This Privacy Policy explains how Chosen Digital Solutions (“we”, “us”, “our”) collects, uses, stores and protects personal information when you use Chosen Menu (the “Service”). It is designed to comply with the Constitution of Kenya and the Data Protection Act, 2019 (and related regulations).
Chosen Menu is a digital menus and hospitality services platform for hotels, restaurants, resorts, cafés, lodges, bars, guest houses, serviced apartments and similar businesses in Kenya and elsewhere. Businesses publish restaurant menus, room rates, bar lists, pool, gym, spa, conference and other hospitality services that guests can view by scanning a permanent QR code. Customers can scan and view public menus without creating an account or downloading an application.
Chosen Menu is operated by Chosen Digital Solutions. For privacy-related enquiries, contact us using the details in section 11.
Businesses that use Chosen Menu (hotels, restaurants and other venues) are independent controllers of the information they choose to display on their menus and of any information they collect directly from their own customers outside our platform. We process business account data as a controller and, where we process customer interaction data on behalf of a business, we do so as a processor under the Data Protection Act, 2019.
When you create a business account we collect:
During onboarding and ongoing use we may also collect:
Business and menu data, including product and logo images, are stored on secure cloud infrastructure operated on our behalf. Access is limited to authorised systems and personnel.
We use this information to:
/m/{your-id}).Published menu content (names, descriptions, prices, images, contact details you choose to show) is intentionally public so customers can view it without logging in.
Customers do not need an account or app to view a public menu. Simply opening the menu URL or scanning the QR code does not require them to provide name, email or phone number.
Depending on features enabled by the business, limited interaction data may be created, for example:
This interaction data is stored with the relevant business account and is accessible to the business owner (and our administrators only as needed for support or abuse prevention). We do not sell customer interaction data. Customers should contact the venue directly for questions about how that venue uses information collected at the table.
Businesses may enable optional features such as call assistance and online ordering. Information generated by those features is processed only to deliver the feature to that business. We do not use it for advertising to customers. Businesses remain responsible for informing their guests about any in-venue data practices that go beyond what the platform itself collects.
We use industry-standard measures including encrypted connections (HTTPS), secure sign-in, access-controlled data storage, and server-side verification of payments. Access to production systems is restricted to authorised personnel. No method of transmission or storage is 100% secure; we work to reduce risk continuously.
Account and business data are retained while the account is active and for a reasonable period afterwards as needed for billing, dispute resolution, legal obligations and security. Consent records are retained for compliance with the Data Protection Act, 2019. You may request deletion as described below.
You may request deletion of your personal account information and associated business data. We will action valid requests subject to legal retention requirements (e.g. payment records). Published menu content is removed from public access when the account is closed or the menu is unpublished/suspended according to our processes.
Under the Data Protection Act, 2019, you have rights including to:
To exercise these rights, contact us using the details in section 11. We may need to verify your identity before responding. We aim to respond within the timeframes required by law.
The Service is delivered using reputable cloud infrastructure and payment providers (including Paystack for payments). Data may be processed in data centres outside Kenya. Where required, we rely on appropriate safeguards and the contractual and technical measures offered by these providers. By using the Service you acknowledge this processing is necessary to deliver Chosen Menu.
The Service is directed at businesses and adult operators. We do not knowingly collect personal data from children under 18 for account registration. If you believe a child has provided personal data, contact us so we can delete it.
For questions, access requests, correction or deletion requests, or complaints about privacy:
You may also contact the Office of the Data Protection Commissioner (Kenya) if you are not satisfied with our response.
We may update this Privacy Policy from time to time. The version number and effective date appear at the top. Material changes will be communicated through the Service or by email where appropriate. Continued use after an update constitutes acceptance of the revised policy where permitted by law. Where we rely on consent, we will seek fresh consent when required.
Last updated: May 2026 · Version 1.1