TakoRos Privacy Policy

TakoRos is operated by Shrey Network Ltd ("we", "us"), Sofia Road, Petit Camp, Phoenix, Mauritius. Business Registration Number (BRN): C25229520. VAT number: 28482002. Privacy contact: contact@takoros.com.

This policy explains how we handle personal data when you visit takoros.com, use the TakoRos apps and dashboard, or contact us. It applies to restaurant owners, staff and other authorised users, and to visitors of our website.

• As controller, we decide why and how personal data about our customers and website visitors is used. This covers account holders, staff users, billing contacts, support requests and security logs.
• As processor, we handle personal data about a restaurant's own guests and staff (for example order histories, reservation names and phone numbers, kiosk and online orders, and staff records) on that restaurant's instructions. The restaurant is the controller of that data and is responsible for telling its guests how it is used. We process it only to provide the Service.

A Data Processing Addendum is available on request at contact@takoros.com.

• Account and contact data: name, email, phone number, password (stored as a hash), role and staff PIN. Source: you.
• Business profile: business name, address, branches, VAT number and settings. Source: you.
• Operational data (processor role): menus, orders, receipts, reservations, guest names and phone numbers, staff shifts and reports. Source: you, your staff and your guests through the apps.
• Billing references: plan, add-ons, subscription and transaction identifiers and billing country. Payment card details are collected by Peach Payments and are never stored by us.
• Support and community content: messages, issue reports, and questions and answers you post in the community.
• Technical data: IP address, country, device and browser type, logs and security events, and cookies or local storage (see section 9). Source: collected automatically.

• To create and run your account and the Service, and to provide support: performance of a contract.
• To process subscriptions, invoices (via Zoho Books), tax records and refunds: performance of a contract and legal obligation.
• For security, fraud and abuse prevention, and to maintain and improve the Service: our legitimate interests.
• To send service and billing emails such as verification codes and notices: performance of a contract and our legitimate interests.
• For optional marketing emails, if we send any: your consent, which you can withdraw at any time.
• For accounting, tax and legal compliance: legal obligation.

We do not sell personal data, and we do not use Customer Data for advertising.

We use service providers (sub-processors) under written agreements:

• Peach Payments: payment processing, card data security and fraud checks. See Peach Payments' privacy policy.
• Zoho Corporation: invoicing and billing records.
• Railway and Supabase: application backend and database, hosted in Singapore.
• Vercel: delivery of our website and dashboard through its global network.
• Resend: transactional email delivery.
• Upstash: caching and rate limiting.

We may add or replace providers. We will update this list and give customers notice of material changes. We may also disclose data where the law requires it, to protect rights and safety, or as part of a business sale or reorganisation, with continued protection of your data.

Our main data is hosted in Singapore, and some providers process data in other countries outside Mauritius, including the European Union, the United Kingdom and the United States. Where we transfer data we use appropriate safeguards, such as contractual clauses or adequacy decisions, in line with the Mauritius Data Protection Act 2017 and, where relevant, the GDPR and UK GDPR.

• Account and business profile: while your account is active, then deleted within 90 days after closure.
• Operational data: while your account is active. You can export it for 30 days after closure or downgrade, and it is deleted within 90 days after that.
• Billing and tax records: for the period required by law, generally up to 7 years.
• Support messages: 24 months after resolution.
• Security and access logs: up to 12 months.
• Backups: overwritten within 90 days.
• Community posts: until you ask us to remove them.

We use reasonable technical and organisational measures to protect personal data, including encryption in transit, access controls, separation between customer accounts and monitoring. No online service can be guaranteed to be completely secure. If a breach affects your personal data, we will notify you and the relevant authority as the law requires.

We use only essential cookies and browser storage, for example to keep you signed in and to remember preferences, so that the website and dashboard work. Our marketing website does not use analytics or advertising cookies. You can block cookies in your browser, but signing in may then stop working. If we add any non-essential cookies in future, we will ask for your consent first and update this section.

Questions and answers you post in the community are public and show the name or display name you provide. Your email address is not published. Please do not post confidential information. Messages sent through contact forms are used only to reply to you. To have a post removed, email contact@takoros.com.

Depending on where you live, you may ask us to give you access to your data, to correct it, delete it, restrict or object to its use, or to give it to you in a portable format. You may also withdraw consent you have given. Email contact@takoros.com and we will respond within 30 days.

If you are a restaurant's guest, please contact that restaurant first, as it is the controller of your data. We will help it to respond.

You may complain to the Mauritius Data Protection Office (dataprotection.govmu.org) or, if you are in the EU or UK, to your local supervisory authority.

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.

We will update this policy when our practices change and will change the "Last updated" date above. For material changes we will notify account holders by email or in the dashboard.

Shrey Network Ltd, Sofia Road, Petit Camp, Phoenix, Mauritius. For privacy questions, access requests or data concerns, contact contact@takoros.com.