Privacy policy

Who is responsible?

Milvexa is responsible for deciding how information received through this website is used. Our available business details are on the Company information page. Privacy questions can be sent to the contact address below.

When you send an enquiry

Our Contact and Restaurant Website forms send the details below to our application. Successful submissions are emailed to our business mailbox. We use them to answer you, discuss suitability and prepare a possible proposal. An ordinary email enquiry is handled for the same purpose.

Contact requires your name, email, topic and message. Company name is optional. The Restaurant Website form requires name, company/restaurant name and email, with optional phone, message and package. Please avoid sensitive personal information.

The website does not create a CRM profile or store a full lead in a lead-management database. We do not automatically subscribe you to marketing or make automated decisions with legal effects about you.

After validation or delivery errors, the form can temporarily retain your input in the server session so you can retry. The session has a configured lifetime of 120 minutes.

• Your name, email address and message. The central Contact form also includes a topic and an optional company name.
• The Restaurant Website form requires a company or restaurant name. Phone, message and maintenance package are optional there.
• An optional selected package: Essential, Care or Pro.
• Your Restaurant Website configuration: restaurant name, concept/layout, five colours, heading font, body font and preview device.
• The language, enquiry reference and submission time. Contact enquiries include the Contact page path and may include a recognised referring Milvexa page without its query. Restaurant enquiries include the configuration and price summary.

Why we use this information

Project enquiries are handled to take steps you request before a possible agreement. For general questions and business correspondence, we rely on our legitimate interest in responding. Necessary security and storage support our legitimate interest in keeping the website reliable and preventing abuse. Optional analytics relies on consent under the normal settings.

Submitting an enquiry is separate from allowing analytics. Rejecting analytics does not prevent an enquiry, demo or language change.

Configurator and shared demo links

Editing the configurator normally happens in your browser. Temporary browser storage and history can retain preview choices to support language changes and returning from a demo. They do not contain your lead-form name, email, phone or message.

A shared or opened demo URL can include the restaurant name and selected design options. Those query values reach our server and may appear in browser history or technical access logs. Anyone who has the link can see them. Avoid personal or confidential details in a demo name. These URL values are not sent to analytics.

Optional analytics

When enabled, analytics helps us understand visits and actions such as choosing a concept or package, opening a demo and submitting an enquiry. Our own first-party integration sends categories through the website server to Insights in the Milvexa Business Panel. Tracking starts only after acceptance by default.

Events contain only allowed categories, such as language, page, layout, package, device, action location and a general failure reason. We do not send restaurant names, lead-form names, email, phone, messages, submission references, colours, fonts, URL queries or referrers to analytics.

The website server receives the network information needed for a request, but does not forward the visitor’s IP address, browser information or cookies to the Panel. Analytics stores no personal details, fingerprint or visitor ID and sets no tracking cookies. Technical hosting logs are separate from analytics.

Optional analytics is currently available on this website. You can manage your choice through Analytics preferences.

Security and technical records

We use form validation, CSRF/origin protection, rate limits and duplicate-submission controls. Contact also uses a hidden spam field and a short timing check. Rate limits use hashes derived from the client IP and, for Contact, a normalised email address. Duplicate-prevention records contain hashes and short-lived processing states or locks, rather than full contact fields.

Application mail-failure warnings record the enquiry reference, processing stage and error type. Restaurant form warnings also identify the configured mailer. They do not record form content or credentials. Webserver and service logs may contain IP addresses, browser/request information, requested URLs and timestamps. These records support operation, diagnosis and abuse prevention. They are not advertising profiles.

Who may process data

Our authorised operator handles enquiries. Website operation and email delivery may involve hosting, email and security service providers acting for us. An enabled analytics provider receives only the analytics information described above. We share only what is needed for those purposes or a legal requirement. We do not sell your data or send leads to an advertising network.

We do not claim that a CRM, payment provider or automatic website-provisioning service receives your enquiry: those integrations are not part of this website. Before using a service that transfers personal data outside the European Economic Area, we must establish the appropriate safeguards and update this information. You can ask us about the suppliers and safeguards that apply.

How long we keep information

Enquiries and related email are kept while needed to answer you, follow up a requested proposal and deal with the resulting correspondence. We review closed enquiries and remove information when it is no longer needed, unless a legal obligation or a specific dispute requires longer retention. There is no automatic mailbox-deletion feature in this website.

Restaurant enquiry duplicate-prevention hashes are valid for 24 hours. Contact duplicate-prevention hashes are valid for 15 minutes. Consent choices are valid for 180 days under the current settings. Application warnings use rotating log retention. Other technical records and any backups depend on the relevant service and are limited to their operational or security purpose. An expired browser record may remain until it is replaced or cleared. The Cookies & analytics page gives the storage details.

Your choices and rights

You can ask for access, correction, deletion or restriction of your personal data, and object to processing based on legitimate interests. Portability applies where the legal conditions are met. Contact us at the address below. We normally respond within one month and may ask only for information needed to verify your identity.

You can withdraw analytics permission through Analytics preferences. Withdrawal stops future tracking without undoing lawful earlier processing or requests already received by the provider. You may also complain to your data protection authority, including the AP in the Netherlands or AEPD in Spain.

Dutch Data Protection Authority (AP) · Spanish Data Protection Agency (AEPD)

Changes to this policy

We update this policy when the website or relevant processing changes. The date above identifies this version. New purposes or providers must be assessed and explained before they are used.