Privacy Policy

1.Our roles

CROWN EPOS is controller for its client contacts, account administration, billing, support and complaints. Restaurants are controllers for their customer order and reservation information; we process that information on their behalf to operate and support the cloud service, under Schedule A of our Terms.

Customer information is entered into and stored in the restaurant’s cloud POS system. Authorised CROWN EPOS personnel can access it for service operation and support. We do not sell it or use restaurant customer details for our own marketing.

2.Information processed

• Client and authorised-user information: business/contact details, account credentials, selected services, billing and subscription records, support correspondence, consent/acceptance records and relevant device or technical information needed to provide the service.
• Online orders: customer name, phone, email, delivery address where needed, order details and transaction references, status and fee information.
• Reservations: first name, surname, phone, email, party size, booking date and time, optional requests and allergy notes.
• Communication preferences: review-email consent records and unsubscribe/suppression status.

Optional allergy information can reveal health data. The reservation form obtains explicit consent separately from review-email consent; the restaurant uses it to accommodate the request and must apply appropriate safeguards and retention.

Identity documents and bank details for payment onboarding should be submitted directly to Ryft wherever possible. Any temporary copies received by CROWN EPOS are securely deleted after onboarding unless a specific legal or contractual requirement requires retention.

3.Purposes and lawful bases

We process client information to provide agreed services, administer accounts and payments, deliver support, investigate complaints, protect the platform and meet legal obligations. Our bases are contractual necessity where the individual is a contracting party; legitimate interests in administering business-client relationships, service security and support where appropriate; and legal obligations for required accounting or regulatory records. Consent is used where required.

For restaurant customer information, the restaurant determines and documents the applicable lawful basis. We follow its lawful instructions to manage orders, reservations, service communications and consented review requests. Reservation details are used to manage bookings and accommodate requests; review emails are a separate optional purpose requiring the recorded opt-in. The restaurant obtains an appropriate Article 9 condition, such as explicit consent, for allergy health information.

4.Payments and connected services

Ryft currently processes card payments through CROWN EPOS’s main merchant account with restaurants as sub-merchants and pays restaurants directly. CROWN EPOS does not receive or store full card numbers or CVV; the integration receives transaction information, references, status and fee data. Ryft also handles its own identity checks, fraud controls and regulatory obligations. A future provider such as Stripe is not treated as currently active merely because the service may support it later.

• SendGrid: sends order confirmations, reservation messages and restaurant-selected review requests. Open Tracking and Click Tracking are disabled. Delivery processing may still produce operational delivery/error records; this is different from monitoring opens or clicks.
• Twilio (optional SMS): where the client enables SMS, processes recipient phone numbers, message content and delivery information to send order and reservation updates and support order verification and fraud prevention. This SMS feature is not used for review requests or promotional messages.
• Ideal Postcodes and Google address APIs: receive information needed for address lookup and autocomplete in checkout and the cloud POS.
• Hosting providers: store the cloud database and may have necessary infrastructure access. The actual provider varies by deployment; examples may include Hostinger, Unlimited Web Hosting or 123 Reg, not necessarily all of them for a particular restaurant.
• Google, Cloudflare and jsDelivr: supply fonts, icons or page resources on public ordering/reservation pages. Resource requests disclose technical information such as IP address to those providers.

We disclose the actual processors used for the client’s deployment and require appropriate contractual safeguards. Public-resource and payment providers may also process information for their own purposes as described in their notices. We may disclose information where legally required to regulators or law enforcement. We do not share customer details for unrelated advertising.

5.Service messages, email preferences and review requests

Order confirmations and reservation communications are sent by email. Where the client enables SMS, Twilio may also send order and reservation updates and messages for order verification and fraud prevention. Where CROWN EPOS enables the review-request feature, the restaurant chooses whether to use it. Review requests require a separate optional, unticked consent choice in the relevant ordering, checkout or reservation form; the system records when consent is given.

Customers can unsubscribe by replying to the review-request email. Replies go to the restaurant, which must monitor them and mark the customer unsubscribed before sending further review requests. Opting out does not stop essential order or reservation messages. CROWN EPOS does not use those details to market its own services.

6.Device storage and public-page tracking

Public ordering and reservation pages do not use advertising, analytics or cross-site tracking for CROWN EPOS. They use device storage for functions such as a basket, selected light/dark mode and the last order number used for tracking. Storage needed for the service or a preference expressly requested by the visitor is distinguished from optional convenience storage.

Remembering name, phone and email on the device requires an optional checkbox that starts unticked. Where available, “Not you? Clear” removes that saved copy and clears the choice. Browser settings can also clear site storage, emptying the basket and forgetting preferences without preventing a fresh order.

External page-resource providers receive IP addresses when their files load. Ryft’s payment pages may use necessary security and fraud-prevention cookies. Device storage and payment-page technologies are described in the relevant page notices. Clearing a device does not delete server-side order or reservation records; those follow the retention and rights processes below.

7.Hosting locations and international transfers

Storage and support-access locations depend on the actual hosting and connected providers used for a deployment. We do not claim all information remains in the UK. Locations must be checked before a provider is used.

Where a restricted international transfer occurs, we must use an appropriate UK mechanism, such as applicable adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses, together with any required assessment and additional safeguards. Clients can request details of their deployment’s providers, locations and safeguards at [email protected]. Routine additions or replacements of data-processing providers require 14 calendar days’ advance notice and an opportunity to raise a data-protection objection.

8.Retention, export and deletion

Each restaurant agrees a documented retention schedule distinguishing customer contact/reservation details from necessary financial records. Information is not retained indefinitely merely because the account remains active. Older customer details can be deleted or anonymised while preserving transaction totals. The restaurant must justify any continued identifiable retention.

CROWN EPOS’s own required company accounting records are generally retained for six years from the relevant financial year-end, or longer where law requires. This does not justify retaining every customer detail for that period. Other client and support records are retained only while needed for their documented purpose and any necessary legal obligations or claims, with periodic review.

Once cancellation is confirmed, the client is immediately offered a free export and must instruct us in writing to export or delete its customer data. Exports are supplied within seven calendar days. Without a response, we send a reminder and delete the data 30 days after service ends. If an export is requested near the deadline, deletion is postponed until delivery and seven calendar days for retrieval. Legally required exceptions are limited to the necessary records and purpose.

There is currently no CROWN EPOS backup or recovery service; deleted data cannot be restored by us. Deleting device storage is separate from server deletion.

9.Security and personal-data breaches

We use HTTPS to encrypt connections, individual employee logins, confidentiality obligations and regular internal security checks by authorised personnel. Access to restaurant customer data is for service operation and support; hosting providers may need infrastructure access under appropriate safeguards.

Customer data is not currently encrypted at rest, and individual support-access activity logging is not currently in place. We do not describe these controls as implemented. We must assess and maintain appropriate security measures for the nature and risk of the processing; no security description removes that obligation.

Where we become aware of a personal-data breach affecting a restaurant, we notify it without undue delay, share available details and provide updates. We assist it with its own assessment and any required notifications.

10.Your rights and contact

Depending on the circumstances, individuals may request access, correction, erasure, restriction or portability of their personal data, object to processing, or withdraw consent without affecting earlier lawful processing. Erasure is not unconditional where necessary legal retention applies.

For restaurant order or reservation data, contact the restaurant first. If a request reaches CROWN EPOS, we promptly forward it to the restaurant and assist it in responding. For our own controller processing, contact [email protected]. You can complain to the Information Commissioner’s Office.

Material changes to this notice will be communicated appropriately. Publishing a revised notice does not retrospectively authorise a different use of personal data or replace consent where required.

UKBD TECH LTD trading as CROWN EPOS (Company No. 13450076), Ashley House Business Centre, Suite 301, 235–239 High Road, Wood Green, London N22 8HF.

Email: [email protected]. Phone: +44 (0)7522 58 11 22.