Privacy Policy

How RPOS collects, uses and protects personal data.

Last updated: 3 August 2026

GMHCO LTD ("RPOS", "we", "us") is the data controller for personal data we collect about you when you sign up for or use the RPOS dashboard (account holders, staff users). Where the Service is used to process data about your customers or staff (for example, booking guests or loyalty members), you are the data controller for that data and we act as your data processor — see our Terms of Service and Data Processing Agreement.

1. Who we are

GMHCO LTD, registered in England and Wales (company no. 16056150). ICO registration number: [ICO Registration Number]. Contact our Data Protection point of contact at [email protected].

2. What we collect

Account data: business name, your name, email address, hashed password, phone number.
Billing data: processed by Stripe on our behalf; we retain subscription status and invoice history, not full card numbers.
Usage data: log data, device/browser information, and product analytics needed to operate and improve the Service.
Data you input as controller: menu, sales, staff, and — where those features are enabled — guest booking details and loyalty member data.
Location data: if a venue has Geofenced Offers enabled and a customer opts in, we process that customer's approximate device location only while their consent is active, solely to determine whether they're within range of an offer. Claiming an offer creates a normal loyalty member record; we don't retain a location history beyond that.
Menu or business information you send us directly for our optional Restaurant Menu Integration Service (RMIS) — used solely to build your account's menu and not for any other purpose.

Sensitive contact fields (name, email, phone) for bookings and loyalty members are encrypted at rest (AES-256-GCM) and only decrypted to serve your requests.

3. Why we process it (legal basis)

To provide the Service and fulfil our contract with you (Art. 6(1)(b) UK GDPR).
To bill you and comply with tax/accounting obligations (Art. 6(1)(c)).
To keep the Service secure and prevent abuse, including rate-limiting signups (Art. 6(1)(f), legitimate interests).
To send service communications; marketing only with your consent, which you can withdraw at any time.

5. International transfers

Where a sub-processor is located outside the UK/EEA, we rely on the UK International Data Transfer Addendum or an adequacy decision to ensure an equivalent level of protection.

6. Retention

We retain account and transaction data for as long as your subscription is active and for a further period required for tax and accounting records (typically 6 years in the UK). You can request export or erasure of guest/member data you control via the in-product GDPR tools, subject to our own retention obligations.

7. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or port your personal data, and to object to certain processing. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

To exercise these rights, email [email protected].

8. Security

We use encryption in transit (TLS) and at rest for sensitive fields, role-based access control, and tenant data isolation. No system is completely secure; we will notify affected customers and the ICO of any qualifying personal data breach as required by law.

9. Cookies

We use strictly necessary cookies/local storage to keep you signed in, and, where enabled, analytics cookies to understand product usage. You can control cookies through your browser.

10. Changes

We may update this policy from time to time; material changes will be notified by email or in-app.