelto.

Privacy Notice

This notice covers the Zvelto onboarding form and the venue owners, managers and staff who submit it. It applies whether you are in the United Kingdom, Greece or elsewhere in the EEA. It does not cover general website visitors, cookies that are not related to the form, analytics beyond what is listed below, diner ordering data or payment data. Those are handled separately.

1. Who we are

Zvelto Limited is a company registered in England and Wales, company number 17046810. We are the data controller for the personal data described in this notice.

Contact: privacy@zvelto.ai
Registered office: 66 Paul Street, London, EC2A 4NA, United Kingdom

We operate in Greece through our team based there. Because we have an establishment in the EU, we are not required to appoint a separate Article 27 EU representative. The contact above handles all data protection matters. We have not appointed a Data Protection Officer because we are not required to.

2. Who this notice covers

This notice covers people whose personal data we process when a venue enquires about or signs up to Zvelto: owners, managers and staff who complete our onboarding form or otherwise deal with us. It also covers individuals whose personal data appears in material a venue uploads, such as a named customer in a testimonial.

3. What we collect and where it comes from

Most of the information we hold comes directly from you when you complete the onboarding form or communicate with us. We collect:

We also collect the following technical data automatically when you use the form:

We do not use analytics cookies or trackers, and we do not collect device identifiers beyond what the browser and hosting provider transmit.

We do not ask for, and you should not send us, any special category data (such as health information) through the onboarding form.

4. What we use it for, and our lawful basis

UK GDPR and EU GDPR require us to tell you the lawful basis for each purpose. The table below links each purpose to the data used and the basis relied on, following ICO enforcement guidance that separate lists without linkage fall short of Article 13.

Purpose Personal data used Lawful basis
Setting up and operating your venue's website and services, including building your menu and pages from what you upload Contact details, business information, uploaded content Performance of a contract, or steps taken at your request before entering one (Article 6(1)(b))
Communicating with you about your onboarding, your account and our services Contact details, correspondence Performance of a contract (Article 6(1)(b))
Improving our products and services, and internal record-keeping Business information, correspondence Our legitimate interests in running and improving our business (Article 6(1)(f))
Sending you marketing about Zvelto products and services, where you have opted in Contact details Consent (Article 6(1)(a)), which you can withdraw at any time
Keeping accounting and tax records Contact details, transaction records Legal obligation (Article 6(1)(c))
Establishing, exercising or defending legal claims Any of the above, as relevant Our legitimate interests in protecting our legal position (Article 6(1)(f))

Where we rely on legitimate interests, we have balanced those interests against your rights and concluded they are not overridden. You can ask us for details of that assessment, and you can object at any time (see section 9).

5. Who we share it with

We use service providers who process data on our behalf under contract:

We do not sell personal data, and we do not share it with third parties for their own marketing.

6. International transfers

Zvelto Limited is based in the United Kingdom. If you are in Greece or elsewhere in the EEA, your data is transferred to the UK. The European Commission has renewed its adequacy decisions for the UK, confirming personal data can flow freely from the EEA to the UK without additional safeguards; the renewed decisions run to 27 December 2031.

Some of our service providers are based in the United States. We rely on Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office for any transfers to these providers. Where available, we also rely on the UK-US Data Bridge and the EU-US Data Privacy Framework. You can request a copy of the safeguards by emailing privacy@zvelto.ai.

7. Cookies and similar technologies

We do not use analytics or marketing cookies on the onboarding form. The form uses browser localStorage to save a draft on your device so you can return to it later. localStorage is not a cookie and does not send data to us automatically.

The form and these legal pages load the Manrope font from Google Fonts. When a font is loaded, your browser requests the font files from Google, which means your IP address is sent to Google. We consider this a non-essential use of a third-party service and will only load Google Fonts if you consent through the cookie banner. If you do not consent, we display the pages using system fonts instead.

Any cookies that are strictly necessary to make the form work (for example, security or load-balancing cookies set by our hosting provider) do not require consent under UK PECR and the Greek ePrivacy rules.

8. How long we keep it

9. Content you upload about other people

If material you upload contains someone else's personal data, for example a testimonial naming a customer, you are responsible for having that person's permission before you send it to us. See our Terms of Service.

10. Your rights

You have the right to: access your personal data; have it corrected; have it erased in certain circumstances; restrict or object to our processing, including an absolute right to object to direct marketing; data portability; and to withdraw consent at any time where consent is our basis, without affecting processing before withdrawal. You also have the right to object to processing based on legitimate interests on grounds relating to your particular situation.

To exercise any right, contact us at privacy@zvelto.ai. We will respond within one month.

You also have the right to complain to a supervisory authority:

We would appreciate the chance to resolve any concern first, but you can go to the regulator directly at any time.

11. Changes to this notice

We will post any changes on this page and, where the change is significant, tell you directly.