Cookie policy

1. What this policy covers

It applies to three parts of the service: the guest view that opens after scanning a venue QR code, the back office used by venues, their staff and sales partners, and the public website kymiro.com including the consent banner.

2. Cookies and local storage are treated alike

Kymiro deliberately works almost entirely without classic cookies. Nearly everything we keep on your device is stored in the browser's local storage, which never leaves your device on its own. Legally this makes no difference: § 25 TDDDG in Germany and Art. 4 of Greek Law 3471/2006 in conjunction with Law 4624/2019 cover any storing of, or access to, information on your terminal equipment. We therefore treat both the same way.

• We do not use advertising networks, cross-site tracking pixels or fingerprinting.
• Nothing beyond strictly necessary storage is written before you agree.
• Rejecting optional categories has no effect on your ability to use the menu or place a request.

3. Legal bases

We distinguish two situations:

• Strictly necessary storage: § 25(2) no. 2 TDDDG (Germany) and the equivalent exemption under Greek law — no consent required, because it is needed to provide the service you explicitly requested. Any subsequent processing of the resulting personal data rests on Art. 6(1)(b) and (f) GDPR.
• Optional storage (preferences, analytics, marketing): § 25(1) TDDDG and Art. 4 Law 3471/2006 require your prior consent; the processing of the resulting personal data is based on Art. 6(1)(a) GDPR. The Hellenic Data Protection Authority's Guideline 2/2020 on cookies applies to visits from Greece.
• Consent is freely given, specific and revocable — rejecting is exactly as easy as accepting, both on the first layer of the banner.

4. Categories we use

The banner offers four categories. Only the first one is active without your consent.

• Strictly necessary — session, language, appearance and sign-in state. Always active.
• Preferences — optional comfort settings such as favourites, recently seen venues and sound alerts. Off until you allow it.
• Analytics — aggregated usage statistics that help us improve the product. Off until you allow it. No analytics tool is active today; if we add one, it will only run for visitors who have consented.
• Marketing — campaign measurement and referral attribution. Off until you allow it. We currently run no advertising tags.

5. Consent, withdrawal and lifetime

Your decision is stored on your device so we do not have to ask again on every visit.

• The banner appears on your first visit; nothing optional is stored while it is open.
• You can change or withdraw your decision at any time using the cookie settings button on this page, in the footer and in the privacy policy. Withdrawal takes effect immediately and does not affect the lawfulness of processing before it.
• We ask again at the latest after 12 months, and immediately whenever the categories change.
• We keep the record of your decision (categories and timestamp) as proof of consent under Art. 7(1) GDPR. It stays on your device only — we do not create a server-side profile from it.

6. Third parties and transfers outside the EU/EEA

Some entries are set by service providers we use to run Kymiro. They act as processors under Art. 28 GDPR.

• Hosting, database and authentication — keeps you signed in and delivers the pages; sets a sign-in token and security cookies.
• AI services for menu translation, menu import and product images — process venue menu content, no guest data, and set no storage on your device.
• Email delivery for sign-in and invitation messages — sets no storage on your device.
• Payment processing for subscriptions (planned, not active yet) — will be described here before it goes live.
• Where a provider processes data outside the EU/EEA, the transfer is covered by an adequacy decision or the EU Standard Contractual Clauses. Details and the full list of purposes are in our privacy policy.

7. Controlling storage in your browser

Independently of our banner you can delete or block cookies and site data in your browser settings, usually under Privacy and security > Cookies and site data.

• Deleting site data also removes your consent record, so the banner will appear again.
• In the guest view it also clears your current table session, cart and favourites — you can simply scan the QR code again.
• Blocking all storage entirely may prevent sign-in and the shared table session from working.

8. Children

Kymiro is not directed at children. We do not knowingly store data of children under 16 and we do not use storage to profile minors.

9. Changes to this policy

We update this policy whenever we add, remove or repurpose an entry. The date at the top always shows the current version; material changes trigger a fresh consent request.

10. Contact and right to complain

For any question about this policy contact NT Investments UG (haftungsbeschränkt), Katzbachstraße 8, 40231 Düsseldorf, Germany, info@kymiro.com.

• Greece: Hellenic Data Protection Authority (HDPA), Kifissias 1-3, 115 23 Athens, www.dpa.gr.
• Germany: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, www.ldi.nrw.de.
• You may also complain to the supervisory authority of your habitual residence or place of work.