PRIVACY POLICY

1. WHO WE ARE

1.1  We are Bishal Bhandari, trading as BhandariTech, of 11 Thynne St, West Bromwich, B70 6PH. Our email address is [email protected]. We are responsible (the "controller") for the personal information described in this policy. Our Data Protection Officer can be reached at [email protected].

1.2  This policy does not cover the personal information of customers who order from a restaurant that uses our platform. For that information the restaurant is the controller and we handle it on the restaurant's behalf. Customers should read the privacy notice on the restaurant's own website. The exception is social sign-in: because we run the sign-in connection with Google, Facebook, Microsoft and Apple centrally for every restaurant on the platform, section 3 below explains what we do with that specific information.

2. WHAT WE COLLECT

2.1  We collect and use:

• (a)  partner details: your name, your business's name and address, email address, phone number, food business and company details, and details of your domain names;
• (b)  account and billing information: what you have agreed with us, invoices, payments and payment history, and identifiers for your Stripe or Mollie account (we do not receive or store card numbers);
• (c)  order totals and dates for orders placed through your website, which we need to work out our fees;
• (d)  our communications with you, including emails and support requests; and
• (e)  technical information when you visit our website, such as your IP address, browser, device, the pages you view and cookie information.

2.2  We collect this information from you directly, from your use of our platform and website, and from the payment providers you connect to us.

3. SOCIAL SIGN-IN (GOOGLE, FACEBOOK, MICROSOFT AND APPLE)

3.1  Every restaurant on our platform can offer customers a "Continue with Google / Facebook / Microsoft / Apple" sign-in button. This connection is run once, centrally, for the whole platform, rather than set up separately by each restaurant, which is why we describe it here rather than leaving it entirely to each restaurant's own notice.

3.2  When a customer uses social sign-in, we receive from the provider:

• (a)  the customer's name and email address;
• (b)  a unique account identifier the provider uses to recognise that customer on future sign-ins; and
• (c)  for Sign in with Apple only, the customer's name may instead be sent as a one-time field the very first time they authorise, and not again afterwards.

3.3  We do not receive the customer's password, and we do not receive or request access to their contacts, photos, posts or any other information from their Google, Facebook, Microsoft or Apple account beyond what is listed in 3.2.

3.4  We use this information only to create or sign the customer into their account on the specific restaurant's storefront they are ordering from, and, where they choose to link more than one sign-in method, to recognise that it is the same customer. We act as a processor of this information on behalf of the restaurant the customer is ordering from, in the same way described in clause 4 for the rest of a restaurant's customer data. We do not use it for our own marketing, and we do not sell it.

3.5  Each provider also processes information about the sign-in under its own privacy policy: see Google's, Meta's, Microsoft's and Apple's privacy policies.

3.6  A customer can disconnect a social sign-in method from their restaurant account at any time from their account settings on the restaurant's storefront, provided they have another way to sign in, and can revoke the connection directly with Google, Facebook, Microsoft or Apple from their own account settings with that provider at any time. See bhandaritech.com/data-deletion for full instructions, including how to request that we delete this information entirely.

4. HOW WE USE IT AND WHY

4.1  We use personal information for these purposes and on these legal bases:

• (a)  to consider, approve and set up partners, provide the platform and your website, and bill you: because we need it to make and carry out our contract with you;
• (b)  to keep accounting and tax records and meet other legal duties: because the law requires it;
• (c)  to give support and respond to your messages: because it is needed for our contract with you, and in our legitimate interest in running our business;
• (d)  to keep our systems secure, prevent fraud and misuse, fix problems and improve the platform: in our legitimate interests;
• (e)  to send you service messages and news about the platform: in our legitimate interest in keeping our partners informed. You can ask us to stop the news at any time; and
• (f)  to use analytics cookies on our website: only if you agree.

4.2  We do not sell personal information, and we do not use it for automated decisions that have legal effects on you.

5. WHO WE SHARE IT WITH

5.1  We share personal information only where needed, with:

• (a)  payment providers, currently Stripe and Mollie, to take our fees and connect your account;
• (b)  Cloudflare, which provides our hosting, security and performance services;
• (c)  email delivery providers (Resend, SendGrid, and a Cloudflare-hosted relay), which send account, order and booking emails;
• (d)  Google Analytics on our website, only if you agree to analytics cookies;
• (e)  Google, Facebook, Microsoft and Apple, when a customer signs in with one of them, as described in section 3;
• (f)  Google Firebase and browser notification services (Google, Apple and Mozilla), which deliver order status notifications to customers who turn them on, and new-order alerts to restaurant staff devices — notifications contain an order number and status, not a customer's name or address;
• (g)  Postcodes.io, which we use to look up postcodes and check delivery distances;
• (h)  our accountant and professional advisers, where they need it to advise us; and
• (i)  the courts, regulators, the police or tax authorities, where the law requires or allows it.

5.2  If we sell or transfer our business, we may share information with the buyer, who must use it under this policy.

6. TRANSFERS OUTSIDE THE UK

6.1  Some of the companies above are based, or store information, outside the UK. Where they are, we only use them if there are safeguards the law requires, such as the UK's data bridge with the United States or the UK's approved standard contract terms.

7. HOW LONG WE KEEP IT

7.1  We keep billing and accounting records for 6 years, as tax and company law expect. We keep other partner account information for up to 12 months after our agreement with you ends. Website analytics data is kept for as long as our analytics settings allow, and we review them regularly. Social sign-in data is kept for as long as the customer's account with the restaurant stays open, and deleted under the process at bhandaritech.com/data-deletion. When we no longer need information we delete it, and backups are removed in the normal backup cycle.

8. KEEPING IT SECURE

8.1  We use suitable technical and organisational measures to protect personal information, including access controls and encrypted connections. No system is completely secure. If a breach puts your rights at risk, we will tell you and the Information Commissioner's Office where the law requires.

9. YOUR RIGHTS

9.1  You have the right to:

• (a)  ask for a copy of the personal information we hold about you;
• (b)  ask us to correct information that is wrong or incomplete;
• (c)  ask us to delete your information, in some cases;
• (d)  ask us to restrict how we use it, in some cases;
• (e)  ask us to give you your information in a portable form, in some cases;
• (f)  object to our use of your information where we rely on our legitimate interests, and to any direct marketing; and
• (g)  withdraw your consent at any time, where we rely on it, without affecting what we did before.

9.2  To use any of these rights, email [email protected]. We will reply within one month. We may ask you to prove who you are. For deleting a customer account created through social sign-in specifically, see bhandaritech.com/data-deletion.

10. COOKIES

10.1  Our website uses cookies that are needed for it to work and stay secure, including those set by Cloudflare. We only use analytics cookies, such as Google Analytics, if you agree to them. You can change your choice at any time using the cookie settings on our website, or by changing your browser settings.

11. OUR MOBILE APPS

11.1  BTD Admin (listed in the app stores as "BhandariTech Direct Admin") is our app for restaurant owners and staff. When you sign in, we process your email address, the restaurant website address you enter and a sign-in session token. The token is kept in your device's secure storage (the Keychain on iPhone, encrypted storage on Android) and is removed when you sign out.

11.2  The app shows and updates your restaurant's orders, bookings, menu and settings. These can include customers' names, phone numbers, email addresses, delivery addresses and order details. We handle that customer information on the restaurant's behalf, as explained in 1.2.

11.3  To alert you to new orders and bookings, the app registers a notification token for your device. Alerts are delivered through Google Firebase Cloud Messaging and, on iPhone, Apple's push notification service (see 5.1(f)). We delete the token when you sign out, and you can turn notifications off at any time in your device settings.

11.4  The app does not use your location, camera, contacts or photos, does not collect biometric data, and contains no advertising, analytics or tracking.

11.5  Our in-restaurant apps, BhandariTech POS (BT POS) and BhandariTech Display (BT Display), only talk to the restaurant's own till and send no data to us. They have their own policy at bhandaritech.com/privacy/apps.

12. CHILDREN

12.1  Our platform is for businesses. It is not meant for anyone under 18, and we do not knowingly collect information from children.

13. CHANGES TO THIS POLICY

13.1  We may update this policy. The date at the top shows when it was last changed. If we make an important change, we will tell our partners by email.

14. COMPLAINTS

14.1  If you are unhappy with how we have used your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.