Privacy notice

1. Who is responsible for your data

Controller

ინდივიდუალური მეწარმე ჰეუნგ სიკ პარკ (Individual Entrepreneur Heung Sik Park)

Identification number

322959553

Address

2a Irakli Abashidze Street, Vera District, Tbilisi 0179, Georgia

Privacy requests

help@ecolinkwork.com

Data protection officer

Not appointed — the Law does not require one for this service (art. 33). Send requests to the email above.

2. Controller and processor

We are the controller for data about account holders, website visitors, billing, support and security.

A venue (café, restaurant, hotel and so on) decides what it publishes and how it handles orders, staff calls and staff profiles. For that data the venue is the controller and we are its processor (Law on Personal Data Protection, art. 36; GDPR art. 28), under the data processing addendum (/dpa). If you are a guest with a question about an order or a call, you can contact the venue or us — we will pass your request to the venue and help it answer.

3. What we collect and why

3.1 Visitors to the website and guest menus

• Guest menus set no cookies, load no advertising or analytics scripts from other companies, and do not track you across sites.
• To count views, QR scans and language choices, the menu creates a random number that lives only in the open browser tab. We store a one-way hash of that number — never your name, email or IP address. Venues see totals only.
• Your language, light or dark theme and the time an offline copy of the menu was saved stay in your browser (localStorage) and are not sent to us.
• Like any website, our servers receive your IP address and browser details with each request. We use them to deliver the page and protect the service and do not store them in the database, except as described in 3.7.

Legal basis: our legitimate interest in a secure, working menu service (Law, art. 5; GDPR art. 6(1)(f)).

3.2 Owners, managers and staff with an account

• Email address, name, role and the venues you belong to.
• A password hash (bcrypt) — we never store the password itself — or, if you choose it, the ID, email and name Google or Facebook gives us.
• Two-step verification data, if you turn it on.
• Sign-in sessions and email-verification, password-reset and invitation links.
• Actions in the owner console, recorded in the audit log (see 3.7).

Legal basis: performing the contract with you or your venue (Law, art. 5; GDPR art. 6(1)(b)). We cannot create an account without an email address.

3.3 Staff PIN profiles and devices

• Display name, PIN hash, language, the device paired with the venue, and which staff member accepted a guest call.
• If staff turn on notifications, the browser push address of that device.

We process this data on behalf of the venue, which is the controller.

3.4 Guest orders and staff calls

• When a guest sends an order or calls staff, we store the table or room number, the dishes, any note the guest writes, the time and a random ID for that visit. We do not ask for the guest’s name, phone number or email.
• Please do not put health or other sensitive details in the note — tell staff in person. Allergen information on the menu is provided by the venue.

We process this data on behalf of the venue, which is the controller.

3.5 Billing

• Venue and business details, plan, amounts, payment status and invoices.
• Card payments happen on the page of the bank or payment company (TBC Bank, Bank of Georgia or Payze). We never receive or store card numbers; the payment company is a separate controller under its own privacy notice.

Legal basis: performing the contract and obligations under Georgian tax and accounting law (Law, art. 5; GDPR art. 6(1)(b) and (c)).

3.6 Support

• Messages you send through the help chat or to help@ecolinkwork.com, your email address, the venue concerned and our replies.

Legal basis: performing the contract or our legitimate interest in answering you (Law, art. 5; GDPR art. 6(1)(b) and (f)).

3.7 Security

• The audit log records who changed what and when, with a keyed hash of the IP address (not the address itself) and the browser type.
• To stop password guessing, sign-in and sign-up attempts are counted by IP address and email. The counter is removed when you sign in, or after about a day at the latest.

Legal basis: our legitimate interest in protecting accounts and the service, and our duty to keep data secure (Law, arts. 5 and 27; GDPR arts. 6(1)(f) and 32).

4. Cookies and browser storage

We use only the cookies needed for signing in and for the language you choose, so we do not ask for cookie consent. We use no advertising or analytics cookies.

5. Who receives data

We do not sell personal data or share it for advertising. To run the service we use these providers, bound by data processing terms:

We may also disclose data to courts, law enforcement or other authorities when Georgian law requires it. We will update this list before adding a provider that receives personal data.

6. Transfers outside Georgia

Our servers are in Singapore and some providers are in the USA or the EU. These transfers take place under Article 37 of the Law on Personal Data Protection and, where the GDPR applies, Chapter V of the GDPR — on the basis of the providers’ data processing terms and, where there is no adequacy decision, standard contractual clauses. Write to us for details.

7. How long we keep data

• Account data — while the account exists. After it is closed we delete or anonymise the data, except what we must keep by law or to defend legal claims.
• Sign-in sessions — 7 days (staff: 12 hours). Links: password reset 1 hour, sign-in link 10 minutes, email verification 24 hours, invitation 7 days.
• Sign-in attempt counters — about one day.
• Guest orders, staff calls, audit log and view statistics — while the venue’s account exists.
• Invoices and payment records — as long as Georgian tax and accounting law requires.
• Support messages — as long as needed to resolve the request and any follow-up.

8. Your rights

Under Articles 13–20 of the Law on Personal Data Protection you have the right to:

• be told whether and how your data is processed (art. 13);
• access your data and get a copy free of charge (art. 14);
• have wrong or incomplete data corrected (art. 15);
• ask us to stop processing, delete or destroy your data (art. 16);
• have your data blocked while a question is being resolved (art. 17);
• receive data you gave us in a machine-readable format, or have it sent to another controller (art. 18);
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects (art. 19) — we make no such decisions;
• withdraw consent at any time, without affecting processing before the withdrawal (art. 20).

If the GDPR applies to you, you have the matching rights under GDPR arts. 15–22, including the right to object to processing based on legitimate interests.

Owners can export menu data from the console on every plan.

9. How to use your rights and where to complain

Write to help@ecolinkwork.com from the email linked to your account, or tell us how we can confirm it is you. We reply within 10 working days; in special cases we may extend this by up to 10 working days and will tell you why. Using your rights is free.

You can complain to the State Audit Office of Georgia, which supervises personal data protection, or go to court. If you live in the European Economic Area or the United Kingdom, you can also complain to the data protection authority where you live or work.

10. How we protect data

• Every page is served over an encrypted connection (HTTPS).
• Passwords and PINs are stored only as hashes; two-step verification is available.
• Each venue’s data is separated in the database by row-level security.
• IP addresses in logs are replaced by keyed hashes; access to production systems is restricted.
• If an incident could harm you, we notify the State Audit Office within 72 hours where the Law requires it (art. 29) and tell you without undue delay (art. 30).

11. Children

Accounts are for adults acting for a business. Guest menus are open to everyone and collect no identity data. We do not knowingly collect data from children under 16 (art. 7).

12. Marketing messages

We send the messages the service needs (for example sign-in, billing and security emails). We send marketing only with your consent. You can withdraw consent at any time, and we stop within 7 working days (art. 12).

13. Changes to this notice

We publish changes here with a new version and date. We tell account holders about important changes by email or in the console before they take effect.