Privacy policy

Introduction

This Privacy Policy explains how Expert Puffin Ltd("Expert Puffin", "we", "us" or "our") collects, uses, processes, stores, and shares personal data in connection with our websites, products, and services — including Resto Loop (C-ROS), our Ed-Tech ecosystem (Project Expert Puffin), consumer applications, artificial intelligence features, and bespoke software engagements.

We process personal data in line with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and other applicable privacy laws (together, "Data Protection Laws"). Terms such as "controller", "processor", "personal data", and "processing" have the meanings given under Data Protection Laws.

By using our websites or services, you acknowledge this Policy. If you do not agree, please do not use our services. Related contractual terms are set out in our Terms of Service.

Who we are

Expert Puffin Ltd is a UK technology company headquartered in London. We architect digital ecosystems for hospitality operations, education, consumer lifestyle, and enterprise clients.

• Email: info@expertpuffin.com
• Registered office: London, United Kingdom

Roles under Data Protection Laws

Similar to other hospitality and SaaS platforms, our role depends on the context:

• Website visitors and prospective customers: Expert Puffin is the controller of personal data you submit when contacting us, requesting a demonstration, or browsing our site.
• Business customers (venues, distributors, enterprises): your organisation is typically the controller of guest, student, staff, and supplier data you input into our platforms. Expert Puffin acts as a processor (or sub-processor) when providing Resto Loop, Ed-Tech, or bespoke hosted services on your instructions.
• End customers ordering via a venue's digital channels: the venue and Expert Puffin may share controller responsibilities for order fulfilment data, as set out in the applicable service agreement or data processing addendum.

Information we collect

1. Information you provide

Account and contact details

• Name, job title, business email, phone number
• Company or venue name, address, and trading details
• Login credentials and authentication data
• Demo requests, support tickets, and correspondence

Operational and product data (when you use our platforms)

• Menus, recipes, pricing, allergens, stock levels, and supplier catalogues (Resto Loop)
• Orders, reservations, table identifiers, tips, and fulfilment status
• Staff usernames, roles, and activity logs necessary to operate the system
• Learning accounts, progress, assessments, and teacher tools (Ed-Tech)
• Profile and location-related data in consumer applications (where enabled)

Payment-related information

• Billing contact details, invoices, and transaction references
• Card and payment data processed by regulated payment partners (e.g. Dojo, Stripe, Adyen). We do not store full card numbers on our servers where processing is handled by those providers.

2. Information collected automatically

• Device, browser, IP address, approximate location, and usage analytics
• Cookies and similar technologies (see Cookies below)
• Application diagnostic logs, performance metrics, and security events
• IoT and device telemetry where enabled (e.g. temperature or goods intake readings linked to your venues)

3. Information from third parties

• Delivery and marketplace partners (e.g. Uber Eats, Just Eat) where you connect integrations
• Suppliers and distributors connected to your ordering workflows
• Identity or authentication providers you choose to use
• Public or publisher-licensed content for Ed-Tech deployments

How we use personal data

We process personal data to:

• Provide, maintain, and improve our websites and software products
• Facilitate demonstrations, onboarding, support, and account administration
• Process orders, menus, inventory, reservations, POS sync, and related hospitality workflows
• Enable AI features (e.g. upselling suggestions, allergen checks, tutoring tools) in accordance with your configuration and our service terms
• Bill for services and prevent fraud or misuse
• Comply with legal obligations and enforce our agreements
• Send product updates and marketing where permitted (you may opt out of marketing at any time)

Legal bases for processing (UK GDPR)

• Contract: to deliver services you or your organisation have requested
• Legitimate interests: to secure, improve, and market our products in a proportionate manner
• Consent: where required (e.g. certain cookies or optional marketing)
• Legal obligation: tax, accounting, regulatory, or law-enforcement requirements

Special category data (such as detailed health or allergen preferences) is processed only where necessary for the service, with appropriate safeguards, and typically under the venue's instructions as controller.

How we share information

We may share personal data with:

• Service providers hosting, supporting, or securing our platforms
• Payment and fintech partners for settlement and compliance
• Integration partners you enable (delivery platforms, accounting tools, EPOS-related APIs)
• Professional advisers and auditors under confidentiality
• Authorities when required by law or to protect rights and safety
• A successor entity in connection with a merger, acquisition, or restructuring (with notice where required)

We do not sell personal data. Venue customers remain responsible for their own privacy notices to guests and staff when using Resto Loop or related products.

International transfers

Personal data may be processed in the UK, EEA, or other countries where our providers operate. Where transfers occur outside the UK/EEA, we use appropriate safeguards such as UK International Data Transfer Agreements or Standard Contractual Clauses, plus additional measures where needed.

Retention

We keep personal data only as long as necessary for the purposes described above, including to meet contractual, accounting, and legal requirements. Processor data held for business customers is retained according to the customer agreement and deletion or return instructions on termination, subject to legal retention overrides.

Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, or alteration — including access controls, encryption in transit where appropriate, monitoring, and staff training. No method of transmission or storage is completely secure; we continuously improve our controls.

Your rights

Depending on applicable law, you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase data ("right to be forgotten")
• Restrict or object to certain processing
• Data portability
• Withdraw consent where processing is based on consent
• Lodge a complaint with the UK Information Commissioner's Office (ICO)

To exercise these rights, contact info@expertpuffin.com. If you are an end customer of a restaurant or school using our software, please contact that organisation first — they are usually the controller for your data.

Cookies

Our websites may use essential cookies to operate the site and, where consented, analytics or preference cookies. You can manage non-essential cookies via your browser or any consent tool we display.

Children and Ed-Tech

Our corporate website is not directed at children. Ed-Tech deployments may involve student data under a school, distributor, or publisher arrangement. In those cases the education customer typically acts as controller, and we process data only as instructed and as required by the applicable data protection addendum and licensing terms.

Changes to this Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the latest revision. Material changes may be communicated via our website or email where appropriate.

Contact

For privacy questions or requests: info@expertpuffin.com

Expert Puffin Ltd · London HQ · United Kingdom

This Policy is provided for transparency and does not constitute legal advice. For formal contracts, please refer to your signed agreement and any Data Processing Addendum with Expert Puffin Ltd.