Privacy Policy

Duxa is the data controller responsible for the personal data processed through this website and the Duxa platform. Duxa is being established in Luxembourg, with field operations supported through a partner in Montenegro.

For any question about this policy or your personal data, you can reach us using the contact details in the final section.

We collect only the data needed to provide the service. Depending on how you use Duxa, this may include the following categories.

• Account data: name, email address and password used to create and manage your account.
• Contact data: information you provide through forms, such as a demo request or a support message.
• Usage data: pages visited, features used and approximate session duration, used to improve the service.
• Device data: browser type, operating system and IP address, collected for security and compatibility.
• Order data: information processed on behalf of a restaurant for orders placed through Duxa, such as items, amounts and timestamps.

We process your personal data for the following purposes.

• To provide, operate and maintain the Duxa platform and its features.
• To respond to your requests and provide customer support.
• To manage subscriptions, invoicing and payments.
• To protect the service against fraud, abuse and security incidents.
• To meet our legal and regulatory obligations.

Under the GDPR, we rely on the following legal bases.

• Performance of a contract, when processing is needed to provide the service you requested.
• Consent, for non-essential cookies and optional communications, which you can withdraw at any time.
• Legitimate interest, for keeping the service secure and improving it.
• Legal obligation, when processing is required by applicable law.

We do not sell your personal data. We share it only with parties that help us run the service, and only to the extent necessary.

• Service providers (data processors) that host infrastructure, send email or provide analytics under a data processing agreement.
• Payment providers that process subscription and order payments securely.
• Authorities, when disclosure is required by law or to protect our legal rights.

Every processor is bound by a contract that requires them to protect your data and process it only on our instructions.

We keep personal data only as long as needed for the purposes described in this policy, or as required by law. When data is no longer needed, we delete it or anonymise it.

Where data is transferred outside the European Economic Area, we apply appropriate safeguards, such as standard contractual clauses approved by the European Commission.

Under the GDPR you have the following rights over your personal data.

• The right to access the personal data we hold about you.
• The right to have inaccurate data corrected.
• The right to have your data erased, where applicable.
• The right to restrict processing of your data.
• The right to receive your data in a portable format.
• The right to object to certain processing.
• The right to lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us using the details below. We respond within the period set by law.

We apply technical and organisational measures to protect your data, including encryption in transit, access controls and strict separation of each restaurant's data.

We use cookies and similar technologies as described in our Cookie Policy. You can manage your preferences at any time.

Duxa is a service for businesses and is not directed at children. We do not knowingly collect personal data from children.

We may update this policy from time to time. We will publish the new version on this page and update the date at the top.

For privacy questions or to exercise your rights, email us at privacy@duxa.pro.