Venueward privacy notice.

Who we are

Venueward is operated by Mohammed Islam. For privacy questions, information requests or privacy complaints, email mohammed.j.islam95@gmail.com.

This notice covers the Venueward app, website and support service. Venueward helps hospitality businesses manage their teams, reservations, daily checks and venue records.

Your business and Venueward

Your employer or restaurant decides why it uses staff, applicant, guest and operational records. It is the data controller for that use. Venueward processes those records to provide the service on the business’s instructions. The business should give you its own privacy information, including its retention rules.

Mohammed Islam is separately responsible for Venueward’s account administration, customer relationships, support correspondence and service-security activities. Contact us if you are unsure where to direct a request or no longer have app access.

Information we handle

Depending on the features your business uses, information includes:

• Email, name, account identifier, business membership, role, work area and sign-in/security information.
• Rotas, availability, shift offers, attendance, work times, leave and absence records. Illness categories and notes can reveal health information.
• Named checks, temperature readings, cleaning, equipment and stock records, assignments, approvals, corrections and recorded times.
• Applicant details, recruitment notes and uploaded CV pages.
• Guest contact details, reservations, waitlists, requests, notes, deposit amounts and payment references. The current reservations feature records payments handled elsewhere; it does not take card payments.
• Customer complaints, contact/address details, remedies, actions, outcomes and attachments.
• Inspection documents, photos, food-safety records, privacy requests and investigation notes.
• Support correspondence, relevant device/app details, technical request and security information, and enabled notification identifiers and delivery status.

Information comes from you, authorised business users, their uploads and the service’s activity and security functions. A restaurant may enter information received in person or by telephone. Please avoid unnecessary medical information, identity documents, passwords or payment-card details in general notes and support emails.

Search terms sent to retrieve records may appear in our service provider’s technical request logs.

Purposes and lawful bases

For processing where Venueward is the controller:

• Contract: information necessary to provide the service to an individual customer, including a sole trader, or take steps they request before contracting.
• Legitimate interests: administering business contacts and authorised access, answering enquiries, providing support, operating the website and protecting the service. These interests are running the requested service and preventing misuse; they do not justify unrelated uses of information.
• Legal obligations: responding to statutory privacy requests and keeping information required by applicable law. Necessary evidence for a dispute may also be retained for the legitimate interest of establishing or defending legal rights.

The business determines its lawful bases for employment and guest records. Health information also needs an applicable special-category condition. Accepting an invitation or allowing notifications is not blanket consent to employment or health-data processing.

Sign-in and access information is necessary to use an account. Your business should explain other information it requires. Venueward does not use customer business records for marketing, sell those records, make hiring decisions or score employee performance.

Recorded stock demand helps suggest minimum stock and order quantities.

Access and providers

Business access depends on membership, role, work area and the feature. Some actions require shift approval or manager confirmation. Staff can see their own absence details; authorised managers can access the relevant staff records. Absence reasons are not copied into cover offers. Businesses are responsible for copies they print, export or share.

The service uses:

• Supabase: app authentication, database, private files and server functions.
• Expo Push Service and Apple: enabled iPhone notifications, using device identifiers, general messages and routing information.
• Google/Gmail: sign-in email delivery through Gmail SMTP, and the public support/privacy mailbox and correspondence you send.
• OpenAI Sites, with hosting infrastructure including Cloudflare: the public website and associated technical requests.

Relevant information may also be disclosed where legally required or needed for a specific professional-advice or legal matter.

The app database is configured in London. Suppliers may handle information elsewhere, including the United States. Supabase’s and OpenAI Sites’ published processing terms describe UK transfer clauses; Expo and Google describe the UK extension to the Data Privacy Framework; Apple describes contractual safeguards. These are supplier arrangements, whose application depends on the service and information involved. Contact us for details relevant to your data.

The website and staff app

The public product walkthrough uses fictional venue, staff and guest records; its examples do not connect to a live business. Browser interactions with sample data can be held for that browser session. Do not enter real personal or business information into the public demonstration.

The staff website loads a sign-in page that anyone with the link can open. Operational records require an authorised Venueward account and the appropriate business membership and permissions. Website hosting involves network/request information needed to deliver and protect the pages.

Retention and deletion

Retention depends on the information and its purpose. Account details are needed to maintain authorised access. Support correspondence is kept while needed to resolve the enquiry and understand related follow-up. Privacy-case records document the request, action and outcome. Security information supports investigating misuse; relevant contract or financial information may be needed for legal duties or claims.

Business records follow the business’s instructions and applicable requirements: recruitment needs, employment/payroll responsibilities, a reservation or unresolved complaint, food-safety records, inspections or a specific legal claim. Named attribution is retained only where separately necessary. Keeping records indefinitely merely because storage is available is not the purpose. Ask the business for its particular periods.

Mohammed Islam is responsible for the retention review process, with customer-controller instructions for business records. The adopted policy requires a monthly review of records due for review, a policy review every 90 days, and earlier review when the relevant purpose ends. When information is no longer needed, the policy requires deletion or genuine anonymisation across records, files, history and request copies. Illness reasons and health notes are reviewed separately: a need to keep attendance hours does not justify keeping health details.

Any point-in-time recovery copies held by Venueward also need a documented retention decision. Deleting a live record does not necessarily remove an existing copy immediately. Scheduled database and file backups are not currently configured.

Account deletion during the web pilot

Email mohammed.j.islam95@gmail.com to request account deletion or help with your information. You can contact us even when signed out or without a business membership. We verify your identity and explain the effect on your account and business access.

If you own a business, its ongoing ownership or closure needs to be resolved. Necessary business records are considered with the responsible business under the retention criteria above. An account-deletion request does not automatically erase every record you helped create or information about other people.

We confirm what has been deleted and explain any justified retention or unresolved action. A request being received or under review is not confirmation that deletion has finished. Automated in-app account deletion is not available in this browser pilot.

Your rights and complaints

Depending on the circumstances, you can request access, correction, deletion, restriction or a portable copy of your information. You can object to processing based on legitimate interests. Where consent is the basis, you can withdraw it.

Email us using the address above; no special wording is needed. We may need proportionate identity checks. Rights requests normally receive a response within one month, with any lawful extension explained.

We acknowledge data protection complaints within 30 days, investigate and explain the outcome. You can also complain to the Information Commissioner’s Office.

Device choices

Camera and file selection support attachments you choose to add. The web pilot does not send phone push notifications and does not offer an offline copy of business records. Downloads, screenshots and printed files may remain on the device. Lock or sign out after using a shared device.