How personal data is collected and processed on the Heselo platform, and what rights apply.

Signing in to or using the System counts as acceptance of this Privacy policy.

1. Who it covers and roles

This policy applies to the venue owner, director, admin, reception, waiters, and other staff accounts.
The Customer (venue) is primarily responsible for guest / customer data entered in the System: what is recorded and who can see it.
Heselo processes that data to provide the Service; ownership belongs to the Customer under the Service agreement.
For Heselo accounts (email, name, password hash, sign-in session), Heselo processes data in its own right.
If there is a conflict: commercial matters — Service agreement; usage behaviour — Terms of use; personal data — this policy.

2. What data is processed

The System may typically hold the following (if a field is empty, that data is not present):

venue name, city, address, timezone;
director and contact email;
billing identity details provided by the Customer (e.g. tax ID / VOEN under the agreement).

When POS or card is selected, the System records only the payment method and amount; card details stay with the terminal / bank.

Processing is for performing the Service agreement and providing the System.
When entering guest data, the Customer must act on a lawful basis and for venue needs.
Security logs and sessions — to protect the service and prevent misuse.
When the law requires it — the corresponding legal basis.

Inside the venue — only staff with permissions (configured by the Customer).
Heselo’s trusted infrastructure providers (hosting, email, etc.) — only as needed.
Public authorities when required by law.
There is no access to other venues’ data or sale of lists between venues.
Heselo does not sell guest lists to third parties for advertising.

Data is kept while the subscription is active and the Service is provided.
After the agreement ends, Heselo may retain data for a limited time for technical and legal needs, then delete or anonymise it (except mandatory legal retention).
Sign-in sessions and OTP codes are short-lived.
Recommendation: regularly back up reports via Excel / export (Service agreement).

Passwords are stored as hashes; plain passwords are not disclosed.
Sensitive operations may use the venue protection code and staff permissions.
Logs mask passwords, tokens, OTPs, and similar fields.
No online system is 100% risk-free; report suspicious sign-ins to the director and Heselo when possible.

A guest / customer should address requests about their data first to the venue (Customer).
Requests about a staff account (email, name) can go through the director or Heselo support channels.
Possible requests: access, correction, deletion, or restriction of processing — within law and the agreement.
Deletion may affect operational and report integrity; some records may remain limited for legal retention.

The System uses a necessary cookie for the sign-in session (`refresh_token`).
This cookie renews sign-in; it is not for advertising tracking.
The browser may store technical data (session / language) only for the System to work.

The System is not aimed at children; the age field is for venue business needs, not deliberate child profiles.
Special categories (health, religion, biometrics, etc.) are not required and are not collected.

Hosting and infrastructure may be in Azerbaijan or other countries.
When transfers occur, Heselo aims to apply the same privacy and security principles.

Heselo may update this Privacy policy. The new text is published under System → Documents; material changes may also be emailed to the director.
Continued use after publication counts as acceptance.