PRIVACY POLICY OF MOBEE
1. Introduction
This Privacy Policy describes how WebWise Consulting Limited collects, uses, stores, discloses and protects personal data processed through:
- the website mobee.space
- public pages associated with venues that use Mobee
- the Mobee software platform
- reserved areas dedicated to Customers and Partners
- contact, demo request and registration forms
- subscription and payment procedures
- features relating to reservations, orders, digital menus, events, offers, newsletters and communications
- features supported by artificial intelligence
- technical and commercial support services
- any other feature or service connected to Mobee
This notice must be read together with the Cookie Policy, the Terms and Conditions of Service and, where applicable, the Data Processing Addendum.
2. Identity of the provider and data controller
The provider of the Mobee platform is:
For the processing described in the sections relating to management of the website, accounts, subscriptions, payments, commercial contacts, Partners and service security, WebWise Consulting Limited acts as an independent data controller.
4. Privacy roles on the Mobee platform
4.1 Mobee Customer data
“Customer” means the restaurant, hotel, pizzeria, bar, venue, business or professional that opens an account, subscribes to a plan or uses Mobee.
WebWise Consulting Limited acts as an independent controller for data relating to:
- the account administrator
- employees and collaborators authorised by the Customer
- plan subscription
- billing and payments
- support
- security
- abuse prevention
- management of the contractual relationship
- compliance with legal and tax obligations
4.2 Data of guests and venue customers
When Mobee processes personal data of persons who:
- request a reservation
- place a takeaway or delivery order
- request information
- subscribe to the venue’s newsletter
- take part in events or initiatives
receive confirmations, reminders or other communications from the venue,
the Mobee Customer, namely the relevant venue, is normally the data controller.
In such cases WebWise Consulting Limited operates as a data processor, processing the data exclusively:
- to provide the features requested by the Customer
- according to the Customer’s documented instructions
- within the limits set by the Terms of Service and the Data Processing Addendum
- adopting the technical and organisational measures provided for in the contract
The Customer is responsible for the accuracy and completeness of the notice shown to its guests and for the existence of a suitable legal basis for each communication.
4.3 Limited independent processing of operational data
WebWise Consulting Limited may independently process certain technical and operational data generated by use of the platform when necessary for:
- IT security
- fraud and abuse prevention
- technical diagnostics
- infrastructure protection
- credit accounting
- incident management
- protection of its own rights
- production of aggregated or anonymised statistics
WebWise does not use Customer guests’ data to create its own independent commercial database or to send advertising directly on its own behalf, except with specific and separate consent of the data subject or another valid legal basis.
5. Categories of personal data processed
5.1 Browsing data and technical data
During use of the website or platform the following may be collected:
- IP address
- date and time of access
- pages visited
- referring URL
- session identifiers
- browser type
- operating system
- language
- device used
- technical settings
- access logs
- security logs
- application events
- error information
- cookie consent data
- indicative geographic location information derived from the IP address
5.2 Commercial contact data
Through the contact or demo request form the following may be collected:
- first and last name
- email address
- telephone number, when provided
- restaurant or business name
- city and country
- website
- professional role
- message content
- information on the current method of managing reservations, orders or communications
- commercial preferences and requests
5.3 Registration and account data
To create and administer a Mobee account the following may be collected:
- first and last name
- password in encrypted or hashed form
- business name
- Country
- role and permissions
- language
- account settings
- access history
- authorised users
- venue configurations
- history of relevant changes
WebWise does not store passwords in clear text.
5.4 Contractual and billing data
The following may be processed:
- trade name or company name
- billing address
- Country
- tax identifiers
- VAT, GST or equivalent number
- purchased plan
- subscription date
- renewals
- amounts
- currency
- discounts
- credits
- invoices
- payment status
- data relating to cancellations, disputes and chargebacks
5.5 Payment data
Payments are processed through Stripe or another payment provider indicated at checkout.
WebWise may receive:
- transaction identifier
- payment status
- last digits and card network
- expiry date in limited form
- issuing country
- anti-fraud data
- receipt references
- information relating to refunds, disputes or chargebacks
WebWise does not normally receive or store the full card number or the related security code.
5.6 Venue guest data
Depending on the features used by the Customer, Mobee may process:
- first name
- last name
- telephone number
- email address
- international dialling code
- date and time of the reservation
- number of people
- table preferences
- special requests
- notes entered by the guest or the venue
- reservation history
- reservation status
- confirmations, cancellations and no-shows
- communication content
- products or dishes ordered
- quantities
- order price and total
- pickup time
- delivery address
- delivery instructions
- requested events or offers
- consent to promotional communications, when collected
- preferred language
5.7 Potentially sensitive data
Notes relating to reservations and orders may contain information about:
- allergies
- intolerances
- disabilities
- accessibility needs
- religious beliefs inferable from dietary requests
- health conditions
- other special categories of data
The Customer must limit collection of such information to what is strictly necessary, provide an adequate notice and identify a valid legal condition for the processing.
Mobee must not be used as a health archive and is not designed to hold medical records or detailed medical information.
5.8 Communication-related data
The following may be processed:
- email addresses
- telephone numbers
- message identifiers
- date and time of sending
- message content
- delivery status
- non-delivery
- opening or interaction, if the related feature is active and permitted
- communication preferences
- unsubscribe requests
- objections
- message templates used
5.9 Partner data
For the Partner Program the following may be collected:
- first and last name
- company or brand
- website
- application information
- partner identifier
- tracking link
- clicks
- referrals
- conversions
- plan subscribed by the referred Customer
- commissions
- payments
- tax and banking data necessary for payment
- any suspicious or fraudulent activity
5.10 Content entered into the platform
The Customer may upload or create:
- menus
- descriptions
- prices
- photographs
- logos
- contact details
- opening hours
- events
- offers
- news
- newsletter texts
- communication templates
- reservation rules
- order rules
- delivery zones and costs
- translations
- instructions for artificial intelligence features
6. Sources of data
Data may be collected:
- directly from the data subject
- from the Mobee Customer
- from an employee or collaborator authorised by the Customer
- through public reservation or order pages
- through the website and forms
- through Stripe or other payment providers
- through email, WhatsApp or messaging providers
- through authorised Partners
- through security and monitoring systems
- through cookies and similar technologies
- from publicly accessible sources, within the limits permitted by law
7. Purposes and legal bases
7.1 Provision of the website and platform
Data are processed to:
- enable browsing
- create and authenticate accounts
- maintain sessions
- display menus and public pages
- manage reservations and orders
- perform the requested functions
Legal basis, where applicable: performance of the contract, pre-contractual measures and legitimate interest in the secure operation of the service.
7.2 Subscription management
Data are processed to:
- activate the plan
- account for credits
- manage renewals and cancellations
- issue accounting documents
- collect fees
- manage failed payments
- prevent fraud and abuse
Legal basis: performance of the contract, legal obligation and legitimate interest.
7.3 Contacts and demos
Data are processed to respond to requests, organise a demo, prepare an offer and carry out pre-contractual activities.
Legal basis: request of the data subject, pre-contractual measures and legitimate interest in responding to commercial communications received.
7.4 Support
Data are processed to:
- respond to tickets
- diagnose errors
- resolve issues
- record support activities
- improve platform reliability
Legal basis: performance of the contract and legitimate interest in the proper provision of the service.
7.5 Security and abuse prevention
Data are processed to:
- protect accounts and infrastructure
- detect unauthorised access
- prevent fraud
- counter spam and unlawful use
- retain security evidence
- exercise or defend rights
Legal basis: legitimate interest and legal obligations.
7.6 Administrative communications
WebWise may send necessary communications regarding:
- account activation
- security
- contractual changes
- billing
- renewals
- payments
- maintenance
- service changes
- cancellation
- incidents
Such communications are not advertising and cannot be disabled while the account remains active.
Legal basis: performance of the contract, legal obligation and legitimate interest.
7.7 WebWise marketing
Sending of WebWise newsletters or commercial offers takes place:
- with the data subject’s consent, when required
- on the basis of legitimate interest, exclusively when permitted by applicable law and in compliance with the right to object
Every promotional communication will contain an easy method to unsubscribe.
7.8 Analytics and improvement
WebWise may use aggregated data, statistics and technical information to:
- understand service usage
- improve features and interface
- measure performance
- plan development
- produce aggregated reports
When non-strictly necessary analytics tools are used, processing takes place on the basis of consent requested through the cookie banner.
7.9 Legal compliance
Data may be processed for:
- accounting and tax obligations
- authority requests
- corporate compliance
- sanctions and export controls
- dispute management
- anti-money laundering, where applicable
Legal basis: legal obligation and legitimate interest in the protection of rights.
8. Artificial intelligence features
Mobee may include features based on artificial intelligence models to assist the Customer in creating, translating, classifying or managing:
- texts
- replies
- menus
- descriptions
- messages
- guest requests
- commercial content
- organisational activities
When an AI feature is used, the content entered and the information necessary for generation may be transmitted to the technology provider used by Mobee.
The Customer must:
- avoid entering unnecessary personal data
- not enter special categories of data except where strictly necessary and with a valid legal basis
- always verify outputs
- not use outputs as the sole basis for decisions with legal or similarly significant effects on individuals
- check the accuracy of prices, allergens, availability, opening hours and commercial information
9. Guest reservations, orders and communications
The venue using Mobee decides:
- which data to collect
- which fields to make mandatory
- which communications to send
- how long to retain the data
- whether to activate newsletters or promotional communications
- which users to authorise
- which rules to apply to reservations and orders
Communications strictly necessary to:
- confirm a reservation
- communicate a change
- send a reminder
- update order status
- manage a cancellation
provide information requested by the guest,
are service communications.
Advertising or promotional communications must be managed separately and require the legal basis provided for by applicable law.
10. Recipients and providers
Data may be disclosed, within necessary limits, to:
- hosting and cloud infrastructure providers
- database, backup and storage providers
- IT security and monitoring providers
- Stripe or other payment providers
- transactional email providers
- WhatsApp, SMS or messaging providers
- artificial intelligence providers
- support and ticketing providers
- analytics providers, subject to consent when necessary
- legal, tax, accounting and insurance advisers
- public authorities
- potential buyers or investors in the context of corporate transactions, subject to confidentiality obligations
Parties that process data on behalf of WebWise are bound by contractual data protection obligations.
11. International transfers
WebWise Consulting Limited is based in Hong Kong and the platform may use providers located in countries other than that of the data subject.
When personal data subject to the GDPR or other laws that restrict international transfers are transferred outside the European Economic Area, WebWise uses, as appropriate:
- adequacy decisions
- standard contractual clauses approved by the European Commission
- contractual clauses approved in the United Kingdom or Switzerland
- supplementary contractual agreements
- supplementary technical and organisational measures
- encryption
- minimisation
- pseudonymisation
- other permitted legal bases
The Customer may request information on the applicable mechanism by writing to info@mobee.space.
12. Retention periods
Data are retained for the time necessary for the stated purposes.
In general:
- commercial contact data: up to 24 months from the last significant interaction
- abandoned checkout data: up to 30 days, except for support requests or security obligations
- active accounts: for the entire duration of the relationship
- administrative and contractual data: for the period required by applicable tax, accounting and civil law
- invoices and transactions: normally from 7 to 10 years, according to applicable obligations
- support tickets: up to 36 months from closure, except for disputes
- security logs: normally from 6 to 12 months, except where investigation is needed
- unaccepted Partner applications: up to 24 months
- accepted Partner data: for the duration of the relationship and for the subsequent period necessary for accounting obligations and dispute management
- marketing consents: until withdrawal and thereafter for the period necessary to document the withdrawal
- Customer Data: for the duration of the subscription and for an ordinary maximum period of 30 days from termination
- backup copies: progressive deletion within an ordinary maximum period of 90 days
- data necessary for disputes: until the dispute is resolved and limitation periods expire
The Customer may configure shorter periods or request deletion, within applicable technical and legal limits.
13. Security
WebWise adopts measures that are reasonable and proportionate to the risk, including:
- encrypted connections
- access control
- authentication
- password hashing
- account separation
- role-based permissions
- security event logging
- updates and vulnerability management
- backups
- recovery procedures
- limitation of administrative access
- confidentiality agreements
- provider assessment
- incident management procedures
No system can, however, guarantee absolute security.
The Customer is responsible for:
- choosing strong passwords
- protecting credentials
- promptly disabling users who are no longer authorised
- controlling privileges
- not sharing personal accounts
- informing WebWise of suspicious access
- using adequately protected devices and networks
14. Personal data breaches
In the event of a breach involving data processed on behalf of a Customer, WebWise informs the Customer without undue delay after becoming aware of it and provides, to the extent available:
- nature of the incident
- data involved
- categories of data subjects
- possible consequences
- measures taken
- contact for updates
The Customer remains responsible for assessing notification obligations to data subjects and authorities when acting as controller.
15. Rights of data subjects
Where provided for by applicable law, the data subject may request:
- access to their data
- rectification
- erasure
- restriction
- portability
- objection
- withdrawal of consent
- information on transfers
- a copy of the data
- review of automated decisions, where applicable
Withdrawal of consent does not affect the lawfulness of prior processing.
Requests relating to the Mobee account or to processing carried out by WebWise as controller may be sent to:
info@mobee.space
Requests concerning a reservation, order or newsletter of a specific venue must first be addressed to the venue, as data controller. WebWise will assist the Customer in responding to requests received.
WebWise may ask for information necessary to verify the identity of the requester.
18. Automated decisions
Mobee does not normally use website users’ data to take solely automated decisions that produce legal or similarly significant effects.
Artificial intelligence features are assistive in nature. The Customer must maintain human control over relevant decisions.
19. Sale and sharing of data
WebWise does not sell personal data of users or of Customer guests in exchange for money.
WebWise does not use Customer Data for independent behavioural advertising.
Where local law grants specific rights regarding “sale”, “sharing” or targeted advertising, the data subject may exercise them by writing to info@mobee.space.
20. Links and external services
Mobee pages may contain links to:
- venue websites
- Google Maps
- social networks
- payment systems
- other external services
Access to an external site entails application of that provider’s privacy policy. WebWise does not control the processing methods used by external sites.
21. Changes to the Privacy Policy
WebWise may update this Privacy Policy for:
- regulatory changes
- service developments
- introduction of new providers
- technical changes
- organisational changes
The date of the last update will be indicated at the beginning of the document.
Substantial changes may be communicated via the website, account or email.
22. Contacts
For privacy requests: