Privacy policy

1. Who we are

Hutay is a service for restaurants: an ordering website, QR table ordering, a till, a kitchen screen and table bookings. It is run by Primus Tech Services Limited, a company registered in England and Wales (company number 14845699), whose registered office is First Floor, 402 Palatine Road, Manchester, M22 4FZ.

For anything about your data, email hello@hutay.com or use our contact form.

2. Our two roles

Whose data it is decides what we may do with it.

We decide (we are the controller)

For restaurants and their staff who use Hutay, for visitors to hutay.com, and for anyone who contacts us.

The restaurant decides (we are its processor)

When you order from a restaurant, book a table or pay at your table, you are dealing with that restaurant. The restaurant is responsible for your data, and we hold and handle it on its behalf, only to run its ordering and only as our data processing terms allow. If you ordered from a restaurant and have a question about your data, please ask the restaurant first. We will help it answer you.

3. What we collect

If you run or work at a restaurant

• Account details: your name, email address, phone number and password. We store the password only as a one-way scrambled value, so nobody can read it back.
• Your restaurant: its name, address, opening hours, menu, prices, photos and website settings.
• Staff: names, the role you give them, and their PINs, which are also stored only as one-way scrambled values.
• Devices you pair, such as a till or kitchen screen.
• Payments setup: the identifier of the Stripe account you connect. Your bank details stay with Stripe.
• Your plan: the package you choose, your trial dates and, once you pay us, your invoices and payment status. Card details go to Stripe and never reach us.
• Emails we send you, such as the email check at sign-up and trial reminders. We keep a log of what was sent and when, but never the one-time links inside.

If you order from or book at a restaurant

• Your name, email address and phone number.
• Delivery addresses, including the map position, and any delivery instructions.
• Your orders: what you ordered, prices, how you paid and the order status.
• Table bookings: name, phone number, optional email, party size, date and time, and any notes.
• An account at that restaurant, if you create one.

Card payments are taken by Stripe for the restaurant. We never see or store card numbers.

If you visit hutay.com or contact us

• What you send in our contact form: name, email, phone number if you give it, and your message.
• Your IP address, briefly, to stop abuse such as repeated sign-ups or password guessing. These records delete themselves within 24 hours.

4. Why we use it

We do not sell personal data, and we do not use it for advertising.

5. Who we share it with

We use these companies to run Hutay. Each one handles data only on our instructions and under a written contract.

We also share data when the law requires it, for example with tax authorities or the police when they have the power to ask.

6. Data sent outside the UK and EU

Some of these companies are based in the United States. When data goes there, it is protected by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or by the company's certification under the EU-US Data Privacy Framework and its UK extension.

7. How long we keep it

• Your restaurant account: for as long as you use Hutay. When you leave, we delete it within 90 days, apart from what we must keep by law.
• Invoices and accounting records: 6 years in the UK and 8 years in Hungary, as tax law requires.
• Order and booking records: for as long as the restaurant uses Hutay, then deleted or handed back within 90 days, as the restaurant chooses.
• Messages to us: up to 2 years.
• Security records with IP addresses: they delete themselves within 24 hours.

8. Your rights

You can ask us to:

• show you the data we hold about you, and give you a copy
• correct it
• delete it
• stop or limit using it
• send it to you, or to another service, in a common format

You can also object to anything we do on the basis of legitimate interests. Email hello@hutay.com. We will answer within one month. If your data came from ordering at a restaurant, we will pass your request to that restaurant and help it reply.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office in the UK (ico.org.uk), the Hungarian National Authority for Data Protection and Freedom of Information (naih.hu), or the authority where you live. We would like the chance to put it right first.

9. Cookies and browser storage

hutay.com uses no cookies, no analytics and no tracking, and its fonts come from hutay.com itself.

The app, and the ordering pages it runs for restaurants, store a small amount in your browser so that they work: whether you are signed in, and what is in your basket. This is strictly necessary for the service you ask for, so it needs no consent. We use no advertising or tracking cookies.

10. Keeping it safe

Connections to Hutay are encrypted. Passwords and PINs are stored only as one-way scrambled values. Payment and email keys are stored encrypted. Each restaurant can only ever see its own data, and we test that on every change we make.

11. Children

Restaurant accounts are for adults running a business. Customers of any age may order from a restaurant, and the restaurant is responsible for any age-restricted items it sells.

12. Changes to this policy

If we change this policy in a way that matters, we will email restaurants and update the date at the top of this page.