Data Request

What you can ask for

This page explains how to use your privacy rights with SOHOON Technologies, trading as Restaurant POS Studio. Depending on where you live, you can ask us to:

• Access. Tell you whether we hold personal information about you, what it is, where it came from, why we use it and who receives it, and give you a copy.
• Portability. Give you a copy in a common format, such as a spreadsheet, that you can take elsewhere.
• Correction. Fix information that is wrong or incomplete.
• Deletion. Delete personal information about you.
• Opt out of marketing. Stop marketing emails, SMS and WhatsApp messages.
• Opt out of sale, sharing or targeted advertising. We do not sell personal information or share it for cross-context behavioral advertising, but you can still send this request and we will record it.
• Withdraw consent. For example, consent to Google Analytics on our website. You can also do this from the cookie settings link in the footer.
• Restrict or object. In some cases, ask us to limit or stop using your information.

These rights come from laws such as the California Consumer Privacy Act as amended by the CPRA, the privacy laws of other US states such as Virginia, Colorado, Connecticut and Texas, and the UAE’s Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. In Pakistan, where a national data protection law is not yet in force, we offer the same access, correction and deletion options as a matter of policy.

First, check who holds your data

There are two kinds of data, and the right place to send your request depends on which one it is.

Data we hold for our own business. This includes what you sent through our contact or demo form, your trial or customer account, billing records, and website analytics after consent. Send these requests to us.

Data a restaurant holds in our POS. If you are a diner, guest or employee of a restaurant that uses Restaurant POS Studio, the restaurant controls that data. Examples are your order history, loyalty points, booking details or staff records. Please send your request to the restaurant. We process that data on the restaurant’s behalf, and we will help the restaurant answer you. If you contact us by mistake, we will tell you and, where we can, pass your request to the restaurant.

Restaurant owners can export their own products, customers and sales from the POS at any time, and can correct or delete customer records inside the service.

How to make a request

Contact us through the form on our contact page, or use the “Show email” button on that page. In your message, please include:

1. your full name;
2. the email address or phone number you used with us, so we can find your records;
3. your country, and your state if you are in the United States;
4. which right you want to use (for example, access or deletion);
5. any detail that helps, such as the restaurant name you entered on our form.

Do not send copies of identity documents, card numbers or passwords in your first message. If we need more to verify you, we will ask and tell you why.

How we verify your identity

We must make sure we give data only to the right person. We verify requests in proportion to the risk.

• Lower-risk requests, such as opting out of marketing, need little or no verification.
• Access and deletion requests usually need us to match at least two pieces of information you give us with what we hold, for example your email address and phone number. We may send a code or link to the email or phone in our records and ask you to confirm.
• Requests for specific pieces of data, or for sensitive records, may need a higher level of verification, such as matching three pieces of information.

If you have an account with us, we may ask you to make the request while logged in. We use the information you give us for verification only to verify you and to keep a record of the request.

If we cannot verify you, we will tell you and explain why. For a deletion request we cannot verify, we will still treat it as a request to stop marketing.

Authorized agents

You can ask someone else, such as a family member or a privacy service, to make a request for you. The agent must give us:

• written permission signed by you, or a valid power of attorney; and
• enough information for us to verify your identity.

We may also contact you directly to confirm that you gave the agent permission. We may refuse a request from an agent who cannot show they are authorized.

How long we take to respond

We confirm that we received your request within 10 business days.

• California. We respond within 45 days of receipt. If we need more time, we may extend once by up to another 45 days, and we will tell you why within the first 45 days.
• Other US states. We respond within 45 days, with one extension of up to 45 days where the law allows.
• UAE and other places where a deadline applies. We respond within 30 days, unless the law allows a longer period and we tell you why.
• Opt-out of marketing. We act as quickly as we can, and within 10 business days at the latest. Messages already scheduled may still arrive for a short time.

Requests are free. We may charge a reasonable fee, or refuse, only if requests are clearly unfounded or excessive, for example the same request many times in a short period. We will explain if this happens.

What happens after we act

• Access. We send your information in a readable format, usually a spreadsheet or PDF, through a secure method.
• Correction. We update our records and tell you what changed.
• Deletion. We delete your information from our active systems and CRM. Copies in daily backups are overwritten in the normal backup cycle. We will also ask our service providers to delete it.

Sometimes we must keep certain information, for example invoices and tax records the law requires, records needed to complete a contract you asked for, or a short note that you asked us to stop contacting you, so we do not contact you again. If we keep anything, we will tell you what and why.

If we refuse, you can appeal

If we decline all or part of your request, we will explain the reason. You can appeal by replying to our decision through the contact form with the word “Appeal” in your message. A different team member will review the decision. We respond to appeals within 45 days for US residents and within 30 days elsewhere where required, and explain the result in writing.

If you are still not satisfied, you may contact the privacy regulator where you live. For example, residents of some US states can contact their state attorney general, and UAE residents can contact the UAE Data Office.

We will not treat you differently

Using your privacy rights will not change the price, quality or service you get from us. We will not deny service or charge a different price because you made a request.

Keeping a record

We keep a record of each request and our response for at least 24 months, as required by law, so we can show how we handled it. This record does not include more personal information than we need.

Our privacy policy has more detail about what we collect and why, and our cookie policy lists every item we store in your browser.