Privacy Policy

Version 1.0 · Effective Date: 11 September 2026

1. Who we are

Smatyx Holdings Ltd ("Smatyx", "we", "our" or "us") provides cloud-based software and related services for restaurants and hospitality businesses, including point of sale (POS), self-ordering and QR ordering, kitchen display systems (KDS), inventory management, reporting, loyalty, staff management, and other restaurant technology services.

  • Company Name: Smatyx Holdings Ltd
  • Company Number: 15704378
  • Address: 56 Paul Street, London, EC2A 4LN

If you have any questions regarding this Privacy Policy, please contact:

Email: [email protected]

2. Scope

This Privacy Policy applies to:

  • visitors to our website;
  • restaurant businesses using Smatyx Services;
  • authorised users of customer accounts;
  • individuals contacting Smatyx; and
  • users of customer-facing pages hosted by Smatyx where this Privacy Policy is referenced.

Customer-facing pages may also display or link to the relevant restaurant's privacy notice. The restaurant generally acts as the Data Controller for Personal Data collected in connection with orders, reservations, loyalty programmes and similar restaurant services, while Smatyx processes such data on the restaurant's behalf where applicable.

3. Our Role

Smatyx processes personal data in different capacities depending on how our Services are used.

When we process personal data for our own business purposes, such as account administration, billing, customer support, security, product improvement and legal compliance, Smatyx acts as a Data Controller.

When we process personal data relating to a restaurant's customers, staff or other users on behalf of that restaurant in providing the Services, the restaurant generally acts as the Data Controller and Smatyx acts as the Data Processor.

Where Smatyx acts as a Data Processor, our processing is governed by Section 17 of our Customer Service Agreement. Individuals wishing to exercise rights relating to data processed on behalf of a restaurant should normally contact the relevant restaurant directly.

4. Personal Data We Collect

Depending on how the Services are used, we may collect:

Business Account Information

  • business name
  • registered address
  • company registration number
  • VAT number (where applicable)
  • billing information
  • subscription information

Contact Information

  • names
  • email addresses
  • telephone numbers
  • job titles

Restaurant Operations Data

  • menu information
  • pricing
  • inventory records
  • supplier information
  • staff accounts
  • loyalty programme information
  • operational reports

Customer Order Information

Where processed on behalf of restaurants:

  • customer names
  • phone numbers
  • email addresses
  • order history
  • loyalty information
  • order items
  • quantities
  • special instructions
  • order timestamps
  • VAT information
  • payment status
  • table numbers
  • collection or delivery details

Technical Information

  • IP address
  • browser type
  • operating system
  • device information
  • cookies
  • session identifiers
  • application logs
  • diagnostic information

Support Information

  • emails
  • WhatsApp conversations
  • support requests
  • attachments
  • troubleshooting information

5. Payment Information

Smatyx does not process or store payment card details.

Online payments are processed by independent third-party payment providers selected by the restaurant.

Those providers are responsible for processing payment information in accordance with their own privacy policies.

6. How We Use Personal Data

We use personal data to:

  • provide the Services;
  • create and manage accounts;
  • process subscriptions;
  • provide technical support;
  • improve our software;
  • maintain security;
  • detect fraud;
  • comply with legal obligations;
  • send marketing communications where permitted by law;
  • provide software updates;
  • generate reports and analytics.

Where Smatyx acts as a Data Controller, we process personal data where:

  • Contract: processing is necessary to enter into or perform a contract, including providing and administering our Services;
  • Legitimate interests: processing is necessary for our legitimate interests, including operating and improving our Services, providing support, maintaining security, preventing fraud and managing our business relationships and, where permitted by law, marketing our Services.
  • Legal obligations: processing is necessary to comply with applicable legal or regulatory requirements; or
  • Consent: you have provided consent where consent is required.

Where Smatyx acts as a Data Processor, the relevant restaurant is responsible for determining the appropriate lawful basis for its processing.

8. Customer Data

When Smatyx processes Personal Data on behalf of a restaurant customer, we process that data in accordance with the Customer Service Agreement, the customer's documented instructions and applicable Data Protection Laws.

The restaurant remains responsible for determining the purposes and lawful basis for its processing of such Personal Data.

9. Third-Party Services

Our Services may integrate with independent third-party providers, including payment providers, communication services, cloud infrastructure, analytics providers, authentication services, and other software platforms.

Third-party providers may process Personal Data on our behalf or as independent controllers, depending on the nature of the service and the parties' respective roles.

10. Data Sharing

We do not sell personal data.

We may share personal data with:

  • cloud hosting providers;
  • infrastructure providers;
  • payment providers (where required);
  • technical support providers;
  • professional advisers;
  • auditors;
  • regulators;
  • law enforcement authorities where legally required.

11. International Transfers

Where Personal Data is transferred outside the United Kingdom, we use appropriate safeguards or transfer mechanisms as required by applicable Data Protection Laws. Further information about applicable safeguards may be requested by contacting us.

12. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction.

No internet-based service can guarantee absolute security.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services and meet legal, accounting, security and regulatory requirements.

Where Smatyx processes Personal Data on behalf of a restaurant customer, retention and deletion following termination of the Services will be handled in accordance with the Customer Service Agreement and our applicable retention and backup procedures.

14. Cookies

Our websites and hosted ordering pages may use cookies and similar technologies for:

  • authentication;
  • remembering preferences;
  • security;
  • website functionality;
  • analytics.

15. Your Rights

Subject to applicable law, individuals may have the right to:

  • access personal data;
  • correct inaccurate information;
  • request deletion;
  • restrict processing;
  • object to processing;
  • request data portability;
  • withdraw consent where processing is based on consent.

Where we rely on consent, you may withdraw your consent at any time by contacting us at [email protected] or by using any withdrawal or unsubscribe mechanism provided.

Where Smatyx acts as a data processor on behalf of a restaurant, requests relating to restaurant customer data should normally be directed to the relevant restaurant.

If you have concerns about how Smatyx handles your Personal Data, we encourage you to contact us first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority.

16. Children's Data

Smatyx does not intentionally offer its Services directly to children or knowingly create accounts for children except where authorised and managed by a restaurant customer. Where a restaurant processes Personal Data relating to children through the Services, the restaurant is responsible for ensuring that such processing is lawful.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

The latest version will always be published on our website with the revised effective date.

18. Contact Us

Privacy enquiries:

  • Company Name: Smatyx Holdings Ltd
  • Address: 56 Paul Street, London, EC2A 4LN
  • Email: [email protected]
Company Policy