Last updated: 30 October 2026
1. Scope of this notice
This notice, provided under Articles 12 and 13 of Regulation (EU) 2016/679 (GDPR), describes the processing of data relating to visitors to QRMenu.it, people submitting enquiries and people trying the GaIA assistant through the demo channels listed on the website. It does not replace the notices of restaurant clients using the service for their own businesses.
2. Data controller and contact details
HighTech S.a.s., with its registered office at Corso Garibaldi 177, 80070 Monte di Procida (NA), Italy, VAT number 09444851217, is the data controller for this website and its own demonstration and commercial activities.
For personal data enquiries and to exercise your rights: info@hightechsas.it. The privacy contact published on the company website is also available: dpo@hightechsas.it. Company website: www.htsolution.it. Company telephone: +39 081 868 1442.
The controller determines the purposes and means of processing. Providers processing data on its behalf act as processors where the conditions of Article 28 GDPR apply. For services provided to a restaurant client, the respective roles are governed separately by the contract and the restaurant’s privacy notice.
3. Data processed
Browsing and security: IP address, date and time of the request, resources requested, browser and device information, technical outcomes and logs needed to deliver and protect the website.
Contact enquiries: first name and surname, email address, restaurant or business name if provided, and message content. Enquiries are forwarded to info@hightechsas.it through the contact form.
GaIA phone demo: caller number where available, technical communication data, voice, audio recording, transcript, conversation content and information you choose to provide, such as your name, contact details and details of a demonstration booking. You are interacting with an artificial intelligence assistant.
Do not include passwords, payment details, identity documents or health information in messages or trials. Test data are sufficient for a demonstration. Additional channels, such as WhatsApp, may only be used if actually listed as active and accompanied by the relevant information.
4. Purposes and legal bases
Providing the website, preventing abuse and resolving faults: the controller’s legitimate interest in the availability and security of its services under Article 6(1)(f) GDPR, respecting data subjects’ rights.
Answering enquiries, providing information and preparing a requested offer: taking steps at the data subject’s request before entering into a contract, Article 6(1)(b) GDPR. For enquiries unrelated to a potential contract, the legitimate interest in handling incoming communications, point (f).
Providing the demonstration and handling the requested conversation: steps requested before entering into a contract, Article 6(1)(b). Audio recording and retention of the trial transcript: specific consent under Article 6(1)(a), to be obtained before such processing starts. If you do not wish to try a recorded demonstration, you can request information by email or through the contact form. Consent may be withdrawn at any time without affecting processing already lawfully carried out.
Legal obligations and protection of rights: compliance with applicable obligations, Article 6(1)(c), and, where necessary, the legitimate interest in establishing, exercising or defending legal claims, point (f).
The contact form does not subscribe you to newsletters or promotional campaigns. Any marketing processing requires a separate legal basis and specific information.
5. Optional website statistics
With your consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code), we use Google Analytics 4 to understand page visits and interactions with our services. The service processes pseudonymous browser identifiers, device data, pages and interactions; these data are not necessarily anonymous. We do not intentionally send names, email addresses or form content in custom events. Custom page views exclude query parameters and fragments from URLs.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google’s processing is not limited to HighTech’s Italian data centre. For any transfers outside the EEA, the safeguards under Chapter V GDPR and the relevant Google terms apply. Information: Google Privacy Policy and Google Data Processing Terms. Consent is optional and may be withdrawn from the footer; cookies and the duration of preferences are described in the Cookie Policy. In the Analytics property used by this website, event data retention is set to 2 months and user data retention to 14 months, resetting on new user activity. These periods concern data subject to Analytics retention controls and do not determine the duration of most standard aggregated reports. Browser cookie duration is separate and is set to 180 days in the tag configuration.
Google Search Console is used to check indexing and page performance in Google Search. The verification tag on the website does not load a visit-tracking system.
6. Providing data and automated responses
Browsing involves sending the technical data needed for communication. Providing data through the form is optional, but a name, email address and message are needed to handle the enquiry. Providing the restaurant name is optional.
GaIA generates answers using artificial intelligence models, which can make mistakes. The demo does not make solely automated decisions producing legal or similarly significant effects under Article 22 GDPR. You can always contact HighTech for a human response.
7. People and providers who may access data
Data are accessible to authorised HighTech staff and, as needed for their respective activities, hosting, email, maintenance, security, connectivity and telephony providers. GaIA’s language functions use OpenAImodels; the parts of the conversation needed to generate an answer are therefore processed through that service.
Parties acting on behalf of the controller must be bound by appropriate instructions and obligations under Article 28 GDPR where applicable. Authorities or parties entitled by law may also receive data. Data are not published on the website or sold for advertising. Information about recipients relevant to your enquiry is available by contacting the controller.
8. Archives in Italy and external processing services
Demo recordings, transcripts and archives managed by HighTech are stored at its own data centre in Italy. The location of these company archives does not mean that all OpenAI processing takes place in Italy.
The location and any retention by OpenAI depend on the service and contractual settings used. Transfers outside the European Economic Area require safeguards under Chapter V GDPR, such as an adequacy decision or standard contractual clauses, as applicable. You may ask HighTech about the applicable configuration and for a copy or indication of the relevant safeguards. The provider’s general terms are available in theOpenAI Data Processing Addendum; this reference does not replace information about the service’s specific configuration.
9. Retention and security
Enquiry data are kept for as long as needed to respond and manage any follow-up. If a contractual relationship begins, the relevant documents follow the retention periods for that relationship and applicable obligations.
Trial recordings and transcripts must be limited to the period needed to conduct and manage the demonstration and related feedback. The criterion is completion of these activities, taking account of deletion requests, withdrawal of consent or documented needs to protect rights.
Technical logs are kept for the period needed for operations and security; longer retention is permitted only where justified by incidents, applicable obligations or the protection of rights. Proportionate technical and organisational measures are adopted, including authorised access and protection of communications. No system can guarantee absolute security.
10. Your rights
In the cases and within the limits provided by the GDPR, you may request access, rectification, erasure, restriction and portability; object to processing based on legitimate interests; and withdraw consent. To exercise these rights, write to info@hightechsas.it, specifying your request and information useful to identify the interaction. Only information needed to verify identity may be requested.
You will normally receive a response within one month; any extension allowed by the GDPR will be communicated to you. You may lodge a complaint with the Italian Data Protection Authority or the competent authority where you live or work, and seek a judicial remedy.
11. Cookies, links and updates
For cookies and other technical storage, see the Cookie Policy. The demo restaurant’s menu and website open on another domain: also read the information provided in the environment you use. Restaurant clients have their own privacy notices.
This notice is updated when services or processing methods change. The date at the top indicates the current version. An updated notice does not replace any new consent that may be required.
Personalised demo requests and authorised website analysis
To handle your request we collect your name, role, restaurant or company name, domain, business email, telephone and notes if provided, your declaration that you are the owner or an authorised representative, and your authorisation for the analysis. HighTech uses these data to respond, confirm the request by email and prepare the agreed trial, as steps requested before entering into a contract (Article 6(1)(b) GDPR). The authorisation for analysis concerns the use of public website content for the demo; it is not consent to marketing.
Submitting the form alone does not start a scan. The team verifies the request before analysis. Website information relevant to the restaurant may be processed through the OpenAI services already described in this notice to prepare the demo’s answers. Do not provide confidential content or customers’ personal data. Request data follow the retention criteria for pre-contractual communications; the demo duration, access and deletion date are communicated before the trial. At the end, data in the demo environment are deleted or, at the requester’s choice and with separate service activation, transferred to the live environment under agreed terms and roles. The rights set out in this notice remain available.