1. Who we are and when this policy applies
TillCraft provides cloud-based electronic point of sale (EPOS), ordering, operational and related software for hospitality and retail businesses. For personal information collected through tillcraft.io, sales enquiries, billing, account administration and our direct business relationships, TillCraft is the data controller.
When a TillCraft customer uses the service to process information about its own staff, customers, suppliers or transactions, that customer will usually be the controller and TillCraft acts as its processor. In that situation, the customer’s privacy notice applies and we process the information on its documented instructions and under our data processing terms.
Questions can be sent to hello@tillcraft.io.
2. Information we collect
Depending on how you interact with us, we may collect:
- Identity and contact details, such as your name, work email, telephone number, company, role and venue details.
- Account and subscription details, including user identifiers, permissions, plan, licences, sites and service history.
- Billing and transaction details, such as invoices, payment status and limited payment-related records. Card details may be collected directly by our payment provider rather than TillCraft.
- Communications, including enquiries, support requests, feedback and records of our correspondence.
- Technical and usage data, including IP address, browser and device type, login and audit records, diagnostic events and how the service is used.
- Customer-controlled service data, which may include staff, order, product, customer and operational data entered into the TillCraft service by a customer.
We receive information from you, other authorised users in your organisation, our service providers and automatically from the website or service. Please do not send us special category information unless it is necessary and we have agreed how it will be handled.
3. How and why we use personal information
| Purpose | Typical lawful basis |
|---|---|
| Responding to enquiries, providing proposals and taking steps to start a subscription | Steps before a contract; legitimate interests in developing our business |
| Providing, administering, securing and supporting the service | Performance of a contract; legitimate interests in operating a reliable and secure service |
| Billing, accounting, tax and record keeping | Performance of a contract; legal obligation; legitimate interests |
| Monitoring performance, fixing faults and improving our products | Legitimate interests in maintaining and improving the service |
| Preventing fraud, misuse and security incidents, and establishing or defending legal claims | Legitimate interests; legal obligation where applicable |
| Sending requested product news or direct marketing | Consent where required, or legitimate interests where the law allows business marketing |
Where we rely on legitimate interests, we consider the impact on individuals and do not use information in this way where their rights override our interests. You can object to direct marketing at any time.
If we ask for information that is required to enter into or perform a contract, we will explain this. Without it, we may not be able to provide the relevant service.
5. How long we keep information
We keep information only for as long as needed for the purpose collected, including contractual, security, tax, accounting and legal requirements. Retention depends on the nature of the information, risk and any customer instructions.
- Sales and contact enquiries are normally reviewed after 24 months of inactivity.
- Core customer, contract, invoice and payment records may normally be kept for up to six years after the relationship ends where needed for tax or legal claims.
- Support, audit and security records are retained for a proportionate period based on operational and security need.
- Customer-controlled service data is deleted or returned in accordance with the customer agreement and our data processing terms, subject to limited backup cycles and legal obligations.
We may retain anonymised information that no longer identifies an individual.
6. Security
We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure or access. These include access controls, authentication, logging, system maintenance and supplier controls appropriate to the risk. No internet service can be guaranteed completely secure, so account users must also protect their credentials and notify us promptly of suspected misuse.
7. Your data protection rights
Depending on the circumstances, UK data protection law may give you the right to:
- ask for access to your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information;
- ask us to restrict how information is used;
- object to processing based on legitimate interests or to direct marketing;
- receive certain information in a portable format; and
- withdraw consent at any time where processing relies on consent.
These rights are not absolute and exemptions may apply. To make a request, email hello@tillcraft.io. We may need to verify your identity. If your request concerns data controlled by a TillCraft customer, please contact that customer first; we will assist them as required.
9. Children
TillCraft is a business service and is not directed at children. We do not knowingly invite children to create accounts or submit enquiries.
10. Changes to this policy
We may update this policy to reflect changes to our service, suppliers or the law. We will post the revised version here and change the date above. We will give additional notice where a change materially affects how account information is used.
11. Contact and complaints
Please send privacy questions, requests or complaints to hello@tillcraft.io or use our contact form. We would welcome the opportunity to resolve a concern.
You also have the right to complain to the UK Information Commissioner’s Office (ICO). Visit ico.org.uk/make-a-complaint or telephone 0303 123 1113.