Skip to content
Legal

Privacy Policy

Last updated: April 30, 2026

On this page
Data ControllerFivito grupa d.o.o. za trgovinu i usluge

Ulica Bernarda Bernardija 8, 10000 Zagreb, Croatia

OIB: 34559757098 | MB: 081250906

Marketing website: tablehint.com · Platform: tablehint.app · Service name: “Tablehint”.

Who we are and who this Policy applies to

This Policy describes how we process personal data of visitors to tablehint.com, users of the tablehint.app platform (owners/administrators and employees), and guests of hospitality venues who use the digital menu via QR code.

What data we collect

On tablehint.com

  • Contact form data: name, email, venue name, phone (optional), message.
  • Email address from newsletter sign-up.
  • Technical and analytics data about the visit (IP, device type, pages viewed). Analytics with consent only.
  • Cookies (see section 8 and the Cookie Policy).

On tablehint.app: owner / administrator

  • Account data: first and last name, email, password (encrypted), venue name and address, phone.
  • Subscription and invoicing data.
  • Data the administrator enters about the venue (menu, descriptions, images).

On tablehint.app: employees (staff)

  • First and last name, email/username, role, associated venue.
  • App usage data: sign-ins, progress in training modules, AI assistant usage.

Guests (digital menu)

  • Guests do not need to create an account.
  • Technical session and interaction data (QR scans, item views, AI queries) is recorded anonymously, without identifying the person.
  • Any additional data (e.g., name, allergens) is collected only if the guest voluntarily provides it.

Purposes and legal bases of processing

PurposeLegal basis
Providing the contracted Service (platform, support)Performance of contract, Art. 6(1)(b) GDPR
Service and account security communicationsPerformance of contract / legitimate interest, Art. 6(1)(b), (f)
Handling contact inquiries and quotesPre-contractual steps, Art. 6(1)(b)
Marketing communications (newsletter)Consent, Art. 6(1)(a)
Analytics on website and platform usageConsent / legitimate interest
AI features (recommendations, assistant)Performance of contract / legitimate interest
Security, prevention of abuse and fraudLegitimate interest, Art. 6(1)(f)
Accounting and tax obligationsLegal obligation, Art. 6(1)(c)

Roles in processing

  • For data of tablehint.com visitors and account owners on tablehint.app, the Provider acts as data controller.
  • For data the Customer (venue owner) enters about its employees and guests using the platform, the Customer is the data controller and the Provider acts as data processor in accordance with the contract and the Data Processing Agreement (DPA).

AI processing

Certain features (sommelier recommendations, staff assistant) use AI models. Only the context necessary for the response is sent to AI processing (e.g., food and beverage descriptions, the user’s question), without unnecessary personal identifiers. AI partners do not use the content to train their own models, in accordance with the agreements the Provider has with them.

Who we share data with

We do not sell your data. We may share it with:

  • Cloud infrastructure and database providers (hosting, authentication, storage), within the EU/EEA where possible.
  • Analytics providers (e.g., Google Analytics), only with your consent, with IP anonymization.
  • AI partners for processing AI queries, with limited and secure context.
  • Tooling providers for email, payments, and support, strictly to the extent necessary.
  • Competent authorities when legally required.

Data processing agreements are in place with all processors. Where data is transferred outside the EU/EEA, we use Standard Contractual Clauses (SCC) or other appropriate safeguards.

Retention period

  • User account data: for the duration of the contract + up to 1 year after termination.
  • Contact inquiries without a contract: up to 12 months.
  • Invoices and accounting records: 11 years (legal obligation).
  • Analytics data: up to 26 months.
  • Anonymized statistical data: no time limit.

Cookies

A detailed list of cookies and management options is available in the Cookie Policy. Analytics and marketing cookies are activated only with your consent.

Your rights (GDPR)

You have the right to: access your data, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time (without affecting the lawfulness of processing prior to withdrawal).

Send requests to: hello@tablehint.com. We will respond within the statutory period of 30 days.

You may file a complaint with the Croatian DPA (AZOP): Selska cesta 136, 10000 Zagreb · azop.hr

Data security

We apply technical and organizational protection measures: HTTPS encryption, access restricted to authorized personnel, password encryption, regular security audits, and database access monitoring. In the event of a personal data breach posing a risk to your rights, we will notify you and AZOP in accordance with the GDPR.

Minors

The Service is intended for business users and adults. We do not knowingly collect data from children under 16.

Changes to the Policy

We will notify you of significant changes via email or in-platform notification. The date of the last update is shown at the top of this document.

Contact

Fivito grupa d.o.o.
Ulica Bernarda Bernardija 8, 10000 Zagreb, Croatia
hello@tablehint.com

Questions about this document?

Contact us