This Privacy Policy explains how Hangar, trading as “Hangar” (“Hangar”, “we”, “us”, “our”), collects, uses and protects personal data when you visit sidehangar.com, sign up for a trial or subscription, or use the Hangar POS app and web back office (the “Service”). It should be read alongside our Terms & Conditions.
In short: we collect only what we need to run Hangar, we never sell your personal data, card payments for your subscription are handled by Paddle (we never see or store full card numbers), and you can export or delete your data.
1. Who is responsible for your data
Hangar (registered at Ataturk pr. 232, Baku, Azerbaijan) is the data controller for personal data about our customers, website visitors and prospective customers described in this policy.
For personal data that restaurants enter into Hangar about their own staff and guests (see section 2.2), the restaurant is the controller and Hangar acts as a data processor, processing that data only on the restaurant’s instructions.
2. The data we collect
2.1 Account and contact information
When you start a trial, subscribe or contact us, we collect information such as your name, business name, email address, phone number, business address, number of locations, login credentials and your communications with us (for example, support requests).
2.2 Restaurant business data (we act as processor)
When you use the Service, you and your staff enter business data such as menus, prices, orders and sales, inventory, floor plans, reservations, staff names, roles, PINs, shifts and time-clock records, and guest details (for example, names or phone numbers for reservations and online orders). You own this data. We process it only to provide the Service to you, under our Terms & Conditions and your instructions.
2.3 Billing information
Subscription payments are handled by Paddle.com Market Ltd, our Merchant of Record. Paddle collects your payment card or other payment details, billing address and tax information directly. We do not receive or store your full card numbers. Paddle shares limited information with us, such as your name, email, country, plan, transaction history and the last four digits and expiry of your card, so we can manage your subscription. Paddle’s use of your data is governed by its own privacy notice, available at paddle.com/legal/privacy.
Hangar does not process card payments made by your guests; those are handled by your own card payment provider.
2.4 Website and app usage data
When you visit our website or use the Service, we automatically collect technical information such as IP address, browser and device type, operating system, app version, pages viewed, log data, error reports and approximate location derived from your IP address.
3. How we use your data and our legal bases
Under the EU General Data Protection Regulation (GDPR) and the UK GDPR, we must have a legal basis for processing personal data. We use your data as follows:
- To provide the Service – creating and managing your account, delivering the software, syncing your devices, providing support and processing data you enter. Legal basis: performance of a contract.
- To manage billing and subscriptions – working with Paddle to take payments, handle renewals, upgrades, cancellations and refunds. Legal basis: performance of a contract.
- To send service communications – trial and renewal reminders, receipts, security alerts, notices of changes to our terms or prices. Legal basis: performance of a contract and legitimate interests.
- To keep the Service secure and reliable – monitoring, preventing fraud and abuse, debugging and backups. Legal basis: legitimate interests.
- To improve the Service – understanding how features are used, using aggregated and de-identified data where possible. Legal basis: legitimate interests.
- To send marketing emails about Hangar products and features. Legal basis: consent, or legitimate interests for existing business customers where permitted by law. You can unsubscribe at any time using the link in each email.
- To comply with the law – for example, keeping tax and accounting records and responding to lawful requests. Legal basis: legal obligation.
We do not sell your personal data, and we do not use restaurant business data for advertising.
4. Who we share data with
We share personal data only with trusted service providers (sub-processors) who help us run Hangar, under written contracts that require them to protect it and use it only on our instructions. The categories are:
- Payments and billing: Paddle.com Market Ltd, our Merchant of Record and reseller, which handles checkout, payments, invoicing, tax and refunds.
- Cloud hosting and infrastructure: providers that host our servers, databases and backups.
- Email and communications: providers that send transactional and marketing emails and power our support tools.
- Analytics and error monitoring: providers that help us understand service performance and fix bugs.
We may also share data with professional advisers (such as lawyers and accountants), with authorities where required by law, or with a buyer or successor if our business is involved in a merger, acquisition or sale of assets. If you connect Third-Party Services (such as a card terminal or accounting integration), we share data with them at your direction. A current list of sub-processors is available on request from [email protected].
5. International transfers
Our service providers may process data in countries outside your own, including outside the UK and the European Economic Area. Where we transfer personal data internationally, we use appropriate safeguards required by law, such as adequacy decisions, the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.
6. How long we keep data
- Account data is kept for as long as you have an account, and for a reasonable period afterwards to handle any questions or claims.
- Restaurant business data can be exported to CSV at any time and for 30 days after your subscription ends. After that, it is deleted from our active systems, and from backups within our normal backup cycle, except where retention is legally required.
- Billing and transaction records are kept for as long as required by tax and accounting laws (typically up to 7 years).
- Website usage and log data is kept for a limited period, normally no longer than 13 months.
7. Security
We use technical and organisational measures appropriate to the risk to protect personal data, including encryption in transit (TLS) and at rest, access controls and least-privilege access for our staff, regular backups, and monitoring for suspicious activity. No system is completely secure, so please use a strong password, keep staff PINs private and tell us immediately if you suspect unauthorised access to your account.
8. Your rights
8.1 UK and EU residents (UK GDPR / GDPR)
Depending on your location, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing, including objecting to direct marketing at any time;
- receive your data in a portable format; and
- withdraw consent at any time, where we rely on consent.
You also have the right to complain to a data protection authority, such as the Information Commissioner’s Office (ICO) in the UK or your local supervisory authority in the EU. We’d appreciate the chance to address your concerns first.
8.2 California residents (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect, use and disclose; to request deletion or correction of your personal information; and not to be discriminated against for exercising your rights. We do not sell or share personal information for cross-context behavioural advertising, as those terms are defined under California law.
8.3 How to exercise your rights
Email [email protected]. We may need to verify your identity before acting on your request, and we will respond within the time required by law (usually one month). If your request relates to restaurant business data held by a Hangar customer (for example, you are a guest or employee of a restaurant), please contact that restaurant directly; we will assist them in responding.
9. Cookies
By default, our website and the Service use only essential cookies and similar technologies that are strictly necessary to make them work, such as keeping you signed in, remembering your preferences and protecting against fraud. These do not require consent.
We will only use non-essential cookies, such as analytics or marketing cookies, if you consent to them, and you can change your choice at any time. Paddle may set its own cookies during checkout to process your payment securely and prevent fraud. You can also control cookies through your browser settings, although blocking essential cookies may stop parts of the site from working.
10. Children
Hangar is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and change the “Last updated” date. If we make material changes, we will notify you by email or through the Service before they take effect.
12. Contact us
If you have questions about this policy or how we handle your data, please contact:
Hangar (trading as Hangar)
Address: Ataturk pr. 232, Baku, Azerbaijan
Email: [email protected]