Privacy Policy

Who is responsible for the data

For the account details of venue owners and the other logins they add, Socialize is the controller: we decide how that data is used.

For the data a venue keeps in Tablista about its guests and its staff, the venue is the controller. Socialize processes that data only on the venue's instructions, to run Tablista for it.

If you are a guest or a member of a venue's staff, please contact the venue first about your data. We help the venue answer you.

Data about owners and logins

• email address and password;
• the venue's name, its branches and its reference code;
• the plan, the payments the venue reports and the payments we confirm, with their amounts, methods, references and dates;
• the version of the terms the owner accepted, and when;
• for the owner's alerts, the phone's notification token from Google Firebase;
• technical records of sign-ins and use (such as the time and the device's internet address), which keep the service secure.

We use this data to run the account, confirm payments, write to owners about their account and the service, keep Tablista secure, and meet our legal duties.

Data venues keep in Tablista

A venue decides what it records. Depending on the features it uses, this can include:

• Sales: the menu and prices, orders, bills, payments as recorded, day closes and cash counts.
• Staff: names, roles, PINs (never stored as typed, only in scrambled form using PBKDF2), shifts and schedules. If the venue uses payroll: salaries, allowances, leave, and each person's bank IBAN and Qatar ID number for the salary file (WPS).
• Guests: names, phone numbers, email addresses, birthdays, allergies, visit history, loyalty points, and whether and when they agreed to receive messages by WhatsApp, SMS or email. A venue can also record a guest's title, gender, birth year, nationality, language, anniversary, company, diet, seating preference, likes and dislikes, and notes.
• Bookings and deposits, and the orders guests place on the venue's order and booking pages.
• Orders from delivery apps the venue links, which can include the guest's name, phone number and delivery address.
• Stock, suppliers, purchases and expenses, including photos of supplier invoices.
• Identifiers of the venue's devices.

Some of these details are sensitive. Allergies and some diets say something about a person's health, and the law gives health data and children's data special protection. Record only what you need to serve your guests.

How we use venue data

We use venue data only to run Tablista for the venue: to store it, keep its devices in step, show its reports, send its owner's alerts, and give support when the venue asks.

We do not sell personal data. We do not use it for advertising or tracking, and we never use one venue's data for another venue.

Who else handles the data

We use a small number of service providers. Each one handles data only to provide its service to us:

• Supabase: our database, sign-in and file storage, hosted in Mumbai, India (Amazon Web Services, region ap-south-1). All venue data is stored here.
• GitHub: keeps our nightly backups, encrypted, for 14 days.
• Vercel: hosts the Tablista website and the guest order and booking pages.
• Google Analytics: counts visits to the home page, the terms and this policy on the Tablista website. It receives the pages viewed, the type of device and browser, a rough location (country and city) worked out from the device's internet address, and where the visitor came from, such as a search engine or a link. It receives no names or email addresses.
• Google Firebase Cloud Messaging: delivers alerts to the owner's phone.
• MET Norway: gives us the weather for the branch's area. It receives the location only, with no personal data.
• Anthropic: reads photos of supplier invoices, only if the venue switches this on.
• Talabat (Delivery Hero): only if the venue links its Talabat account, to receive its orders and send back the venue's answers.
• Resend: sends the emails that carry the sign-up and password reset codes. It receives the email address and the content of each email.

WhatsApp messages a venue sends its guests go from the venue's own phone or WhatsApp line, not through Tablista.

Data kept outside Qatar

Tablista's database is in India, so personal data in Tablista is transferred out of Qatar and stored there. Some of the providers above may also process data in other countries, including the United States.

A venue's own notice to its guests and staff should mention this transfer.

On your devices

Each device keeps a copy of its branch's data so the POS works offline. The PINs in that copy are locked with a key that only that device holds. A browser used as a POS keeps the same copy in the browser's storage.

Signing out removes the branch's menu, team and settings from the device. Orders, payments and day closes already on it stay there, and changes not yet sent wait until the same branch signs in on that device again. Before you sell or give away a device, remove Tablista and its data from it.

Guest order and booking pages

Guests can order from a QR code at the table and book online on the venue's page. These pages ask for the guest's name and phone number, which go straight to the venue's records in Tablista.

The venue is responsible for telling its guests how it uses their data. Tablista provides the tools.

Messages to guests

Tablista records whether each guest agreed to receive messages by WhatsApp, SMS or email, and when. The venue sends its own messages, and must have the guest's consent before sending any marketing message. Each marketing message must say who it is from, say that it is marketing, and give the guest an easy way to stop such messages.

How long data is kept

We keep the data while the venue's account is open.

When a venue cancels, it has 90 days to download its data. After that we delete it, except what the law requires us to keep. Deleted data leaves our encrypted backups within 14 days.

Copies on the venue's own devices stay until the venue removes them.

Keeping data safe

Data travels between the devices and our servers encrypted (HTTPS). Each venue's data is walled off from every other venue's in the database. PINs are never stored as typed, and our backups are encrypted.

If a security breach affects a venue's data, we tell the venue straight away. If it affects owners' account data and could cause serious harm, we tell the people affected and the competent authority, as the law requires.

Your rights

Owners and other logins can ask us, at hello@socialize.qa, to:

• see the personal data we hold about them, and get a copy of it;
• correct it;
• delete it, when it is no longer needed or was never needed;
• withdraw a consent they gave, or object to a use of their data.

Guests and staff should contact the venue. If they contact us, we pass the request to the venue and help it answer.

If you are not satisfied with our answer, you can complain to the competent authority in Qatar.

Children

Tablista is a tool for businesses and is not meant for children. The law gives children's data special protection, so venues should not record details about children in Tablista.

Cookies

The Tablista website uses the cookies needed to sign you in and keep you signed in. On its public pages (the home page, the terms and this policy, in English and Arabic), we also use Google Analytics cookies to count visits and see which pages visitors find useful. These cookies last two years from your latest visit, and we never use them for advertising. Google Analytics runs only on those pages, never on the guest order and booking pages or in the POS app and its back office.

You can block or delete cookies in your browser's settings, but signing in does not work without the sign-in cookies. Google explains how it uses this information at policies.google.com/technologies/partner-sites.

Changes to this policy

We post any change here with its date, and tell venue owners by email before a significant change takes effect.

Contact

Socialize Services W.L.L, Office 53, Floor 12, Burj Marina, Lusail, Qatar.

Email: hello@socialize.qa