This policy applies to Tavzio FZC ("Tavzio", "we", "us"), a hospitality technology platform providing NFC/QR-powered guest experience, ordering, and payment software to hospitality businesses - restaurants, cafes, hotels, and similar venues - ("Businesses") in the United Arab Emirates.

It covers two different relationships: our own visitors and prospective clients on this website, and the guests of the Businesses that use Tavzio (where we act as a data processor on that Business's behalf, not as the data controller).

From website visitors: name, email, phone number, business details, and any message you send us through our "Get Started" or "Contact us" forms.

From Business accounts and staff: name, email, role, and activity within the platform (orders processed, settings changed) needed to operate the service and maintain a security audit trail.

From guests of a Business (processed on that Business's behalf): order and payment details, loyalty/reservation information where enabled, and NFC tap events used to route a guest to the correct menu or portal. We do not sell this data, and a Business's guest data is never shared with or visible to any other Business on the platform.

To operate the platform: process orders and payments, generate receipts, run loyalty programs, and provide the dashboards Businesses use to manage their operations.

To respond to inquiries submitted through this website and, where you've asked us to, follow up about pricing or onboarding.

To maintain security: detecting and preventing fraud, unauthorized access, and abuse of the platform.

We do not use guest or Business data to train external AI models, and we do not sell personal data to third parties.

Tavzio processes personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL").

For a Business's guest and customer data, Tavzio acts as a data processor and the Business acts as the data controller, as set out in the Data Processing Addendum incorporated into every Tavzio service agreement. Where you're a guest of a Business using Tavzio, your rights regarding that data are primarily exercised through that Business - we assist them in responding to such requests.

Subprocessors necessary to run the platform: cloud hosting and database providers; payment gateway providers used to process transactions; SMS/OTP verification providers used to verify phone numbers; transactional email providers used to send account, order, and billing notifications; AI-assisted content-processing providers used to help structure content a Business itself uploads (such as extracting a menu from a photo or PDF); and translation service providers used to auto-translate content into a guest's or visitor's selected language. Each is bound by confidentiality and security obligations consistent with this policy.

We do not share personal data with third parties for their own marketing purposes.

We may disclose information where required by UAE law or a valid legal process.

Sensitive credentials (such as payment gateway API keys) are encrypted at rest. Every Business's data is isolated from every other Business's data at the database level, enforced independently of application code.

Administrative access to the platform requires authentication, and we maintain an audit trail of significant account and data changes.

No system is perfectly secure. If we become aware of a data breach affecting your personal data, we will notify affected Businesses without undue delay, consistent with our contractual and legal obligations.

We retain personal data for as long as needed to provide the service and for legitimate business purposes such as legal compliance, dispute resolution, and enforcing our agreements.

When a Business's agreement with Tavzio ends, we delete or return that Business's data at their election, subject to any legal retention requirements that apply.

Depending on your relationship to Tavzio, you may have the right to access, correct, or request deletion of your personal data, and to object to certain processing, under UAE PDPL.

If you're a guest of a Business using Tavzio, please contact that Business directly, as they control the data and are best placed to action your request. If you're a website visitor or a Business account holder, contact us directly using the details below.

This website uses only the cookies and local storage necessary for it to function - for example, keeping you signed in to your dashboard, or remembering your demo session on our public demo page. We do not use third-party advertising or tracking cookies.

We may update this policy from time to time to reflect changes in our practices or legal requirements. We'll update the "Last updated" date below when we do; where a change is material, we'll take reasonable steps to notify affected Businesses.

For questions about this policy or to exercise a data subject right, contact Tavzio at the email address provided in your service agreement, or through the "Contact us" form on our homepage.

Legal name: Tavzio (FZC). License type: Free Zone Company, Services. License No.: 11795, issued by the Sharjah Research Technology and Innovation Park (SRTIP) Free Zone Authority, Government of Sharjah, United Arab Emirates.

Registered address: SRTIP, Block B - B59-057, Sharjah, United Arab Emirates.