GDPR

Data processing information

How responsibilities are divided when venues use UpSalt to handle reservations and guest relationships.

Last updated: 1 August 2026

Controller and processor roles

A hospitality venue is normally the controller of guest data entered into UpSalt. It decides why guest information is collected, what information is required and how long it is kept. UpSalt normally acts as its processor, following documented instructions. UpSalt is a controller for its own website, sales, account, security and corporate data.

Processing covered

Depending on the enabled features, processing may include collecting, recording, organising, hosting, retrieving, transmitting and deleting contact details, bookings, preferences, notes, message history, payment status and operational analytics. The purpose is to provide reservation, seating, guest-management, messaging, payment-support and reporting functionality.

UpSalt commitments

  • Process customer data only on documented instructions and for the contracted service.
  • Require confidentiality from people authorised to process it.
  • Maintain risk-appropriate technical and organisational security measures.
  • Support reasonable requests involving data-subject rights, incidents and compliance assessments.
  • Use subprocessors under written protections and provide appropriate transfer safeguards where required.
  • Delete or return customer data at the end of service, subject to law and agreed retention or backup cycles.

Venue responsibilities

Venues must have a valid legal basis, give guests transparent privacy information, configure appropriate retention, limit staff access, keep account details secure and ensure reservation forms do not request unnecessary sensitive information.

Data Processing Agreement

Business customers that require a GDPR Article 28 Data Processing Agreement or current subprocessor and security information can request it at info@upsalt.io. The signed DPA, not this summary page, governs processor obligations for a customer account.

Data rights and incidents

Guests should contact the venue about a reservation. UpSalt will assist the venue as required. Concerns relating to UpSalt’s own processing can be sent to info@upsalt.io. Suspected security incidents should be reported promptly to the same address.