Privacy policy
Last updated: · Version 1.1
This page explains what data the platoo.gr website collects, why, how long we keep it and what rights you have. It covers this website only. The admin panel (my.platoo.io) and the digital menu (menu.platoo.io) are covered by the Platoo privacy policy shown when you sign up on my.platoo.io. See also our Terms of use.
1. Data controller
The data controller is Platoo — the team that builds the Platoo digital menu service (platoo.io, platoo.gr, my.platoo.io and menu.platoo.io). We work online. For any question about your data or to exercise your rights, write to [email protected].
2. What data we collect
There are no forms or user accounts on this website. Sign-up happens on my.platoo.io. We only collect:
- Technical data: IP address, browser and device type, requested page, time. The server logs it automatically so the site works and is protected from attacks.
- Traffic statistics (Google Analytics): pages you read, where you came from, country and device type. Only if you allow it in the cookie banner.
- Session statistics (Microsoft Clarity): how you scroll and click on our pages, as heatmaps and session replays. What you type in fields is masked. Only if you allow statistics in the cookie banner.
- Platoo’s own statistics: which buttons and links you click on this site (for example the pricing period, the Viber button, QR generator settings — never the text you type), the page, language, browser and device type, and a random visitor ID and visit ID stored in your browser. Only if you allow statistics in the cookie banner.
- Ad measurement data (Google Ads): whether you reached us from an ad. Only if you allow it.
- Messages you send us via Viber, WhatsApp or email: name, phone number or email and whatever you write.
- Your cookie choice, so we don’t ask again on every visit. We also count which option was chosen in the banner — anonymously, without any ID.
We don’t ask for or process special categories of data (GDPR Art. 9). We don’t sell data to anyone.
3. Purposes, legal basis and retention
- Running and securing the website
- Data: Technical data
- Legal basis: Legitimate interest (Art. 6(1)(f))
- Retention: Up to 24 months
- Traffic statistics
- Data: Google Analytics
- Legal basis: Consent (Art. 6(1)(a))
- Retention: Up to 14 months
- Improving the website
- Data: Platoo’s own statistics (clicks, random visitor ID)
- Legal basis: Consent (Art. 6(1)(a))
- Retention: Up to 14 months
- Improving the website
- Data: Microsoft Clarity (heatmaps, session replays)
- Legal basis: Consent (Art. 6(1)(a))
- Retention: Up to 13 months (session replays: 30 days)
- Ad measurement
- Data: Google Ads
- Legal basis: Consent (Art. 6(1)(a))
- Retention: Up to 90 days (cookie)
- Answering your messages and offering the service
- Data: Contact details, message content
- Legal basis: Steps before a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f))
- Retention: While we are in contact and up to 24 months after
- Proof of your consent
- Data: Cookie choice
- Legal basis: Legal obligation (Art. 6(1)(c), Art. 7(1))
- Retention: 12 months
We don’t make decisions based solely on automated processing and don’t build profiles that affect you (GDPR Art. 22).
4. Who receives data
- Hosting provider with servers in the European Union, as a processor (GDPR Art. 28).
- Google Ireland Ltd (Google Analytics, Google Tag Manager, Google Ads) — only for what you allowed in the cookie settings.
- Microsoft Ireland Operations Ltd (Microsoft Clarity) — only if you allow statistics.
- Platoo’s own statistics are stored on Platoo’s servers and are not shared with anyone.
- Rakuten Viber and WhatsApp (Meta Platforms Ireland) — only if you message us there. Their own privacy policies also apply.
- Public authorities, only when required by law.
5. Transfers outside the EU
Google and Microsoft may also process data in the United States. The transfer relies on the adequacy decision for the EU–US Data Privacy Framework (GDPR Art. 45) and on the European Commission’s Standard Contractual Clauses (GDPR Art. 46).
6. Demo menu
The home page and some guides show a real demo menu from menu.platoo.io, Platoo’s own guest menu service. It loads only after you allow statistics — until then you see a picture of it. menu.platoo.io uses its own tools: a language cookie (NEXT_LOCALE), Google Analytics, Microsoft Clarity, Platoo’s own statistics and Cloudflare Web Analytics (without cookies). If you open the demo menu in a new tab with the button under the picture, these tools work there too. The Platoo privacy policy, shown when you sign up on my.platoo.io, applies to the menu. See also our Terms of use.
7. Your rights
Under the GDPR you have the right to:
- access your data (Art. 15)
- rectification (Art. 16)
- erasure (Art. 17)
- restriction of processing (Art. 18)
- data portability (Art. 20)
- object to processing based on legitimate interest (Art. 21)
- withdraw consent at any time (Art. 7(3)) — this doesn’t affect processing done before
To exercise a right, write to us at [email protected]. We reply within one month at the latest (Art. 12(3)). We may ask you to confirm your identity.
8. Complaints
If you believe we process your data unlawfully, you can lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Ave, 115 23 Athens, www.dpa.gr) or with the data protection authority of your country (GDPR Art. 77).
9. Security
The website runs on HTTPS only, the servers are in the EU and only authorised Platoo staff can access the data (GDPR Art. 32).
10. Children
The website is meant for hospitality businesses, not for children. We don’t knowingly collect data from minors.
11. Changes
If the way we process data changes, we will update this page and the date at the top. For cookies, see also the cookie policy.