Privacy Policy
This Privacy Policy explains how HospitalityOS ("we", "us", "our") collects, uses, and protects personal data when you use our workforce and operations platform for hotels, restaurants, bars, and leisure businesses across Ireland and the United Kingdom. We are committed to handling your data lawfully, fairly, and transparently in line with the EU GDPR and UK GDPR.
1. Who this policy covers
HospitalityOS is provided to hospitality businesses (our "customers") and used by their managers and staff. Your employer is the data controller for employee records processed on the platform; we act as a data processor on their behalf. For account and billing data we hold about the business, we act as the controller.
2. Information we collect
- Account details — business name, country, contact name, email address, and login credentials.
- Employee records — names, roles, departments, contact details, and identifiers required for payroll (such as PPS or National Insurance numbers) and payment (IBAN or sort code / account number).
- Rostering and attendance — schedules, shift swaps, time-off requests, and clock-in/clock-out data.
- Operational data — sales, orders, inventory, supplier records, and cost information you enter.
- Payroll data — hours worked, pay rates, tax bands (PRSI / NI), and generated payslips.
- Usage and device data — pages visited, actions taken, IP address, device type, and push notification tokens for our management and staff mobile apps.
3. How we use your information
We use personal data to operate and secure the platform, generate rosters and payroll, deliver notifications and messaging, provide business intelligence and forecasting, offer customer support, and comply with our legal obligations.
4. Legal bases for processing
Where we act as a controller, we rely on legitimate interests (running and improving the service), performance of a contract (providing your subscription), and legal obligation (tax and record-keeping) as our lawful bases under the GDPR.
5. Sharing with third parties
We share data only with service providers that help us run the platform, under written agreements and appropriate safeguards. These include cloud hosting, payment processors, WhatsApp / SMS delivery partners (such as Twilio), and push notification providers (such as Firebase Cloud Messaging). We do not sell your personal data.
6. Data retention
We retain personal data for as long as your account is active and thereafter only as required to meet legal, tax, and accounting obligations, after which it is securely deleted or anonymised.
7. Security
We use encryption in transit, strict tenant isolation so each business's data is kept separate, role-based access controls, and audit logging to protect your information.
8. Your rights
Subject to applicable law, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Employees should contact their employer in the first instance; we will support any verified request.
9. International transfers
Where data is transferred outside the EEA or UK, we ensure an adequate level of protection using approved safeguards such as Standard Contractual Clauses.
10. Contact us
For any privacy question or to exercise your rights, please contact your account administrator or email us at support@hospitalityos.com.