Privacy Policy

2. Personal Data We Collect

Depending on your interaction with NexraFlow, we may collect and process:

• Account & Registration Information: Restaurant name, legal business identity, manager/owner contact details (name, email, phone number), billing address, and authentication credentials.
• Operational & Order Data: Dine-in orders, table numbers, takeaway and delivery requests, order items, ticket modifications, and staff shift records.
• Guest & Reservation Details: Guest name, phone number, email address, party size, reservation date/time, and special dining requests.
• Payment Metadata: Transaction IDs, timestamps, payment methods (e.g. TWINT, credit card, Apple Pay), and payment settlement statuses. NexraFlow never stores full credit card numbers, CVVs, or bank account PINs on our servers.
• Device & Usage Logs: IP address, device model, operating system, browser type, app version, connection logs, and diagnostic error reports.

3. Purposes of Data Processing & Legal Basis

We process your personal data under the following legal bases and operational purposes:

• Contract Performance: To deliver the NexraFlow software services, manage table orders, trigger kitchen print dispatching, and process table bookings.
• Legal Compliance: To satisfy Swiss accounting and tax retention obligations (e.g. daily Z-reports and VAT calculation).
• Legitimate Interests: To optimize system security, ensure uptime reliability, prevent fraud, and continuously improve our user interface and hardware drivers.
• Consent: Where required by law, such as sending promotional newsletters or specific marketing communications (which can be withdrawn at any time).

4. Mobile Applications (NexraFlow Restaurant & NexraFlow User)

Our mobile apps published on the Apple App Store and Google Play Store require certain device permissions strictly to deliver core functionalities:

• Camera Permission: Used exclusively to scan table QR codes for instant contactless menu ordering and pairing staff devices.
• Bluetooth & Local Network: Required by the restaurant app to discover and communicate with wireless thermal receipt printers and card terminals over local Wi-Fi.
• Push Notifications: Delivers instant sound and visual alerts for new orders, kitchen ready status, and reservation confirmations.

5. Payment Gateways & Third-Party Processors

When you accept payments at tables, through our webshop, or via card terminals, transactions are processed by certified third-party payment service providers (PSPs) including TWINT, Wallee, Mollie, and Stripe. All payment communications utilize end-to-end TLS encryption and comply with PCI-DSS Level 1 standards.

6. Data Security & Retention

We employ state-of-the-art technical and organizational measures (TOMs), including 256-bit SSL/TLS encryption in transit, encrypted storage at rest in enterprise-grade data centers located in Switzerland and the European Economic Area (EEA), role-based staff access restrictions, and regular security audits.

We retain your data only for as long as necessary to fulfill the purposes outlined in this policy or as mandated by Swiss statutory retention laws (such as commercial and tax document archiving periods of up to 10 years).

7. Your Rights Under Swiss & European Privacy Laws

You have the following rights regarding your personal data:

• Right of Access: You can request confirmation and a copy of the personal data we hold about you.
• Right to Rectification: You can request the correction of inaccurate or incomplete data.
• Right to Erasure: You can request the deletion of your personal data where statutory retention obligations do not prevent it.
• Right to Restriction & Objection: You can object to data processing based on legitimate interests or request processing limitations.
• Right to Data Portability: You can receive your data in a structured, commonly used, and machine-readable format.

To exercise any of these rights, please contact our data protection team at hello@nexraflow.com.