This is an English translation provided for convenience. In case of any discrepancy, the French version of this page prevails.

Last updated: May 2026

1. Legal notice

The website https://www.menu.lu and the MENU.LU mobile apps are published by:

WeServices S.à r.l.
Registered office: 5, Rue Aldringen, L-1118 Luxembourg (Grand Duchy of Luxembourg)
Luxembourg Trade and Companies Register (RCS) No. B258641
EU VAT No.: LU33554515
Email: info@menu.lu

Publication director: the legal representative of WeServices S.à r.l.

Hosting: the website and apps are hosted by WeServices S.à r.l., 5, Rue Aldringen, L-1118 Luxembourg. Data is stored on servers located within the European Union.

2. Purpose of the service

MENU.LU provides, free of charge, a directory, search, review and online table-booking service for restaurants in Luxembourg, available on the website and the mobile apps. Use of the service implies acceptance of this legal notice and of this privacy policy. Prices shown by restaurants are given for information only, are not contractual and may change without notice.

3. Privacy policy and data protection (GDPR)

WeServices S.à r.l. attaches great importance to protecting your privacy. This document explains which personal data is collected, for what purposes, on what legal bases, with whom it is shared, how long it is kept and what your rights are, in accordance with Regulation (EU) 2016/679 ("GDPR") and the Luxembourg law of 1^st August 2018 on the protection of natural persons with regard to the processing of personal data.

3.1. Data controller

The data controller is WeServices S.à r.l. (contact details above). For any question about your data or to exercise your rights: info@menu.lu.

3.2. Data collected and purposes

We only collect the data needed for the purposes described below. No sensitive data is requested.

• Table booking – name, email address, phone number (only if you ask for a text-message confirmation), number of guests, date and time, any comments, restaurant concerned. Purpose: to process your booking request and pass it on to the restaurant. Legal basis: performance of pre-contractual measures/of the service (Art. 6(1)(b) GDPR); the phone number and text-message notification are based on your consent (Art. 6(1)(a)).
• Reviews and ratings – name (published with the review), email address (not published), rating, comment, date, restaurant concerned. Purpose: to publish moderated reviews of restaurants. Legal basis: consent (Art. 6(1)(a)) and legitimate interest in informing users (Art. 6(1)(f)). Reviews are moderated before publication.
• Restaurant recommendation – name, email, name and town of the restaurant, website if any, message. Purpose: to process your listing suggestion. Legal basis: legitimate interest / consent.
• Contact form – title, last name, first name, company if any, email, message and up to three attachments. Purpose: to answer your request. Legal basis: consent / pre-contractual measures.
• Listing request / restaurant account – first name, last name, email, phone, restaurant name, address and contact details, category, region, description and opening hours. Purpose: to create and manage the restaurant page and access to the restaurant area. Legal basis: pre-contractual measures / performance of the contract (Art. 6(1)(b)).
• Newsletter – email address, first name, last name, language, interest groups. Purpose: sending information and news. Legal basis: consent (double opt-in sign-up); you can unsubscribe at any time with the link included in every mailing.
• Restaurant and administrator accounts – username, email, password (stored in hashed form), name, date of last login; for administration access: IP address and browser used to log in (security logs). Purpose: authentication, account management and security. Legal basis: performance of the contract and legitimate interest in the security of the service.
• Geolocation – if you allow it in your browser (or if you enter an address), your approximate location is used to calculate the distance to restaurants and sort the results. It is kept only in your session (server side) for the duration of your visit. Legal basis: consent.
• Browsing data and technical logs – session cookie, server logs (IP address, date/time, pages viewed, browser type) generated automatically. Purpose: operation, security, prevention of abuse and anonymous technical statistics. Legal basis: legitimate interest in the proper functioning and security of the service.

3.3. Recipients and processors

Your data is never sold. It may be disclosed:

• to the restaurant concerned when a booking or request requires it, so that it can be honoured;
• to our technical providers acting as processors: email delivery provider (Google Workspace / Gmail SMTP service), text-message provider(s) for booking confirmations (Clickatell and/or Twilio), anti-spam service Google reCAPTCHA v3 (form protection), hosting provider;
• to the competent authorities when required by law.

When you click on an external booking or ordering link offered by a restaurant (for example Quandoo, Editus or a delivery service), you leave MENU.LU and are redirected to a third-party website subject to its own privacy policy.

3.4. Transfers outside the European Union

Data is processed within the European Union. However, some providers or technical resources may involve a transfer (in particular of the IP address) to third countries: Google email service and fonts (Google Fonts), the Google reCAPTCHA anti-spam service, an icon library served through a content delivery network, and the text-message provider Twilio. These transfers are covered by appropriate safeguards (European Commission standard contractual clauses and/or the EU–US Data Privacy Framework). Maps are now displayed from our own server (local mapping technology): no request is sent to Google Maps any more, and no Facebook or Instagram module or third-party audience measurement tool is active on the site.

3.5. Retention periods

• Bookings: for the time needed to process them, then limited archiving (24 months maximum) for evidence and statistical purposes, unless the law requires otherwise.
• Published reviews: kept for as long as they are online; you can ask for their deletion at any time.
• Contact requests and recommendations: up to 24 months after the last exchange.
• Newsletter: until you withdraw your consent (unsubscribe).
• Restaurant/administrator accounts: for the whole duration of the relationship, then deleted or anonymised within a reasonable time.
• Technical and security logs: in principle 12 months maximum.

3.6. Cookies and trackers

A cookie is a small file stored on your device. MENU.LU uses no advertising, profiling or third-party tracking cookies. Only cookies strictly necessary for the service are used; in accordance with the regulations, they do not require prior consent:

The site also loads fonts and an icon library from third-party servers: these resources do not set cookies but may pass your IP address on to the provider concerned (see "Transfers outside the EU"). Google reCAPTCHA v3 is used only to secure forms (fighting spam and automated submissions), on the basis of our legitimate interest in protecting the service; it is subject to Google's privacy policy and terms of service. You can set your browser to block or delete cookies at any time; blocking strictly necessary cookies may prevent some features from working (booking, restaurant area).

3.7. Security

We apply appropriate technical and organisational measures: encrypted connection (HTTPS), passwords stored in hashed form, restricted and logged administration access, and minimisation of the data collected.

3.8. Your rights

Under the GDPR, you have the following rights over your data: the right of access, rectification, erasure ("right to be forgotten"), restriction of processing, objection, portability, as well as the right to withdraw your consent at any time (without retroactive effect) and to set instructions for your data after your death.

To exercise these rights, write to info@menu.lu specifying your request; proof of identity may be requested. We normally reply within one month.

If you believe that the processing of your data does not comply with the rules, you can lodge a complaint with the Luxembourg supervisory authority:

Commission nationale pour la protection des données (CNPD)
15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg
Tel.: (+352) 26 10 60 -1 – Website: www.cnpd.lu

3.9. Minors

The service is not intended for people under 16 without the consent of the holder of parental responsibility. We do not knowingly collect data about minors without such consent.

3.10. Changes to this policy

This policy may be amended to reflect legal, technical or service changes. The applicable version is the one published on this page; the date of the last update is shown at the top of the document.

4. Intellectual property

All elements of the MENU.LU website and apps (trademarks, logos, texts, databases, layout) are protected by intellectual property law. Any unauthorised reproduction or reuse is prohibited.

5. Liability

MENU.LU strives to ensure the accuracy of the information published but cannot guarantee that the information provided by restaurants (menus, prices, opening hours, availability) is complete or up to date. MENU.LU acts as a technical intermediary putting users in contact with restaurants and cannot be held liable for the service provided by the restaurant.

6. Applicable law and jurisdiction

This legal notice is governed by Luxembourg law. Any dispute relating to its interpretation or performance falls under the jurisdiction of the courts of the Grand Duchy of Luxembourg, subject to the mandatory provisions applicable to consumers.

7. Contact

For any question about this legal notice or the protection of your data: info@menu.lu.