Privacy policy
This explains which personal data we process when you use ServedSoul, why, for how long and what your rights are. In line with the BiH Law on Personal Data Protection and the GDPR.
Effective from 01.11.2026
Translation. The Bosnian version is legally binding. Show the Bosnian version
1. Who is responsible
For the guest profile (shared portal) and for venue accounts on the platform, the controller is SoulGrid Solutions, Sarajevo. Data protection contact: info@soulgridsolutions.com.
For orders, bills and staff data in a venue, the controller is that venue and we are the processor. You can send questions about that data to the venue or to us; we will forward them to the venue.
2. Which data we process
| Type | Data | When |
|---|---|---|
| Order | table, items, options, note, time, status, amount | when you order |
| Position | a one-time check that you are within the venue’s radius; only the result (yes/no) and the time are stored | only when sending an order |
| Table session | session cookie, shortened fingerprint of the IP address, browser | when you scan the QR code |
| Guest profile | name, e-mail, password (hash only), phone (optional), language | when you create a profile |
| Diet | allergens, diabetes, note | only if you enter them; to a venue only with separate consent |
| Consents | type, text version, time, shortened fingerprint of the IP address | when you give or withdraw consent |
| Staff | name, e-mail, role, PIN (hash), shifts, performance, sign-ins | when you work in a venue |
3. Why and on what basis
- fulfilling your order and using the service (contract);
- checking your position when sending an order, security and preventing misuse (legitimate interest of the venue and ours);
- health data only with your explicit consent, separate for each venue;
- news and offers only with your consent;
- keeping bills and records the venue is required to keep (the venue’s legal obligation);
- analytics of visits to public pages only with consent (see “Cookies”).
4. Position (GPS)
The browser asks for location permission only when you press “Send order”. Your position is used once, to check that you are within the venue’s radius, and is not stored as coordinates or tracked. Without permission you cannot send an order through the app, but you can order from the staff.
5. Health data
Allergen and diabetes information is shared with a venue only with your explicit, separate and revocable consent for that venue. Details are in the “Health data” document.
6. How long we keep data
| Data | Period |
|---|---|
| Table session | 12 hours |
| Live events (staff notifications) | 48 hours |
| Guest profile | until you delete it |
| Orders and bills | as long as the venue must keep them by law; anonymised in your profile after deletion |
| Proof of consent | while the purpose lasts and up to 3 years afterwards, as evidence |
| Password reset tokens | at most 2 hours |
7. Who receives data
The venue where you order sees your order and, only with consent, your dietary information. To run the service we use a hosting provider and an e-mail delivery provider. We do not sell data and do not use it for third-party advertising.
8. Your rights
- access to and download of all your data (in your profile: “Download my data”, JSON);
- rectification of inaccurate data;
- deletion of your profile (anonymisation: e-mail and name are removed permanently, orders stay with the venue without your identity);
- withdrawal of consent at any time, without affecting earlier processing;
- objection to processing based on legitimate interest;
- a complaint to the Personal Data Protection Agency of Bosnia and Herzegovina or to the supervisory authority in the country where you live.
For any questions write to info@soulgridsolutions.com. We reply within 30 days at the latest.
9. Security
The connection is always encrypted (HTTPS). We store passwords only as hashes, and each venue’s data is strictly separated. Administrator access to a venue’s business data is only possible with the venue’s approval and is recorded.
10. Children
A guest profile can be created by persons over 16. Younger guests can order in the venue without a profile.
11. Changes
We announce material changes in the app. The effective date is at the top of this document. The Bosnian version is binding.