Quvo Terms of Service and Privacy Notice

Version 1.0 — effective 1 September 2026

Operator and controller for platform accounts: DOMIBIO B.V., KVK/CCI 42137963, Haarlemmerweg 331 A, 1051 LH Amsterdam, Netherlands ("Quvo", "we"). Support and privacy: domibio@domi.hk, +31 684452360. We have not appointed a Data Protection Officer (DPO). Privacy matters are handled through domibio@domi.hk; we periodically reassess whether appointment becomes legally required under GDPR or Thai PDPA and will publish DPO contact details if appointed.

Part A — Terms of Service

1. Scope and parties

Quvo provides restaurant software for menus, QR ordering, tables, kitchen tickets, checkout, payments records, shifts, reports, devices and printing. A restaurant or business subscribing to Quvo is a Merchant. Its owners, staff and contractors are Merchant Users. A diner using a restaurant QR menu is a Guest. The restaurant—not Quvo—sells and prepares food, sets prices/taxes/allergen information, accepts or rejects orders, receives payment and handles refunds and complaints.

By creating or using a Merchant account, the Merchant accepts these Terms and the order form. A person accepting for an organisation warrants authority to bind it. Guests use the ordering interface subject to the restaurant's terms and mandatory consumer law; placing an order creates a transaction with the restaurant, not Quvo.

2. Accounts and security

Users must provide accurate information, keep credentials confidential, use least-privilege staff roles, promptly remove former staff and notify us of suspected compromise. The Merchant is responsible for activity under its accounts except to the extent caused by Quvo's breach. Quvo may require password changes, suspend compromised credentials and retain security evidence.

3. Merchant obligations

The Merchant must: comply with food, tax, employment, consumer, accessibility, privacy and marketing laws; publish accurate menu, price, VAT/service-charge, availability and allergen information; obtain lawful instructions/consents for personal data; answer Guest rights requests; configure lawful retention; provide receipts/refunds; secure its network, terminals and printers; and use supported payment methods. The Merchant is controller of Guest and staff business data; Quvo processes such data only to provide, secure and support the service, except where Quvo is independently controller as stated in the Privacy Notice.

4. Orders and payments

Orders may be subject to restaurant confirmation and availability. The displayed total may include restaurant-configured discounts, service charge, VAT and rounding. Quvo records payment status but is not a bank, payment institution, food seller or escrow agent. Cash, card, bank transfer and PromptPay are provided and completed by the Merchant or its provider and are manually confirmed by the Merchant in the current service. Quvo does not initiate, route, hold or settle funds. The Merchant must verify receipt before settlement. Chargebacks, refunds, tax invoices and food disputes are between Merchant and Guest, subject to mandatory law. Quvo does not store full card numbers unless a separately named compliant provider and notice are introduced.

5. Subscription, fees and termination

Plans, limits, price, billing cycle, taxes, renewal and cancellation are stated in the order form or plan page presented before purchase. No unstated fee applies. The Merchant may cancel as stated there; mandatory withdrawal and consumer rights remain unaffected. Quvo may suspend for material breach, security risk, unlawful use or overdue undisputed fees after reasonable notice where practicable. On termination, access ends; export and deletion follow the Privacy Notice, Merchant instructions and legal retention duties. For a Merchant established in the EU/EEA, we additionally give at least 30 days' notice of a Terms change that is materially detrimental to it, and a statement of reasons before — or, where advance notice is not possible for legal, security or fraud-prevention reasons, promptly after — any suspension, restriction or termination, consistent with the EU Platform-to-Business Regulation (EU) 2019/1150.

6. Acceptable use

Users must not access another tenant, bypass permissions or quotas, probe security without written authorisation, upload malware or unlawful content, misuse personal data, interfere with service, reverse engineer except where law permits, resell without agreement, or use Quvo for discrimination, deception or unlawful surveillance. We may investigate and proportionately restrict abuse.

7. Availability, changes and support

We use reasonable skill and care but do not promise uninterrupted service. Internet, Contabo, payment networks, printers and Merchant equipment may fail. Merchants must keep reasonable offline continuity procedures. Material adverse changes will receive reasonable notice unless urgent security/legal action is required. Support channels and any service level are those in the order form. EU/EEA-established Merchants have free access to an internal system for complaints about our compliance with these Terms, our non-performance, or the effects of Terms changes, as required by the EU Platform-to-Business Regulation; as a small enterprise we are not required to name an out-of-court mediator under it, but other legal remedies remain available.

8. Intellectual property and data

Quvo and its licensors own the software, design and documentation. The Merchant retains rights in its menu, branding and business data and grants Quvo a limited licence to host and process them solely to operate and improve the contracted service, secure it and comply with law. We do not sell personal data or use Merchant/Guest content for third-party advertising.

9. Confidentiality and data protection

Each party protects the other's non-public information and uses it only for this relationship. For Merchant-controlled personal data, a Data Processing Addendum — available on request and incorporated by reference from account creation — sets Article 28 GDPR / Thai-PDPA-compliant processing terms: documented instructions, confidentiality, appropriate security, subprocessor controls, assistance with rights/incidents/DPIAs, deletion or return, and audit information. Where Merchant or Guest personal data originating in the EEA is accessed by our personnel or subprocessors outside the EEA (including Thailand), that access is safeguarded by the 2021 EU Standard Contractual Clauses together with a transfer-risk assessment and any needed supplementary measures. The public subprocessor list is https://order.quvo.cc/legal/subprocessors.

10. Warranties and liability

Nothing excludes liability that cannot lawfully be excluded, including fraud, wilful misconduct, death/personal injury caused by negligence, or mandatory consumer/data-protection rights. To the maximum lawful extent, neither party is liable for indirect or consequential loss. Quvo is not liable for food safety, allergens, restaurant performance, Merchant-entered content, or payment receipt. For business Merchants, Quvo's aggregate contractual liability in 12 months is limited to fees paid/payable for the affected service in those 12 months, except where mandatory law requires more. Consumer users retain all non-waivable remedies.

11. Governing law and disputes

Contact domibio@domi.hk first. These Terms are governed by the laws of the Netherlands and directly applicable European Union law. Business disputes are submitted exclusively to the competent chamber of the District Court of Amsterdam, Netherlands. This does not deprive consumers of mandatory protections or courts available under applicable EU/EEA or Thai law. Parties may agree mediation. Regulatory and data-subject complaint rights remain unaffected.

12. General

We may assign to an affiliate or successor with continued protection; the Merchant may assign only with consent not unreasonably withheld. Invalid terms are severed; delay is not waiver. The order form, processing terms, these Terms and Privacy Notice form the agreement, with the order form prevailing for commercial specifics. Changes are posted with a new version/effective date; material changes receive notice and, where law requires, renewed acceptance.

Part B — Privacy Notice

1. Who controls the data

Quvo is controller for Merchant onboarding, account administration, subscriptions, security, support, legal compliance and its own service communications. Each Merchant is controller for Guest orders, table sessions, restaurant payment records, staff operations and restaurant-configured content; Quvo is its processor. Rights requests about a specific restaurant transaction should normally go to that restaurant, though Quvo will route and assist. Contact domibio@domi.hk.

2. Data processed

We may process: account name/username, recovery email, roles, stores and authentication/session data; restaurant contact, tax, address, PromptPay identifier and branding; menu/order/table/session identifiers, line items, modifiers, notes, service calls, void reasons, timestamps and guest count; payment method, amount, status and reference (not full card data under the current design); shift, cashier, device, printer and audit/security events; subscription, quota and billing records; support messages; IP address, browser/device information, necessary cookies and local storage; and information supplied in a rights request.

Do not enter sensitive data, health data or allergy details into free-text fields unless the restaurant has a lawful, necessary process. Quvo is not designed for children's accounts or behavioural advertising.

3. Purposes and legal bases

We process data to perform contracts and requested orders; provide authentication, ordering, checkout, printing, reports and support; pursue legitimate interests in security, fraud prevention, reliability and product administration where interests are not overridden; comply with tax, accounting, court and regulatory duties; protect vital interests in exceptional safety incidents; and use consent only for genuinely optional processing. Under Thai PDPA we rely on the corresponding contractual, legal-obligation, legitimate-interest, vital-interest or consent grounds. Consent may be withdrawn prospectively without affecting prior lawful processing.

4. Sharing and processors

Data is shared only as needed with the relevant Merchant and authorised users; Contabo as hosting/infrastructure processor; transactional-email, payment, backup, security and support providers listed at https://order.quvo.cc/legal/subprocessors; professional advisers, auditors and authorities where legally required; and a successor in a properly safeguarded transaction. We do not sell personal data. Merchants decide which authorised staff and print devices receive restaurant data.

5. Hosting and international transfers

Primary hosting is with Contabo in Germany (EEA). Our support and operations personnel access the platform from Thailand and from processor locations shown in the subprocessor list. For personal data originating in the EEA, access from outside the EEA is a restricted transfer under GDPR and is safeguarded by the 2021 EU Standard Contractual Clauses, a transfer-risk assessment and supplementary safeguards; for personal data originating in Thailand, cross-border transfers must satisfy PDPA requirements. A copy or summary of safeguards is available from domibio@domi.hk, subject to necessary redactions.

6. Retention

We retain data only for the shortest period needed for the stated purpose, Merchant instructions and law. The binding schedule is https://order.quvo.cc/legal/retention. Orders, invoices, archived bills, payment status, refunds and supporting tax/accounting evidence are retained for seven years from the relevant transaction, or longer where mandatory Thai or other applicable law requires. After Merchant termination, ordinary account data, store configuration, menus and non-statutory business data remain available for recovery/export for 30 days and are then deleted from active systems or irreversibly anonymised. Mandatory archives and legal holds are excluded and are restricted to compliance, audit, claims and security purposes, not marketing or routine profiling. Authentication, permission-change, sensitive-operation, IP/device and other security/audit logs are retained for 12 months, and longer only for an active security investigation, dispute or documented legal hold. Support tickets, support emails, complaints and incident-resolution records are retained for three years after closure; unnecessary passwords, identity documents and sensitive data are deleted or redacted immediately. Password-reset tokens expire after 30 minutes, are deleted immediately after use, are superseded when a new token is issued, and expired records are removed from storage within 24 hours. Daily backups are retained on a rolling 30-day basis. Data deleted from active systems may remain in a backup for up to 30 days and is not restored to routine use; any restoration must replay the applicable deletion list.

7. Security and incidents

Measures include tenant/role isolation, credential hashing and session controls, TLS, access logging, least privilege, backups, integrity checks, secure development and incident handling. The current Contabo server volume, live application data file and server-local backup files are not encrypted at rest; access is restricted by operating-system permissions, but those permissions are not encryption. No system is risk-free. We notify controllers, affected people and authorities where required, including applicable 72-hour GDPR/Thai-PDPA assessments.

8. Rights

Subject to law and verification, individuals may request information/access, a copy or portability, correction, deletion, restriction, objection, withdrawal of consent, and review of any solely automated significant decision. Quvo currently makes no solely automated legal/significant decisions. Requests: domibio@domi.hk. We normally respond within one month for GDPR requests and within applicable Thai deadlines; extensions and refusals will be explained. Restaurant-data requests may be referred to the relevant Merchant. Complaints may be made to Thailand's Personal Data Protection Committee/Office or the competent EU/EEA supervisory authority and courts.

9. Cookies and local storage

The current service uses necessary authentication/session cookies and local storage for language, selected store/device role, cart/session continuity and security-related operation. These are required for requested functionality. We currently state that no third-party advertising or cross-site behavioural tracker is used. If optional analytics/marketing technology is added, this Notice and a compliant prior-consent mechanism must be updated before activation where required.

10. Children, changes and contact

The business service is for authorised adults; a Guest may order only as permitted by the restaurant and applicable law. We do not knowingly create child profiles for advertising. Material notice changes will be dated and communicated where required. Privacy contact: domibio@domi.hk; postal contact: DOMIBIO B.V., Haarlemmerweg 331 A, 1051 LH Amsterdam, Netherlands. No DPO is currently appointed. No GDPR Article 27 representative is required because DOMIBIO B.V. is established in the EU.

Terms: https://order.quvo.cc/legal/terms · Privacy: https://order.quvo.cc/legal/privacy