UMAI

What UMAI is

UMAI is a restaurant reservation, guest management and marketing platform operated by UMAI Restaurant Software from Kuala Lumpur, Malaysia. It gives restaurants a booking widget that is embedded on their website, along with table management, a guest CRM and marketing automation. A diner uses the embedded widget to check real time availability, choose a date, time and party size and confirm a reservation without leaving the restaurant website.

What data and cookies UMAI collects

When a diner makes a reservation, the widget collects personal data such as name, email address, telephone number, party size, special requests and, over time, a history of past reservations, preferences and no shows that builds a guest profile in the UMAI CRM. To operate the booking flow, UMAI stores booking details in first party cookies and browser localStorage. Through connected marketing and analytics integrations such as Google Tag Manager, Google Analytics and the Meta Pixel, the widget can also set non essential cookies that measure widget performance and support remarketing to diners.

GDPR and ePrivacy implications

The diner details and the identifiers UMAI processes are personal data under the GDPR, because they relate to identifiable individuals. Storing and reading identifiers on the diner device also falls within Article 5(3) of the ePrivacy Directive. The strictly necessary booking session is exempt from prior consent, but the marketing and analytics cookies are not, and the CNIL in France, the German authorities under the TDDDG and the AEPD in Spain all enforce a strict prior consent obligation for such non essential trackers.

When consent is required and when contract applies

The booking transaction itself can rest on the performance of a contract or on steps taken at the request of the diner under Article 6(1)(b) GDPR, so the strictly necessary booking session may run without prior consent. The non essential marketing and analytics cookies set through the widget are different: they require prior, freely given, specific, informed and unambiguous consent under Article 6(1)(a) GDPR, and it must be as easy to refuse as to accept. Until the diner accepts, those marketing and analytics cookies should not be set.

Transfers of data outside the European Economic Area

UMAI is operated from Malaysia and hosts its platform in the Asia Pacific region, so diner data is transferred outside the European Economic Area. Malaysia is not covered by a European Commission adequacy decision, so the transfer requires the EU Standard Contractual Clauses 2021/914 within the UMAI data processing agreement and a documented Transfer Impact Assessment, in line with the Schrems II ruling and the guidance of the European Data Protection Board. Where the widget also loads Google and Meta tools, data may additionally reach the United States under the same clauses.

Practical steps for compliant use

Gate the non essential UMAI cookies behind your consent management platform so that Google, Meta and other marketing and analytics tags fire only after the relevant category is accepted, while keeping the booking session available so diners can always reserve. Provide clear information about UMAI in your cookie policy, including the booking and marketing cookies it sets and their lifetime. Sign the UMAI data processing agreement, complete a Transfer Impact Assessment and apply the shortest workable retention on guest records. Collect only the diner data you need to manage the reservation.