Privacy policy

VenueBites lets you order food and drink at a venue (from your seat, your table or wherever the canteen delivers), on the web or in the VenueBites app, without an account. The platform is operated by Venushub CY LTD, a company registered in Cyprus (registration number HE442414, VAT number CY60003025H, registered office Geranon 1, 7040 Larnaca, Cyprus). The canteen you order from sells you the food and drink. This page lists what the system actually stores, for how long and who receives it; it was checked against the software on 11 October 2026. This page is in English only for now; the ordering pages are in English and Greek.

Who is responsible

The canteen you order from and Venushub CY LTD each have a role under the GDPR, and a data processing agreement between them sets out what Venushub may do with your data on the canteen's behalf.

What we collect when you order

Required (the order cannot be placed without it):

• Your name (so the canteen can call your order) and your mobile number (for status messages and for finding your order again).
• Your seat (stand, section, row, seat) for delivery, or the pickup point; what you ordered, the prices and the time. When the canteen prints a kitchen or runner ticket, we keep a copy of that ticket (name, number, seat, note, items) with the order.
• The result of your payment as the canteen's payment provider reports it: amount, status, card brand and last four digits, the provider's reference. You type your card on the provider's own page or card field; the full card number never reaches our servers.
• A one-way keyed hash of your IP address and, in the app, of a random ID the app created on install. These cap how many unpaid orders one address or one device may hold at once (unpaid orders reserve stock). The hash cannot be read back without our key, so it is pseudonymous rather than anonymous; the IP address and the install ID themselves are not stored on the order.
• The language you ordered in (English or Greek), so your messages come in that language.

Optional:

• A note to the kitchen, if you type one.
• Push notifications in the app (see Notifications below), only if you switch them on for an order.
• “Remember my details” keeps your name, number and seat on your own device only.

With every order we also record which version of the Terms of use was in force when you placed it and, if the basket contained alcohol, the time you ticked the 18+ confirmation. Neither says who you are, and both stay with the order's accounting record after your details are removed.

Not collected: we do not store your age or date of birth (only that you confirmed being 18 or over, and when), your location (see below), your card number, or anything for advertising or analytics.

Why we use it, and the legal basis

How long we keep it

• Your personal details on an order (name, mobile number, seat or pickup point, note, the number in the SMS log and the printed-ticket copy) are removed 180 days after the order closes (completed, rejected, cancelled, failed or refunded); on demo venues after 24 hours. A job does this every hour. You can ask for it sooner at Delete my data: we text a code to the number you ordered with and remove the details as soon as you confirm.
• The sale itself (items, amounts, VAT rates and fees, dates, payment and refund references, the payment provider's transaction IDs, settlement references, card brand and last four) stays at least 7 years from the end of the financial year of the transaction, as Cyprus tax and company law requires (Assessment and Collection of Taxes Law, Companies Law Cap. 113), without your details.
• Request counters holding your IP address or your phone number (in international format) are deleted after 24 hours.
• Push notification data is deleted 3 days after the order closes, or 3 days after you switch it off or the phone stops accepting messages.
• Technical copies of the payment provider's replies and webhooks are kept with the payment record, for the same period as the sales records.

Who receives it

• The canteen's staff and runners see your name, number, seat, note and order on their screens and ticket.
• Our hosting provider stores everything above (see Where it is processed).
• The SMS provider receives your mobile number and the text of each message.
• The canteen's payment provider receives the amount, the order code and canteen name, and our order references. If the canteen uses Viva, it also receives your name; Stripe, JCC and Revolut do not.
• If you switch on push: Expo, and through it Apple or Google, receive the push token and the message text.
• Nobody receives it for advertising, profiling or resale.

Where it is processed, and transfers

Your rights

You can ask for access to, correction or deletion of your data, object to its use, or ask for a copy, by writing to support@venuebites.com. How deletion works, and what accounting records remain, is explained at Delete my data. You can also complain to the Commissioner for Personal Data Protection in Cyprus.

Cookies and storage

Ordering uses no tracking, advertising or analytics cookies. The site sets only two cookies: vh_lang, and only when you choose a language yourself, and vh_session, for canteen staff who sign in; the VenueBites app sets no cookies and keeps its data on your phone (table below). No cookie consent banner is shown because there are no non-essential cookies: both are strictly necessary for a service you explicitly asked for (Article 5(3) of the ePrivacy Directive, as applied in Cyprus).

Notifications

• SMS: we always text you when the canteen accepts your order (the order number, the amount charged, where to collect it or where it will be brought — your row and seat, or the location you chose — and the tracking link), and always if it is rejected, cancelled, refunded or the payment fails. We also text you when it is ready (or on its way to you), unless the app is following the order with push notifications. We do not text you when the order is received or completed; those appear on the tracker and as push. [SMS policy per ADR 68 — the platform setting may be “Full”, in which case every update is texted.]
• Push (app): only if you say yes for an order, and only for that order. The message contains the order code and the status text, which may include the pickup point, where a delivery goes (your row and seat, or the location you chose), the refund amount or the rejection reason; never your name or number. You can switch it off on the tracker at any time.
• No marketing, ever: we never send promotional messages, and we do not give your number to anyone for that purpose.

Location (VenueBites app)

If you tap “Find canteens near me” (or have allowed location before), the app reads your phone's position on the phone only and compares it with the public list of venue positions it downloads. The app sends no coordinates to us, and nothing about your position is stored (checked in the app's code on 11 October 2026). You can scan the QR code or type the venue code instead.

Ticket scan (VenueBites app)

If you choose “Scan my ticket or season card”, the app reads the photo or screenshot on the phone only and uses only the gate, section, row and seat, exactly as if you had typed them; the image and the recognised text (such as your name or card number) never leave the phone and are not stored.

On Android the reading is done by Google's ML Kit library, which, according to Google, sends Google technical diagnostics and usage statistics about the library itself (such as the device model, the app version, performance figures and a per-installation identifier not intended to identify you) — not the image or its text. On iPhone the reading is done by iOS itself.

Age, children and alcohol

VenueBites is intended for users aged 14 and older. Under Cyprus law (Law 125(I)/2018, which applies Article 8 of the GDPR), 14 is the age from which a person can agree to an online service like this one on their own; we do not knowingly collect data from anyone younger. Alcohol ordering is strictly limited to people aged 18 and older: alcohol can be ordered only where the venue allows it and only after you confirm you are 18 or over; photo ID is checked when it is handed over; we keep only the time you confirmed, not your age or date of birth.

Canteen staff

Staff who sign in have an account (email, name, password hash, optional two-factor secret). We keep their session's IP address and browser, an audit log of important actions with IP address and browser, and, for “Forgot password”, the requesting IP address for up to 7 days after the link expires; the reset email is sent through Resend, Inc. (USA; EU-US Data Privacy Framework / standard contractual clauses). A failed sign-in is logged with the email address tried. Venushub CY LTD is the controller for staff accounts, on the basis of the contract with the canteen and its legitimate interest in access control and audit logging. The canteen's card or SEPA direct-debit mandate for our fees is held by Stripe; we store only a reference and a label such as “VISA •••• 4242”, plus the canteen's contact and payout bank details for its settlements. Billing, ledger and settlement records are kept at least 7 years like the sales records. Expired sign-in sessions are deleted 7 days after they expire. Audit logs are kept for as long as the canteen's account exists.

Changes

When the software changes what it collects, this page changes with it and the date at the top moves. The engineering inventory this page is written from is kept with the source code.