TABLEAXIS
Data Protection Information
Draft for review — not yet final contractual terms. Company-specific policies and processing details must be confirmed before public launch. Updated 19 September 2026.
Controller and processor roles
A restaurant or hotel generally determines why it uses guest and staff information in its operations. The provider may process that information on the business’s instructions, while acting separately for its own account administration. The actual roles depend on the processing and must be documented.
Data-processing agreement
Before processing customer personal data, the parties should establish applicable processing instructions, subject matter, duration, categories of data and people, confidentiality, security measures, subprocessors, assistance obligations, deletion or return and audit arrangements.
Security, transfers and incidents
Document actual technical and organisational measures, hosting locations, access controls, incident procedures and international-transfer safeguards. This draft makes no unsupported encryption, residency, certification or breach-response guarantee.
Requests and retention
Provide a verified route for privacy requests, coordinate responsibilities between provider and customer, and define retention and deletion schedules. Guests should generally contact the restaurant or hotel responsible for their service records.
Reference guidance
The ICO explains controller and processor roles at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors-a-guide/ . The final agreement must reflect actual operations and applicable country law.