Privacy Policy for Restaurants & Staff

1. Who we are

• BidLX is a restaurant management platform owned and operated by BIDLX SOLUTIONS SDN. BHD., a private limited company registered in Malaysia ("BidLX", "we", "us").
• We are the controller of restaurant owners' account data, and the processor (Data Processor) of staff and customer data entered by the restaurant, under the Data Processing Agreement.
• Data Protection Officer: reachable at support@bidlx.com with the subject "Data Protection".

2. Allocation of responsibility

• The restaurant owner is the controller of the staff and customer data they enter, decides what is collected and why, and must inform those individuals and obtain their consent where the law requires.
• We process that data as a processor, under the restaurant's documented instructions in the Data Processing Agreement, and only to provide the service.
• We are the controller of the owner's account, subscription and billing data.

3. Data we process and its source

• Owner account data (provided by the owner): email, hashed password, manager name, phone number, and subscription and payment details.
• Restaurant data (provided by the restaurant): name, country, city, branches, logo, menu, prices, photos and tables, plus contact details and social accounts published in the directory.
• Operational data (generated by use of the system): orders, invoices, payments, shifts, expenses, receipt photos, inventory, purchasing and suppliers.
• Customer data (entered by the restaurant): name, phone, email, birthday, loyalty points, visit history, reservations and deposits.
• Staff data (entered by the restaurant or the employee): name, role, branch, phone, email, photo, ID document, join date and salary, plus attendance, shifts, requests, violations, evaluations and deductions.
• Staff location: read from the employee's device only at the moment of check-in and check-out to confirm presence within the branch area, and stored with the attendance record. We never track location at any other time. Employees may decline location permission, in which case mobile check-in may not be possible.
• Technical data: sign-in logs, IP address and device type, for security.
• Basic account and restaurant data is mandatory to create an account and run the service; without it the service cannot be provided. Other data is optional depending on the features the restaurant uses.

4. Purposes and legal basis

• Providing the service the restaurant subscribed to and running its account — performance of contract (Terms of Use).
• Managing subscriptions and billing and meeting accounting and tax obligations — contract and legal obligation.
• Protecting accounts, preventing fraud and abuse, and technical support — legitimate interest.
• Processing staff and customer data for the restaurant — the restaurant's instructions and the legal basis the restaurant relies on towards them (such as the employment contract or consent).
• Sending necessary service messages (account, subscription and security alerts). We send marketing messages to account holders only with their consent, and they can be stopped at any time.
• We may contact restaurants on their publicly listed business numbers and accounts to introduce our services — legitimate interest. Any restaurant can ask us to stop at any time by replying "stop" or contacting us, and we will stop contacting it.
• Subscription payments are made through Stripe: the restaurant owner enters card details directly on Stripe's payment page, and we neither see the full card number nor store it. We keep only the Stripe customer identifier and the subscription and invoice records. The payment page and subscription management page are governed by Stripe's privacy policy.
• Improving the system using aggregated figures that identify no restaurant or person.

5. Who has access to the data

• Within the restaurant: the owner sees all of the restaurant's data. Each management user (admin, branch manager, supervisor, cashier) sees only what their role allows, and only for their branch if one is assigned. Salaries are visible only to the owner and anyone granted salary permission. Regular employees see only their own data in the staff portal.
• BidLX team: accesses data only as necessary for support, security or legal compliance, under confidentiality.
• Technical service providers acting as sub-processors (see International transfers).
• Government or judicial authorities where we are legally required, limited to what is requested.
• In a merger, acquisition or sale of company assets, data may transfer to the new entity, which will be bound by this policy, and we will notify you.

6. Retention

• We keep restaurant, staff and customer data for as long as the account exists.
• When deletion of a restaurant is requested, we permanently delete its data within 30 days, and it is purged from backups within 90 days at most.
• We keep subscription and billing records for the period required by accounting and tax laws (up to 7 years in Malaysia), then delete them.
• The restaurant may delete any employee or customer record at any time, and remains responsible for retaining what labour laws in its country require.

7. Directory pages prepared from public information

• We may prepare a directory page for a restaurant before it registers with us, using only information it has published to the public: name, address, phone number, social media accounts, menu, prices and opening hours. This is business information, not personal data of individuals, and we process it based on our legitimate interest in helping customers find restaurants.
• The restaurant owner may claim the page, correct its information or have it removed entirely at any time by contacting support@bidlx.com; we carry out the request within three business days of verifying ownership.

8. Rights of staff and customers

Staff and customers exercise their rights over their data with the restaurant as controller. If they contact us directly at support@bidlx.com, we forward the request to the restaurant without delay and assist it in fulfilling the request.

9. Your rights

• Right to be informed: to know what we collect about you and why, as set out in this policy.
• Right of access and to obtain a copy of your data.
• Right to correct or update inaccurate or incomplete data.
• Right to request deletion or destruction of your data once it is no longer needed, unless the law requires us to keep it.
• Right to data portability: to receive your data in a structured, commonly used format, or have it transmitted to another party where technically feasible.
• Right to withdraw consent at any time where processing is based on consent, without affecting prior processing.
• Right to object to or restrict processing, and to prevent processing for direct marketing.
• We respond within the statutory periods: 21 days under Malaysian law and 30 days under Saudi law, and may verify your identity first. Requests are free; we may decline repetitive or manifestly unreasonable requests where the law allows.

10. Complaints to the regulator

Please contact us first at support@bidlx.com so we can resolve any concern. You may in any case lodge a complaint with the competent regulator: the Personal Data Protection Commissioner of Malaysia (JPDP), the Saudi Data & AI Authority (SDAIA) if you are in Saudi Arabia, or the competent authority in your country.

11. International transfers

• We host the service with technical providers whose servers may be located outside Malaysia, Saudi Arabia or your country. We transfer data only to parties offering an adequate level of protection, under binding contractual safeguards, and only as necessary to provide the service, in compliance with the transfer requirements of Malaysian law, the Saudi PDPL and its regulation on transferring data outside the Kingdom.
• Our main providers are currently Supabase Inc. (database, authentication and file storage), Vercel Inc. (website hosting) and Stripe (payment processing for restaurant subscriptions). We update this list when it changes.

12. Security and breach notification

• We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure, including encryption in transit, irreversible password hashing, isolating each restaurant's data through database security rules, limiting each user to their permissions, and restricting our staff's access to what each task requires.
• No system is absolutely secure. If a breach likely to cause harm occurs, we notify the competent regulator within 72 hours of becoming aware of it and notify affected individuals without undue delay where the law requires, explaining what happened, the measures taken and what they can do to protect themselves.

13. Children

BidLX account services (restaurants, staff and jobs) are intended for people aged 18 or over. We do not knowingly collect personal data from anyone younger, and will delete it if we become aware of it.

14. No sale of data, no automated decisions

We do not sell, rent or share personal data with advertisers, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

15. Changes to this document

We may update this document as our services evolve or laws change, and show the last-updated date at the top of the page. For material changes we notify account holders by email or in the system a reasonable time before they take effect, and ask for fresh consent where the law requires.

16. Language

This document is available in Arabic and English. In case of any difference in interpretation the English version prevails, unless a mandatory law requires otherwise.

17. Contact us

BIDLX SOLUTIONS SDN. BHD. — Email: support@bidlx.com, for any question or request about your data or this document.