Privacy policy

Privacy Policy
Airserve (Panagor Purchasing Ltd)**
Last updated: November 2025
‍
Airserve (“we”, “us”, “our”) is a hospitality management platform operated by Panagor Purchasing Ltd, a company registered in England and Wales. This Privacy Policy explains how we collect, use, store, and protect your personal information across all Airserve products and services, including:
• Airserve Shifts (mobile app for staff rotas, hours, pay, notifications)
• Airserve Hub (web platform for venues and managers)
• Airserve Core, Flow, POS, Budgets, Compliance, Ordering, Events, P&L and related modules
• Any future apps, websites, or tools provided under the Airserve brand.
‍
We are committed to protecting your data and being transparent about how it is used.
‍
⸻
‍
1. Who We Are
Panagor Purchasing LtdRegistered Address: 10 Cliff Parade, Wakefield, WF 12TACompany Number: 10964045Data Protection Contact: privacy@tryairserve.com
Panagor Purchasing Ltd is the Data Controller for all Airserve-branded products and services.
‍
⸻
‍
2. What This Policy Covers
This Privacy Policy applies to:
• The Airserve website
• The Airserve Hub web platform
• The Airserve Shifts mobile app
• All Airserve modules (Rotas, POS, Ordering, Budgets, Compliance, etc.)
• Integrations used to power Airserve (e.g., EPOS, payment systems, suppliers)
• API services, notifications, and integrations provided by Airserve
‍
It applies to both:
• Venue owners/managers (employers)
• Staff members (employees/workers) using Airserve Shifts
‍
⸻
‍
3. Information We Collect
A. Information you provide directly
• Name
• Email address
• Phone number
• Password (encrypted; never stored in plain text)
• Job role • Venue/organisational details
• Shift preferences, availability, and working hours
• Information submitted via the app or web platform (e.g., timesheets, rota entries, notes, photos) • Payroll-related inputs provided by your employer
‍
B. Information collected automatically
• Device information (model, OS version, unique identifiers)
• IP address
• Browser type
• Access times
• Usage data (pages viewed, screens, taps, interactions)
• Crash reports and diagnostics (via Supabase, Apple, and Google)
‍
C. Information from third parties and integrations
We may receive data from:
• Your employer/venue (e.g., staff data, rota details, payroll inputs)
• EPOS systems
• Payment providers
• Supplier systems
• Analytics and hosting partners
• Authentication services
‍
⸻
‍
4. How We Use Your Information
We use your data to:
• Provide, operate, and maintain the Airserve platform
• Manage shifts, rotas, hours worked, pay forecasts, and attendance
• Authenticate users and manage access
• Display financial and operational data for authorised users
• Power POS, ordering, events, budgeting, and compliance tools
• Send notifications related to shifts, approvals, reminders, and updates
• Enable venue-to-supplier ordering and contract tracking
• Improve the platform and develop new features
• Protect security and prevent misuse
• Provide customer support
• Comply with legal obligations
‍
We never sell your data.
‍
⸻
‍
5. Legal Basis for Processing (UK GDPR)
We process data on the following bases:
• Performance of a contract delivering the Airserve service
• Legitimate interests, operating and improving our platform
• Consent  for optional features such as notifications
• Legal obligation  where required (e.g., employment laws, financial records)
‍
⸻
‍
6. Employer vs Staff Responsibilities
Airserve is used by hospitality venues to manage staff and business operations.
• Employers act as Data Controllers for staff data they enter into the system (e.g. rota scheduling, payroll inputs).
• Airserve/Panagor Purchasing Ltd acts as the Data Processor in these scenarios.
This means:
• Employers are responsible for ensuring lawful grounds for collecting staff data.
• We process staff data strictly under instructions from the employer and in line with this policy.
‍
⸻
‍
7. Sharing Your Information
We may share data with:
• Your employer/venue (for rota, scheduling, and operational purposes)
• Service providers who support the platform including:
• Supabase (hosting, authentication, notifications)
• Analytics and logging services
• Cloud hosting providers (EU/UK data centres when possible)
• Integrated partners where authorised by your employer:
• EPOS systems
• Payment systems
• Supplier ordering systems
• Regulatory authorities where required
• Professional advisors (legal, auditing, compliance)
‍
We never share your information for marketing by third parties.
‍
⸻
‍
8. International Data Transfers
Some service providers may process data outside the UK.Where this occurs, we ensure:
• UK adequacy decisions
• Standard Contractual Clauses (SCCs)
• Additional technical safeguards
• Encrypted data transfers
‍
⸻
‍
9. Data Security
We use industry-leading security measures:
• Encrypted data transmission (HTTPS/TLS)
• Encrypted databases and backups
• Password hashing • Strict role-based access controls
• Multi-factor authentication (where supported)
• Regular auditing and security reviews
‍
While no system is entirely risk-free, we continuously work to protect your information.
‍
⸻
‍
10. Data Retention
We retain data only as long as necessary for:
• Providing the Airserve service
• Employment/payroll needs
• Legal requirements
• Financial record-keeping
• Security and auditing needs
‍
Data is securely deleted when no longer required.
‍
⸻
‍
11. Your Rights (UK GDPR)
You have the right to:
• Access your personal data
• Correct inaccurate information
• Request deletion
• Restrict or object to processing
• Request data portability
• Withdraw consent for optional features
• Complain to the Information Commissioner’s Office (ICO)
‍
To exercise your rights, email: privacy@tryairserve.com
‍
⸻
‍
12. Cookies and Tracking Technologies
The Airserve Hub uses cookies for:
• Authentication
• Security
• Analytics
• User experience
‍
You can manage cookie settings via your browser.
The Airserve Shifts mobile app does not use cookies but may use device identifiers for analytics and notifications.
‍
⸻
‍
13. AI Features (Present and Future)
Where Airserve uses AI to provide forecasting, insights, or automation:
• Only data necessary for the task is processed
• Data is anonymised or minimised when possible
• Models do not use your data to train publicly available AI systems
• All processing is done under strict security and governance controls
‍
⸻
‍
14. Children’s Privacy
Airserve is not intended for children under 16.
We do not knowingly collect data from anyone under this age.
‍
⸻
‍
15. Changes to This Policy
We may update this Privacy Policy periodically. Changes will be posted with an updated “Last updated” date.
‍
⸻
16. Contact Us
If you have questions about this Privacy Policy or how we handle your data, contact:
Data Protection OfficerPanagor Purchasing LtdEmail: privacy@tryairserve.com