Privacy Policy

1. Data Controller

At the time of publication, Xiova is operated by an individual/business that is in the process of formalising its business registration.

These details will be updated when the relevant legal/business registration information is finalised.

2. Personal Data We Collect

The personal data we collect depends on how you interact with Xiova.

2.1 Restaurant owners and business users

When a restaurant registers for Xiova or uses our services, we may collect:

• Owner or contact person's name
• Restaurant/business name
• Email address
• Telephone number
• Number of restaurant tables
• Account and authentication information
• Restaurant configuration and settings
• Information necessary to provide and operate Xiova services

2.2 Restaurant customers

When a customer uses Xiova through a restaurant's digital menu or ordering system, we may process information associated with an order, depending on the features enabled by that restaurant.

This may include:

• Table number
• Items ordered
• Order details
• Order status
• Order date and time
• Contact information where voluntarily provided

Xiova does not intentionally request or require special categories of personal data, such as health information, religious beliefs, political opinions, or biometric information, for the ordinary operation of the service.

3. Information Collected Automatically

Xiova does not intentionally collect IP addresses, browser information, device information, or operating-system information through its restaurant registration form.

However, when you visit or use a website or online service, basic technical information may be processed automatically by hosting, security, or infrastructure providers as part of delivering and protecting the service.

This may include technical information such as:

• IP address
• Browser or device information
• Operating system information
• Language and general technical information
• Security and diagnostic information
• Information necessary to maintain availability and security

Xiova does not intentionally use this information to create advertising profiles or sell personal information to third parties.

4. How We Use Personal Data

We may process personal data to:

• Provide Xiova services;
• Process restaurant registrations;
• Create and manage restaurant accounts;
• Authenticate users;
• Provide restaurant ordering and management functionality;
• Process and manage orders;
• Send registration, account setup, security, and service-related emails;
• Provide customer support;
• Maintain and secure our systems;
• Detect and prevent fraud, abuse, and security incidents;
• Troubleshoot technical problems;
• Improve the reliability and functionality of Xiova;
• Comply with applicable legal obligations; and
• Establish, exercise, or defend legal claims where necessary.

5. Legal Bases for Processing

Performance of a contract

Where processing is necessary to provide a service requested by a restaurant owner or user.

Steps before entering into a contract

For example, when a restaurant submits information during registration or early access registration.

Legal obligation

Where processing is necessary to comply with applicable laws or legal requirements.

Legitimate interests

Where processing is necessary for legitimate business interests such as maintaining service security, preventing abuse, protecting our systems, and improving the service, provided that those interests do not override the rights and freedoms of individuals.

Consent

Where consent is required by applicable law, we will request it before processing the relevant personal data.

Where processing is based on consent, consent may be withdrawn at any time.

6. Registration and Account Emails

Xiova may send transactional emails relating to:

• Registration;
• Account activation;
• Password/setup processes;
• Security;
• Service operation; and
• Important account-related information.

These emails are necessary for the operation of the requested service and are different from optional marketing communications.

7. Third-Party Service Providers

Xiova uses third-party technical service providers to operate the platform.

Hosting and infrastructure

Xiova uses Render for hosting and infrastructure services.

Database infrastructure

Xiova uses PostgreSQL-based database infrastructure to store and manage application data.

Email delivery

Xiova uses Resend to deliver transactional emails such as account setup and registration-related messages.

Xiova does not sell personal data to third parties.

8. International Data Transfers

Some service providers used by Xiova may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, Xiova will use an appropriate lawful transfer mechanism required by applicable data-protection law, where applicable.

9. Cookies and Similar Technologies

Xiova's public website does not intentionally use advertising cookies or tracking technologies for behavioural advertising.

Xiova may use technically necessary cookies or similar technologies where required for authentication, security, session management, essential functionality, or maintaining the operation of the service.

If Xiova introduces analytics, advertising, profiling, or other non-essential tracking technologies in the future, the relevant privacy and cookie information will be updated and any legally required consent will be obtained.

10. Data Retention

Xiova retains personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Different types of information may have different retention periods.

Xiova may periodically delete or anonymise personal data that is no longer reasonably required.

11. Data Security

Xiova implements reasonable technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, misuse, alteration, unauthorised disclosure, and other security threats.

However, no internet-based service can guarantee absolute security.

12. Data Sharing

Xiova may disclose personal data where necessary to service providers, comply with applicable laws, respond to lawful requests, protect Xiova and its users, or in connection with a lawful corporate transaction.

Xiova does not sell personal data.

13. Your GDPR Rights

Subject to applicable legal conditions, individuals in the European Economic Area may have the right to:

• Request access to their personal data;
• Request correction of inaccurate or incomplete data;
• Request deletion of personal data;
• Request restriction of processing;
• Object to certain processing;
• Request portability of certain personal data;
• Withdraw consent where processing is based on consent; and
• Lodge a complaint with a competent supervisory authority.

14. How to Exercise Your Rights

To make a privacy request, please contact:

xiovatech@gmail.com

We will respond within the time required by applicable data-protection law.

15. Complaints

If you believe that your personal data has been processed unlawfully, you have the right to contact the competent data-protection supervisory authority.

For Italy, the competent authority is the Garante per la protezione dei dati personali.

You may also contact Xiova first so that we can attempt to address your concern.

16. Children's Data

Xiova is primarily intended for restaurants, hospitality businesses, and their customers.

Xiova does not intentionally target children with its services or knowingly collect children's personal data for purposes that are not permitted by applicable law.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to Xiova, our services, technology, data-processing practices, or applicable legal requirements.

When we make changes, we will update the Last updated date at the top of this page.

18. Contact