Who we are
PubSuite is run by Darwen Pub Co Ltd (trading as PubSuite), a company registered in England and Wales under company number 16420301, with its registered office at 253 Bolton Road, Darwen, England, BB3 2PG (“PubSuite”, “we”, “us”). For anything about your personal data, contact Jamie Evans at hello@pubsuite.app or write to the address above.
What this policy covers
This policy covers visitors to pubsuite.app and the people who sign up for and use PubSuite on behalf of a pub, bar or restaurant (“Venues”). It does not cover a Venue’s own guests and staff: for their data, the Venue is the controller and we are its processor. Each Venue publishes its own privacy notice for guests at its own address (for example yourvenue.pubsuite.app/privacy), linked from every booking form.
What we collect and why
How we handle data for Venues
When a Venue uses PubSuite we process its guests’ and staff’s data — bookings, marketing lists, rotas, clock-ins and HR records — only on its instructions, under our Data Processing Agreement, which forms part of our Terms and is available from hello@pubsuite.app. We don’t use that data for our own purposes, we don’t sell it, and we don’t use it to train AI.
Who we share data with
Twilio (text messages) is only used if we switch it on for a Venue, after telling the Venue first.
International transfers
Most of our providers are in the United States. Railway, Cloudflare, Resend, Anthropic and Automattic are certified under the UK Extension to the EU-US Data Privacy Framework, which the UK recognises as providing adequate protection. OpenAI’s transfers are covered by the International Data Transfer Addendum to the Standard Contractual Clauses. Our backups are encrypted before they leave our servers.
How long we keep it
- Account details: while your subscription is active, then 30 days so you can export your data, then deleted. Backup copies expire 35 days after that.
- Billing and accounting records: 6 years from the end of the financial year, as the law requires.
- Enquiries: 24 months after we last hear from you, unless you become a customer.
- Login sessions: until they expire (30 days for managers, up to 400 days since last use for staff).
- Website server logs: per WordPress.com’s short rolling retention.
Security
PubSuite uses HTTPS everywhere, hashes passwords with scrypt, keeps every Venue’s data separate, limits login attempts, encrypts backups with AES-256-GCM, and restricts sensitive staff information to managers and owners. More detail is available on request.
Cookies
The PubSuite app uses only strictly necessary cookies: a login session cookie and a short-lived cookie that shows a confirmation message after an action. There are no analytics, advertising or tracking cookies, so there’s no cookie banner. This website (pubsuite.app) may use WordPress.com’s own cookies to operate — see WordPress.com’s cookie policy.
Your rights
You have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Email hello@pubsuite.app; we’ll reply within one month. If you’re a guest or staff member of a Venue, contact that Venue — we’ll pass on anything sent to us.
Complaints
Please tell us first so we can try to put things right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes
We’ll update this policy when what we do changes, and change the date at the top. We’ll email Venues about significant changes.
253 Bolton Road, Darwen, England, BB3 2PG
