Privacy Policy

The data controller is Avalia, operating in Pakistan. Contact: privacy@getavalia.com

• Account data: name, email, encrypted password, role and linked restaurant.
• Restaurant data: trade name, tax ID, address, phone.
• Restaurant customer data: name, phone, email, order history (processed on behalf of the restaurant).
• Reservation data: name, phone, email, confirmation code.
• Working hours data: staff clock-in/out records.
• Usage data: platform actions, access logs, IP address.

• Account data: for the duration of the contract, plus the period required by law.
• Working-hours and payroll records: for the period required by applicable law.
• Invoices and tax data: for the period required by applicable tax law.

Your data is processed on secure cloud servers. We do not share it with third parties except where required by law, or where necessary to provide the service through hosting and infrastructure providers acting on our instructions.

You may exercise the following rights by emailing privacy@getavalia.com:

• Access — know what data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your data.
• Portability — receive your data in a structured format.
• Objection — object to processing based on legitimate interests.
• Restriction — request processing be restricted.

If you believe your data is not being handled lawfully, please contact us first so we can put it right. You may also raise the matter with the competent data protection authority in Pakistan.

We apply HTTPS/TLS encryption, hashed passwords, role-based access control, change auditing and periodic backups.

Privacy enquiries: privacy@getavalia.com