Privacy policy

The controller for account and loyalty data is Simpli Innovations j.d.o.o., Croatian tax ID (OIB) 66769162719, Vinogradi 76, 10000 Zagreb, Croatia. Contact for privacy and exercising your rights: info@simpli.bar.

The venue you order from is separately responsible for order data, invoicing and payment. Check its identity and contact details in the selected venue's information and on your receipt. Banks and payment providers are responsible for processing they carry out for their own purposes under their own privacy notices.

If you are unsure whom to contact, email info@simpli.bar with the app and venue name. We will help direct your request to the responsible party.

Data comes from you, your use of the app, your selected sign-in provider, and orders and POS systems at participating venues.

• Account and profile: name, email, phone number, account and membership identifiers, sign-in details, preferences and records of accepted terms. Date of birth, city and other profile information are processed if you provide them.
• Social sign-in: the identifier, name and email Google or Apple sends when you choose that method. Apple may provide a relay email address. We do not receive your Google or Apple password.
• Membership and purchases: membership card, points, rewards, coupons, tiers, achievements, order venue and table, products, notes, amounts, and order and payment status.
• Content you send: ratings, comments and support messages. Do not include unnecessary sensitive information in free-text fields.
• Device and usage: push registration identifiers, app and offer interactions, app version, crash and performance information, and network and security logs. These records may be linked to an account or device identifier.

Performance of a contract and steps you request before entering one are the basis for creating and maintaining an account, managing membership, calculating points, providing rewards and processing orders. Without information necessary for a feature, we cannot provide that feature.

Legal obligations cover, for example, accounting records and consumer complaints. Account security, abuse prevention and service reliability rely on legitimate interests, taking your rights into account.

Marketing preferences, optional card saving and device permissions are separate from accepting the terms of service. You can withdraw consent without affecting the lawfulness of earlier processing.

With device permission, location is used to display the map and find nearby venues while you use that feature. You can decline permission and choose a venue manually. The loyalty app does not require continuous background location tracking.

The camera, a selected photo and NFC are used to read a table identifier. QR images are processed on the device; the decoded venue and table identifier is passed to ordering. This does not give the server access to your entire photo library. Maps use Mapbox services.

You can change permissions in device settings. Turning them off may limit the associated feature, such as scanning or finding a nearby venue.

Monri and participating financial institutions process payment card details. If you choose to save a card, the system uses a payment token, masked number, card brand, expiry date and a record of your choice. The full card number and security code are not stored in your loyalty profile.

Saving a card is not a subscription or permission for arbitrary future charges. You approve each order payment separately. Saved-card availability depends on the merchant's payment configuration.

Manage cards in Saved cards. Removing a card from the app prevents its future selection but does not guarantee immediate deletion of a token held by the payment provider. You can request deletion of associated data and remote tokens at info@simpli.bar; handling involves the merchant or payment provider where needed.

Confidentiality of your information is protected and secured by using latest TLS encryption. Pages for web payment are secured by using Secure Socket Layer (SSL) protocol with 128-bit data encryption. SSL encryption is a data coding procedure for prevention of unauthorized access during data transfer.

This enables a secure data transfer and prevents unauthorized data access during communication between user and Monri WebPay Payment Gateway and vice versa.

Monri WebPay Payment Gateway and financial institutions exchange data by using their virtual private network (VPN) which is also protected from unauthorized access.

Monri Payments is PCI DSS Level 1 certified payment service provider.

Credit card numbers are not stored by Merchant and are not available to unauthorized personnel.

Operational messages concern the service, such as order status. Promotional messages concern offers from your programme. Device permission for push notifications is not, by itself, consent to every marketing purpose.

In Profile → Notifications you can manage available marketing, personalisation and analytics choices. Programme rules may group members by purchases and activity to provide relevant offers. You can request human review of disputed points, tiers or benefits.

Usage analytics records interactions to understand and improve the app. It is enabled by default in the current version. Turning it off stops future sending of these events from the device, including events not yet sent; it does not automatically erase events already sent. You can separately request their deletion. Security diagnostics and data needed to process an order serve separate purposes.

Data needed for the selected feature is available to authorised Simpli staff, the programme operator, the selected venue and its POS system. We use infrastructure and technical providers: Heroku for server services, Vercel for web interfaces, Expo and Apple/Google for push notifications, Google/Apple for selected social sign-in, Mapbox for maps, Monri for payments and Sentry for diagnostics.

The scope depends on enabled features. Providers processing data on our behalf may use it for agreed purposes with appropriate safeguards. Data is provided to competent authorities when required by law. This policy does not replace separate notices from banks or other independent controllers.

Connected service providers may process data outside the European Economic Area. The main server's location alone does not mean all services, support and backups are in the same region.

Transfers subject to the GDPR require an appropriate basis, such as an adequacy decision or standard contractual clauses with any necessary supplementary measures. Contact info@simpli.bar for information about providers, applicable safeguards and how to obtain a copy.

We use profile and sign-in data while the account is active. Profile deletion removes its contact and personal details, external sign-in identities and push registrations, and ends account access. Deletion of separate order records and payment tokens is also handled with the responsible merchant or payment provider.

Points transaction history remains pseudonymised for financial verification, linked to an internal identifier instead of profile details. It currently has no automatic deletion deadline. Ratings and comments remain without the author's name or account link, also without a set automatic deletion deadline; mention any personal information you entered in free text in your deletion request.

Order, payment, complaint and preference records may be retained as needed for legal obligations, an open transaction or a legal claim. Backups and independent providers' records have separate lifecycles. Our response to your request will identify retained records, the reason, and the applicable period or criterion.

• Raw usage events and completed push delivery records: periodic cleanup after 90 days.
• Expired or cancelled points reservations not linked to a transaction: cleanup after 365 days from the last update.
• Technical records of communication with the POS: cleanup after 540 days from creation.

You may request access, rectification, erasure and restriction of processing. Where the legal conditions apply, you have rights to portability and to object to processing based on legitimate interests. You may object to direct marketing at any time and withdraw consent.

Send your request to info@simpli.bar or by post to Simpli's address above. Include the app name and account email. We request only identity verification needed to protect your data. We respond without undue delay, within 30 days while respecting any shorter applicable legal deadline. We will explain any legally permitted extension.

Delete your account in Profile → Manage account → Delete account, or use our public account deletion page. Email requests do not require reinstalling the app. Account deletion does not automatically cancel an open order or replace a refund request.

If you believe your rights have been infringed, you may complain to the Croatian Personal Data Protection Agency (AZOP) or another competent supervisory authority.

• Request account deletion
• Croatian Personal Data Protection Agency

A store content age rating is not, by itself, consent to process a child's data or permission to buy age-restricted products. Special rules apply to children, including parental or guardian consent where required. Contact us if you believe a child's account was opened without necessary authorisation.

We protect data through sign-in controls, restricted access, protected transmission and technical monitoring. No system is entirely risk-free. Keep your password and membership QR code secure and report suspected unauthorised access.

We publish updated versions on this page. We will appropriately notify you of material changes to purposes or processing. Where fresh consent is required, we will request it separately; continued use alone is not consent to a new, unrelated purpose.