Privacy Policy

Bavelgo Groups | Version 1.0 | Effective: 8 November 2026

1. Scope and our data protection roles

This policy covers Bavelgo's public website and, where applicable, Bavelgo Restaurant & POS, Workforce & Payroll and Bavelgo Pay.

For Bavelgo's own commercial enquiries, account administration, billing and platform management, the operator ordinarily acts as a data controller. Where businesses upload information about their employees or customers and determine its purposes, those businesses ordinarily act as controllers and Bavelgo as their processor.

The applicable role depends on the specific processing activity, not merely on the product name.

2. Categories of personal information

• Business contacts: names, business details, email addresses, phone numbers and enquiries.
• Account information: identifiers, roles, authentication information and access logs.
• Workforce data: employment details, attendance, leave, working schedules, payment information, payroll records and statutory identifiers supplied by the employer, where enabled.
• Restaurant data: customer contact information, orders, reservations and communications.
• Payment-related information: transaction references, payment status and payment-provider account identifiers, where applicable.
• Technical information: device and security information, cookies and similar technologies.

Only the categories relevant to a person's interaction with the service are processed.

3. Purposes and legal bases

Bavelgo processes its own controller information to respond to enquiries, provide subscribed services, administer accounts and billing, maintain system security, investigate misuse and meet applicable legal requirements.

Depending on the purpose, the relevant UK GDPR legal basis may be performance of a contract, compliance with a legal obligation, legitimate interests following an appropriate assessment, or consent when legally required. The applicable basis and purposes must be documented for each actual processing activity.

For employer-controlled information, the employer must identify and document its own lawful basis. Employment and payroll processing does not automatically rely on employee consent.

4. How information is obtained

Information may be supplied directly by a website visitor, business account holder, employee or customer, or by the organisation using Bavelgo to manage its business operations.

5. Sharing and service providers

Data may be shared with authorised users, technical hosting and support providers, contracted payment providers, professional advisers where appropriate, and competent authorities where required by law.

Bavelgo Pay may involve Stripe and its applicable connected-account arrangements. The current subprocessor inventory and specific contractual relationships must reflect the integrations actually enabled.

6. International transfers

Where personal data is transferred outside the United Kingdom, Bavelgo or the relevant controller must assess whether an adequacy regulation, appropriate safeguards or another lawful transfer mechanism applies. Actual transfer locations and mechanisms must be documented for the applicable providers.

7. Security and confidentiality

Bavelgo is responsible for appropriate security measures within its control, including suitable access management and protection of information entrusted to the platform. Customer organisations must protect their own accounts, manage user permissions and provide accurate information.

No system can promise absolute security. Suspected incidents should be reported promptly through the official contact page.

8. Retention and deletion

Information is retained only as necessary for the applicable purposes and statutory, security or contractual requirements. Different record categories require different periods.

Specific retention schedules, backup deletion procedures and statutory exceptions must be confirmed against the operational systems and documented before this notice can be considered complete.

Requests concerning records controlled by an employer or restaurant may be referred to that organisation.

9. Individual rights

Subject to applicable conditions and exceptions, individuals may request access, rectification, erasure, restriction, portability or object to certain processing. Where processing relies on consent, it can be withdrawn.

Submit requests through Bavelgo Contact. For records controlled by an employer or restaurant, that organisation generally handles the request, assisted by Bavelgo where required.

10. Workers and employers

Employers are responsible for providing their workforce with appropriate privacy information about their payroll and employment records. Bavelgo is responsible for its applicable contractual processor duties and its separate controller activities.

11. Cookies

See the Cookie Policy for information about website storage and access technologies.

12. Complaints

Contact Bavelgo through the contact page. You may also complain to the Information Commissioner's Office (ICO).

13. Official guidance

ICO: privacy information requirements.