Privacy
Privacy Policy
This policy explains what happens to your data when you visit the CallWaiters marketing site and when you submit the demo form. The short version: we collect as little as possible, we do not track you, and we use what we collect only to call you back.
1. Scope
This policy covers this marketing website only. The CallWaiters product itself — the QR menu, ordering and payment flow running at a restaurant's tables — is governed by the agreement with that restaurant and has its own privacy policy, shown inside the app (from the menu and from the sign-in screen). For guests' order and payment data, the restaurant is the controller and MICOVA OÜ processes the data on its behalf; that data is not the subject of this policy.
This policy is also available in French.
2. Who we are
The controller of your personal data is MICOVA OÜ, the company behind CallWaiters, registered in Estonia (registry code 17626732) at Harju maakond, Tallinn, Kesklinna linnaosa, Tartu mnt 67/1-13b. You can reach us at [email protected] for any privacy question, request or complaint.
3. What we collect
Simply browsing the site asks nothing of you. The only way we collect personal data is the demo form:
- Venue name — required
- Contact name — required
- Phone number — required
- Email address — optional
- Your message — optional, and its contents are up to you
If you email us directly, the contents of that correspondence are naturally in our hands too. The server hosting this site may keep technical access logs (IP address, timestamp, requested file), as almost every web server does; we do not use those logs for marketing or profiling.
4. Why we process it, and our legal basis
We use what you send us to:
- answer your demo request and call you back;
- respond to your questions about the product;
- take pre-contractual steps if the conversation leads somewhere.
Where the GDPR applies, our legal bases are Article 6(1)(b) — steps taken at your request before entering into a contract — and Article 6(1)(f), our legitimate interest in responding to people who ask us to get in touch.
We do not use your details to send marketing messages. If we ever want to, we will ask for your consent separately first, and you will be able to withdraw it at any time.
5. Cookies and tracking
This site sets no cookies. No analytics, no advertising pixels, no social media trackers, and nothing stored in your browser. That is why you are not being asked to accept anything — there is nothing to accept.
If that ever changes, we will update this policy and ask for consent where consent is required.
6. Third parties
This site is served through Cloudflare, which acts as our processor: your request passes through Cloudflare's network, so Cloudflare processes your IP address and request details to deliver the page and protect it from abuse. Apart from that, every file the page needs, typefaces included, is served from our own domain.
The only outbound request is to our own API (api.callwaiters.com), and
only when you actually submit the demo form. Our API does not keep the form
in a database: it sends it to us by email through our email provider,
Microsoft 365 (Microsoft Ireland Operations Ltd.), which acts as our
processor. Your request is then stored in our Microsoft 365 mailbox. We do not sell,
rent or share your data for marketing purposes.
7. International transfers
MICOVA OÜ is registered in Estonia (European Union). Your submission is sent by email through Microsoft 365 and stored in our mailbox, with data kept in the European Union; Microsoft may access it from other countries for support and security, under the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. Cloudflare, which serves this site, operates a global network, so your request may be handled outside your country; Cloudflare relies on the EU Standard Contractual Clauses for such transfers.
8. How long we keep it
We keep your request for at most 3 years after your last contact with us, then delete it from our mailbox. The copy kept in our API's email queue is deleted after 90 days. If you become a customer, your details move to your customer file and are kept as set out in your contract. You can ask us to delete them sooner at any time — one email to [email protected] is enough.
9. Your rights
Where the GDPR applies to you, you have the right to request access to your personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of what we did before you withdrew it.
You also have the right to lodge a complaint with a supervisory authority, normally the one where you live or work (Art. 77).
To exercise any of these, write to [email protected]. We respond within 30 days. We may ask you for enough information to confirm who you are before we act on a request.
10. Security
Your submission travels over an encrypted connection (HTTPS). We take reasonable technical and organisational measures to protect your data and fix weaknesses we find in our systems. Even so, no transmission over the internet and no method of storage is absolutely secure, and we would rather say so than pretend otherwise.
If you find a security problem in this site or our API, please tell us at [email protected]. We take such reports seriously.
11. Children
CallWaiters is a service for businesses. This site is not directed at children and we do not knowingly collect data from them.
12. Changes
We may update this policy as our service or the law changes. The current version is always published here, and the "last updated" date above tells you which one you are reading.