Privacy Policy
Draft for review · Not in effect
This proposed Privacy Policy explains how Air POS would describe personal information handled in connection with its website, business accounts and services. A restaurant’s own privacy notice applies to the purposes it determines for guest and employee data. The processing inventory and the review points below must be confirmed before this notice is published.
Information and responsibilities
1.1Who is responsible
Air POS may act as a controller for its own business relationships and as a processor for information handled on a restaurant’s instructions. The role depends on the activity, not simply on who hosts the software. The final notice must identify the relevant Air POS entity and distinguish its activities from those of restaurants, resellers and payment providers.
1.2Information covered
The processing inventory should cover business contact and account details; enquiries and support correspondence; subscription and transaction records; technical and security logs; and, where enabled, restaurant guest, reservation, order, loyalty and employee information. It should also cover prompts, attachments and outputs submitted to Gordon. Only categories actually processed should appear in the published policy.
1.3Where information comes from
Information may be provided by you, your business administrator, a restaurant or reseller, or through an integration you authorise. Technical information may be generated when you use the website or service. The final notice must identify indirect sources and the specific categories obtained from them.
How information is used
2.1Purposes and lawful bases
Proposed purposes include providing requested services, administering business accounts, answering enquiries, maintaining security and meeting legal obligations. Performance of a contract applies only where the individual is a party to that contract and the processing is necessary. Business contact and security activities may instead require a documented legitimate-interest assessment. Consent must be obtained where required, including for applicable optional tracking or marketing. The published notice must map each actual purpose to its lawful basis and identify any legitimate interests.
2.2Restaurant guest and employee data
Restaurants generally determine why their guests’ and employees’ information is collected. Where Air POS acts only on their instructions, requests about that information should be directed to the restaurant. Allergy or accessibility notes may reveal sensitive information; the responsible controller must establish an appropriate basis for handling it and avoid collecting unnecessary details.
2.3Cookies and similar technologies
The website’s actual cookies and similar technologies must be documented, including their providers, purposes and durations. Where consent is required, optional technologies should operate only after consent, with a way to withdraw it. The published policy must link to the available cookie controls; this draft does not claim those controls are already implemented.
Sharing and retention
3.1Who receives information
Recipients may include authorised users, the relevant reseller and providers involved in hosting, communications, payments or optional integrations. The final policy must explain the actual recipients, their purposes and roles, and any disclosures required by law or made in connection with a business transfer. This draft does not assert that any particular provider is contracted or that information is sold or not sold.
3.2International processing
The published policy must identify where information is processed and explain applicable safeguards for transfers outside the EEA or UK. A supplier’s location alone does not establish a valid transfer mechanism. Any reliance on adequacy decisions or contractual safeguards must match the actual arrangements, with information about obtaining the relevant safeguards.
3.3How long information is kept
Retention should reflect the purpose of processing, contractual requirements and applicable legal obligations. The final notice must set out specific periods or meaningful criteria for account records, financial records, support messages, logs, restaurant data and backups, including what happens after an account closes.
Your rights and contact
4.1Your choices and rights
Depending on the applicable law and circumstances, you may request access, correction, deletion, restriction or portability of your information, or object to processing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may complain to the relevant supervisory authority. Requests may require proportionate identity verification. Some rights are subject to conditions and exceptions.
4.2Contact and updates
Use the Air POS contact page to ask where to direct a privacy enquiry. Before publication, replace this interim direction with the confirmed privacy contact and any required representative or DPO details. The final policy should carry its effective date and explain how significant changes will be notified.
Draft review notes
- Confirm the controller’s registered identity, address, privacy contact, and any required EU/UK representative or data protection officer.
- Verify every data category, purpose and lawful basis against actual processing, including cookies, analytics, marketing, AI providers and payment flows.
- Add the actual recipient/subprocessor list, processing countries, transfer safeguards and how to obtain copies of safeguards.
- Approve retention periods by category and confirm whether there is advertising, sale/sharing, profiling or automated decision-making, including regional privacy-law obligations.