Privacy and Cookie Policy
LINARA, d.o.o. 6
Tomaj 24, 6221 Dutovlje
Tax number: 24336343
Registration number: 8736642000
Email: hisalisice@emeni.si
Telephone: +386 (69) 834-301
1. Who processes your data
The controller of personal data generated by the use of this digital menu is the catering establishment whose menu you are viewing. Its details are listed at the beginning of this page.
The online service eMENI is technically provided and maintained by the platform provider, who acts as a contractual processor under Article 28 of the General Data Protection Regulation (GDPR). It does not process personal data for its own purposes and does not forward it without the controller's instructions.
Platform provider: LINARA, d.o.o., Tomaj 24, 6221 Dutovlje, tax number 24336343, registration number 8736642000. Contact for data protection inquiries: info@emeni.si.
2. Which data do we process and why
You can use the digital menu without entering any personal data. We only process data when you place an order, register, or write to us.
| Purpose | Data | Legal basis |
|---|---|---|
| Order acceptance and execution | name, phone number, order content, notes on dishes, table or delivery address, pickup time | performance of the contract (point (b) of Article 6(1) GDPR) |
| Issuance and tax verification of the invoice | account information, amount, payment method | statutory obligation (point c) — Tax Verification of Invoices Act, VAT Act |
| Payment online or via terminal | amount, payment status, transaction identifier (we do not receive or store card information) | performance of the contract (point b) |
| Loyalty program and point collection | name, phone number, order history, and points balance | consent or performance of the contract (points a and b) |
| Order status notification | subscription for push notifications (device address without identity) | consent (point a) |
| Responding to questions, reviews, and complaints | content of the message and the contact information you provide | legitimate interest or performance of the contract (points f and b) |
| Ensuring safety and detecting abuse | IP address, access time, technical logs | legitimate interest (point f) |
| Bookkeeping | data from issued invoices | statutory obligation (point c) — ZDavP-2, ZGD-1 |
3. Cookies
The website uses only its own cookies, which are necessary for the functioning of the menu and ordering, and cookies that remember your settings. We do not use cookies for analytics, advertising, or profiling, and we do not track your visits across other websites. Therefore, according to the third paragraph of Article 225 of the Electronic Communications Act (ZEKom-2), consent is not required for their use, and we do not bother you with a banner upon entry.
Cookies are tied exclusively to the address you are visiting — they are not shared between individual locations. You can delete or block all cookies at any time in your browser settings; in this case, the cart, selected table, and login will not work.
The location map is only loaded when you explicitly open it by clicking. Until then, no request is sent to Google and no third-party cookie is set.
Strictly necessary cookies
| Cookie | Purpose | Duration |
|---|---|---|
PHPSESSID |
Server session cookie: connects consecutive requests of the same session. | until the browser is closed |
BITRIX_SM_* |
System cookies of the Bitrix platform (login to the admin section, form protection). | up to 1 year |
BX_USER_ID |
Anonymous device identifier. Your orders, invoices, and collected points are linked to it — without it, we would not be able to display them on your next visit. It does not contain personal data and is not used for tracking across other websites. | 1 year since the last visit |
order, orderComments, ORDER_NOTE, show_basket |
Cart contents, dish notes, and cart display status. | 6 hours |
order_id, order_db_id, pay_hash |
Current order and payment confirmation upon return from the payment provider. | 6 hours |
selectedPayment |
Selected payment method for the current order. | 6 hours |
selectedTable_<koda> |
The table you selected or from which you scanned the QR code. | 6–10 hours |
serviceMode_<koda>, serviceTime_<koda> |
Method (dine-in, pickup, delivery) and desired time for the current order. | 6 hours |
emeni_client_token |
Loyalty program login. The cookie is HttpOnly — it cannot be accessed by a script in the browser. | 1 year |
STAFF, STAFF_ID, STAFF_PRESENT |
Staff login to work mode. Not set for guests. | 90 days (rolling) |
STAFF_DEVICE |
Označi napravo, ki jo je lastnik potrdil za prijavo osebja s PIN. Piškotek je HttpOnly. Za goste se ne nastavi. | 1 leto (drseče) |
panel_section |
Selected location in the venue's admin panel. | 30 days |
emhl_t |
Access to the technical control page. For system administrator only. | 30 days |
Functional cookies (settings)
| Cookie | Purpose | Duration |
|---|---|---|
MENU_LANG |
The language you have selected. | 10 years |
MENU_TAB |
Last open menu tab. | 1 year |
colorScheme, backgroundTheme, viewType, fontSize |
Page appearance: color scheme, background, display mode, and font size. | 20 years |
CLIENT_NAME, CLIENT_PHONE |
Pre-filling the order and loyalty program registration form so that data does not have to be entered repeatedly. It is recorded only if you fill out the form. | 1 year |
last_tip_shown, price_hint_shown, upsale_block, upsale_x_count |
Remember which hints and suggestions you have already seen, so they do not repeat. | 1 hour – 20 years |
staff_editing_order |
Indicates that staff is editing an existing order. Not set for guests. | 6 hours |
emeni_from_list |
Zapomni si, s katerega seznama lokalov ste prišli na to stran, da vam v meniju lahko pokažemo pot nazaj — na isti seznam z istim filtrom. Piškotek je HttpOnly. | 8 ur |
4. To whom we disclose the data
We do not sell personal data or disclose it for foreign marketing purposes. Access is granted only to contractual processors who perform the service for us, and only to the extent necessary for this purpose:
| Recipient | Country | Purpose |
|---|---|---|
| Webtasy d.o.o. | Slovenija (EU) | website hosting, databases, and mailboxes |
| Finančna uprava RS (FURS) | Slovenija | Tax certification of issued invoices (legal obligation) |
| Mollie B.V. | Nizozemska (EU) | Processing online payments (cards, bank transfers) |
| Stripe Payments Europe, Ltd. | Irska (EU) | Processing online payments (cards, touch terminal) |
| Google LLC | ZDA (SCC) | Maps and geolocation (Google Maps) |
| Google LLC (Firebase Cloud Messaging) | ZDA (SCC) | Push notifications for Android and Chrome |
| Meta Platforms Ireland Ltd. | Irska (EU) | Publishing content on the café's Facebook/Instagram page |
| OpenAI Ireland Ltd. | Irska (EU) | AI assistant and understanding text from invoices and delivery notes |
| Microsoft Ireland Operations Ltd. | Irska (EU) | Automatic reading of invoices and delivery notes (Azure Document Intelligence, processing in EU) |
| Anthropic PBC | ZDA (SCC) | AI assistant (backup provider) |
| Mozilla Corporation | ZDA (SCC) | Push notifications for Firefox |
| Apple Inc. | ZDA (SCC) | Push notifications for Safari/iOS |
We process data in the European Union or the European Economic Area. When an individual processor processes data outside the EEA, this is done based on the European Commission's standard contractual clauses or an adequacy decision.
We also provide data to state authorities when required by law (for example, the tax administration, inspection authorities).
5. How long we retain data
| Data | Retention period |
|---|---|
| Issued invoices and accounting documents | 10 years after the end of the year to which they relate (tax legislation) |
| Orders without an invoice (e.g., canceled) | 1 year |
| Loyalty program data | until your cancellation or 3 years after the last order |
| Reviews, questions, and answers | until the revocation of the publication or 3 years |
| Subscription to push notifications | until logout or deletion of the application |
| Technical access logs | up to 12 months |
| Surveillance footage | maximum 1 year (ZVOP-2) |
6. Your rights
In relation to your personal data, you have the right to:
- familiarization with the data we process and access to their copy (Article 15 GDPR);
- correction of inaccurate data (Article 16);
- deletion of data when there is no longer a basis for processing (Article 17) — issued invoices cannot be deleted due to the legal obligation of retention;
- restrictions on processing (Article 18);
- data portability in a machine-readable format (Article 20);
- objection to processing based on legitimate interest (Article 21);
- withdrawal of consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7).
Address the request to the operator — the catering establishment listed at the beginning of this page (email: hisalisice@emeni.si). We will respond within one month at the latest.
If you believe that your rights have been violated, you can file a complaint with the supervisory authority: Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, https://www.ip-rs.si.
7. Video surveillance
Video surveillance is conducted on the premises of the establishment for the protection of property and the safety of people. Visitors are informed of this with a notice in a visible place upon entry.
Recordings are stored for no longer than permitted by ZVOP-2, after which they are deleted.
8. Data security
The connection to the website is encrypted (HTTPS). Only the staff of the establishment has access to order data through personal login, and accesses are recorded. Passwords and access tokens are stored in hashed or encrypted form. In the event of a personal data protection breach that would pose a high risk to your rights, we will inform you in accordance with Article 34 of the GDPR.
9. Changes to this policy
We can change the policy whenever the service or regulations change. The current version is published on this page, and the date of the last change is indicated under the title.
The legally binding version of the text is the Slovenian one; translations are for informational purposes.