Privacy Policy

Vicsus Global (“Vicsus Global”, “we”, “us”, or “our”) provides a cloud-based restaurant operations platform covering staff scheduling, attendance tracking, payroll, sales, and expense management (the “Service”). This Privacy Policy explains what personal data we collect, how and why we use it, who we share it with, and the rights available to individuals whose data we process. This Policy applies to our website, mobile and web applications, and related services.

Depending on how you interact with us, we may collect the following categories of personal data:

Customer account contacts (business owners/administrators):

• Name, job title, business name, email address, phone number, and business address;
• Billing details necessary to process subscription payments;
• Account activity, such as login history and support requests.

Employees of Customer businesses (End Users of the Service):

• Name, contact details, and job role/position;
• Work schedules, shift assignments, and attendance records, which may include clock-in/clock-out timestamps and, where enabled by the Customer, device or approximate location data used to verify attendance at a work site;
• Payroll-related information such as hourly rates, hours worked, and payslip data, to the extent the Customer uses our payroll module;
• Sales and expense entries recorded by staff in the course of their duties (this data generally relates to business transactions rather than the individual, but may include the identity of the staff member who recorded it).

Website and technical data:

• IP address, browser type, device information, and pages visited on our website or within the application, collected via cookies and similar technologies (see Section 5).

Where we collect personal data directly from a Customer to set up and administer their subscription (for example, billing contact details), we act as the data controller for that data.

Where a Customer submits personal data about its own employees into the Service (for example, schedules, attendance, or payroll data), the Customer is the data controller of that data, and Vicsus Global acts as a data processor, processing such data only on the Customer's documented instructions and for the purpose of providing the Service.

We use personal data for the following purposes and on the following legal bases (where Data Protection Laws such as the UK/EU GDPR apply):

• To create and administer Customer accounts and provide the Service — necessary for performance of our contract with the Customer.
• To process subscription payments and issue invoices — necessary for performance of our contract and to comply with legal/accounting obligations.
• To provide customer support and respond to enquiries — necessary for performance of our contract and our legitimate interest in supporting our customers.
• To operate scheduling, attendance, payroll, sales, and expense features within the Service on behalf of Customers — necessary for performance of our contract with the Customer (as processor, on the Customer's instructions).
• To maintain, secure, and improve the Service, including troubleshooting and system monitoring — necessary for our legitimate interests in operating a secure and reliable Service.
• To send administrative communications (e.g. service updates, security notices) — necessary for performance of our contract.
• To send marketing communications about new features or offers, where you have opted in or as otherwise permitted by law — based on consent or legitimate interests, and you may opt out at any time.

Our website and application use cookies and similar technologies to keep you securely signed in, remember your preferences, and understand how our Service is used so that we can improve it. These generally fall into the following categories:

• Strictly necessary cookies — required for login, session management, and core security functions.
• Functionality cookies — remember your preferences, such as language or display settings.
• Analytics cookies — help us understand usage patterns so we can improve the Service. Where required by law, we will ask for your consent before setting non-essential cookies.

You can control or disable cookies through your browser settings; however, disabling strictly necessary cookies may prevent parts of the Service from working correctly.

We do not sell personal data. We may share personal data with:

• Sub-processors and service providers who help us deliver the Service, such as cloud hosting providers, payment processors, email delivery services, and customer support tools, each bound by appropriate confidentiality and data protection obligations;
• Professional advisors (e.g. lawyers, accountants) where necessary for our legitimate business purposes;
• Law enforcement or regulators where required by applicable law, court order, or governmental request; and
• A successor entity in the event of a merger, acquisition, or sale of assets, subject to appropriate safeguards for personal data.

As we are based in Pakistan and serve customers in the United Kingdom, United States, and other jurisdictions, personal data may be transferred to, stored in, or accessed from countries other than the country in which it was originally collected, including Pakistan and the country where our hosting providers operate. Where such transfers involve personal data protected under the UK or EU GDPR, we take steps to ensure an appropriate level of protection, such as using recognised contractual safeguards with our service providers.

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction, including access controls, encryption of data in transit, and restricting access to personal data to personnel who need it to perform their duties. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain personal data for as long as necessary to provide the Service, comply with our legal and accounting obligations, resolve disputes, and enforce our agreements. Where a Customer's subscription ends, we will retain Customer Data for a reasonable period to allow for data export, after which it will be deleted or anonymised in accordance with our internal retention practices, unless a longer retention period is required by law.

Subject to applicable Data Protection Laws, you may have the right to: request access to your personal data; request correction of inaccurate data; request deletion of your data; object to or request restriction of certain processing; request a portable copy of data you provided to us; and withdraw consent where processing is based on consent.

If you are an employee of one of our Customers and your data is processed within the Service, you should generally direct such requests to your employer (the data controller) in the first instance; we will assist our Customers in responding to such requests in accordance with our agreements with them. Otherwise, you may contact us directly using the details in Section 13.

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated Policy with a revised “Last updated” date, and where changes are material, we will provide additional notice (such as an email or in-app notification).

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of personal data, please contact us at info@vicsusglobal.com.