2. Privacy Policy

2.1 Who We Are

This Privacy Policy explains how THYNKR SYSTEMS LTD, company number 15306717, processes personal information in connection with TableSyncAI.

Registered office:

Office 2, 1st Floor, 73 Station Passage, London, England, E18 1JL

For privacy enquiries: info@tablesyncai.com

In this Policy, "TableSyncAI", "TableSync", "we", "us" and "our" refer to THYNKR SYSTEMS LTD where it acts as controller.

2.2 When This Policy Applies

This Policy applies where THYNKR determines why and how personal data is processed, including data relating to:

• visitors to our websites;
• prospective customers;
• restaurant owners and business contacts;
• account administrators;
• billing and subscription contacts;
• support users;
• partners and suppliers;
• applicants or participants in commercial programmes; and
• individuals whose data we independently process for security, fraud prevention, service analytics or legal compliance.

For personal data processed by THYNKR strictly on behalf of a restaurant or other Customer, that Customer is normally the controller and THYNKR is the processor. That processing is governed by the DPA and the Customer's own privacy notice.

2.3 Information We May Collect

Depending on use of the Services, we may process:

Identity and contact information

Name, business name, job title, address, email address, telephone number and account identifiers.

Business and verification information

Company details, ownership information, restaurant information, regulatory details and information needed to assess eligibility for certain Services.

Account and authentication information

Login identifiers, password hashes, security settings, permissions, device identifiers and authentication logs.

Billing information

Subscription plan, billing address, invoice records, payment status, transaction references and limited payment metadata. Full card data may be handled directly by a payment provider rather than stored by THYNKR.

Technical information

IP address, device type, browser, operating system, application version, logs, crash information, cookie identifiers and security events.

Usage information

Features used, interactions, configuration, audit events and operational activity.

Communications

Emails, support requests, chat messages, call metadata and other communications with us.

Restaurant operational data

Where relevant to our own controller purposes, information concerning locations, device configuration, service usage and integration status.

AI interaction information

Prompts, messages, transcriptions, structured order content and related metadata where AI Features are used, subject to the controller/processor role applicable to the particular interaction.

2.4 Restaurant End-Customer Data

When a diner places an order with a restaurant through TableSyncAI, THYNKR commonly processes the diner's information on behalf of that restaurant.

This may include:

• name;
• telephone number;
• email address;
• delivery or collection information;
• order contents;
• order notes;
• transaction references;
• loyalty information; and
• communications relating to the order.

The restaurant determines the purpose of this processing and is normally responsible for providing its own privacy information to the diner.

THYNKR may separately process limited information as controller where necessary for security, fraud prevention, legal compliance, platform integrity or establishment and defence of legal claims.

2.5 Special Category and Sensitive Information

Customers should not use free-text fields to submit unnecessary special-category data.

Information about food allergies may reveal health-related information. Restaurants should collect and use such information only where lawful and necessary for order fulfilment and safety.

TableSyncAI is not intended to be a medical-record system.

2.6 Why We Use Personal Information

Where we act as controller, we may use personal data to:

• create and administer accounts;
• provide requested services;
• manage subscriptions and billing;
• verify businesses or authorised users;
• communicate with customers;
• provide support;
• secure our systems and prevent fraud;
• investigate misuse;
• maintain logs and auditability;
• improve product reliability and user experience;
• understand service performance;
• comply with law and regulatory requirements;
• establish, exercise or defend legal claims;
• manage suppliers and partners;
• market our business where permitted; and
• develop and improve products using appropriately governed data.

2.7 Lawful Bases

Depending on the activity, we rely on one or more of:

• contract — where processing is necessary to enter into or perform a contract;
• legitimate interests — including securing, operating and improving our business and preventing fraud, balanced against individual rights;
• legal obligation — where law requires processing;
• consent — where consent is the appropriate lawful basis and has been obtained; and
• other lawful bases available under applicable data-protection law.

Where special-category data is processed, an additional lawful condition will be identified where required.

2.8 Marketing

We may send business communications about TableSyncAI where permitted by law.

Recipients may opt out of non-essential electronic marketing using the unsubscribe mechanism or by contacting us.

Transactional, security, billing and service communications are not marketing and may continue where necessary to provide or administer the Services.

2.9 Automated Processing and AI

TableSyncAI may use automated systems to assist with activities such as:

• interpreting natural-language orders;
• fraud or risk signals;
• operational recommendations;
• support routing;
• menu extraction;
• speech recognition; and
• product analytics.

We do not intend to make solely automated decisions producing legal or similarly significant effects about individuals unless an appropriate legal basis, safeguards and notice are in place.

2.10 Who We Share Information With

We may share personal information with:

• cloud-hosting and infrastructure providers;
• payment service providers;
• email and communications providers;
• telecommunications, messaging and voice providers;
• AI and machine-learning infrastructure providers;
• monitoring, logging and security providers;
• analytics providers;
• professional advisers;
• government, regulators, courts or law-enforcement authorities where lawfully required;
• prospective purchasers or investors in a corporate transaction, subject to appropriate safeguards; and
• other subprocessors needed to operate TableSyncAI.

Where THYNKR acts as processor, subprocessor use is governed by the DPA.

2.11 International Transfers

Our providers and infrastructure may process personal information in more than one country.

Where data-protection law restricts an international transfer, we use an appropriate lawful transfer mechanism, which may include:

• a UK adequacy regulation;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved EU Standard Contractual Clauses;
• applicable Standard Contractual Clauses;
• another legally recognised safeguard; or
• a permitted exception where appropriate.

We also undertake any legally required transfer-risk or data-protection assessment.

2.12 Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including contractual, operational, security, tax, accounting, dispute and legal requirements.

Retention periods vary by data category.

When we process data solely as processor, deletion and return are governed by the Customer's instructions and the DPA, subject to legal retention requirements and secure backup cycles.

2.13 Security

We use technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures are selected according to risk and may include:

• access controls;
• authentication controls;
• encryption in transit;
• appropriate encryption at rest;
• network and system hardening;
• logging and monitoring;
• backup and recovery processes;
• vulnerability management;
• least-privilege access;
• staff confidentiality measures; and
• incident-response procedures.

No system can be guaranteed completely secure.

2.14 Your Rights

Depending on the law applicable to you, you may have rights to:

• access personal data;
• correct inaccurate data;
• request deletion;
• restrict processing;
• object to processing;
• receive portable data;
• withdraw consent where processing is based on consent;
• object to certain direct marketing; and
• obtain safeguards relating to certain automated decisions.

Rights are subject to legal conditions and exemptions.

Where THYNKR processes your information solely on behalf of a restaurant, we may direct your request to that restaurant.

2.15 Complaints

You may contact us first so we can try to resolve your concern.

Individuals in the United Kingdom may also have the right to complain to the Information Commissioner's Office (ICO).

2.16 Children

TableSyncAI is a business platform and is not intended to permit children to create restaurant operator accounts.

Restaurants remain responsible for complying with applicable laws when they process information relating to minors as their customers.

2.17 Cookies

Our websites and applications may use cookies, local storage and similar technologies for authentication, security, preferences, analytics and other purposes.

Further information is provided in the Cookie Policy.

2.18 Changes to This Policy

We may update this Policy to reflect changes in law, providers, products or processing.

The "Last updated" date indicates the current version.

2.19 Contact

THYNKR SYSTEMS LTD
Office 2, 1st Floor
73 Station Passage
London, England
E18 1JL

Email: info@tablesyncai.com
Telephone: +44 (0)333 011 8207