Strict Tenant Isolation
Every restaurant, lounge, and bar operates in a logically isolated tenant boundary. Your menus, recipes, and sales are never exposed to other venues.
Zero PIN / Card Storage
M-Pesa STK Push prompts are authenticated directly on the diner's handset via Safaricom. We never see or store customer M-Pesa PINs or card CVVs.
Granular RBAC Controls
Role-Based Access Control and manager PIN authorizations restrict sensitive financial reports and customer records strictly to authorized personnel.
Self-Service Erasure
Diners can exercise their Right to Erasure anytime using our automated OTP-verified Loyalty & Personal Data Deletion portal.
1 Scope & Data Controller / Processor Roles
At Elite SamTech Solutions / SamTech Elite Solutions ("we", "us", "our", accessible via https://elitesamttech.co.ke and https://elitesamtech.co.ke), protecting your privacy is paramount. This Privacy Policy outlines how we collect, process, store, and safeguard personal and business information when you access or use RestoBar OS, including our cloud Point of Sale (POS), Kitchen Display System (KDS), Bar Order Tracker (BOT), Immutable Inventory Ledger, QR Table Self-Ordering menus, and Public Venue Storefronts (/r/<venue-slug>/).
• When We Act as a Data Controller: We act as the Data Controller for account registration details, subscription billing records, demo booking leads, and platform support communications collected directly from hospitality business owners and prospective clients.
• When We Act as a Data Processor: When a subscribed restaurant, lounge, bar, or hotel uses RestoBar OS to manage its staff profiles, table reservations, diner orders, and loyalty points, the hospitality venue is the Data Controller and SamTech Elite Solutions acts as the Data Processor operating under the venue's configured instructions.
2 Information We Collect
We collect personal identification information (Name, email address, phone number, etc.) and business details when you request a setup, book a live demo, subscribe to a plan, or interact with our system. Specifically, we process four categories of data:
2.1 Venue & Business Owner Data
Business/venue name, physical location/town, KRA Tax PIN, VAT registration number, owner/manager full name, official phone/WhatsApp number, billing email address, and subscription invoice history.
2.2 Staff & Operational Audit Data
Staff IDs, usernames, job titles, role assignments (Manager, Cashier, Waiter, Chef, Bartender, Storekeeper, Accountant), shift opening/blind cash declarations, item void approvals, and timestamped security audit logs.
2.3 Diner, Reservation & Loyalty Data
Guest name, mobile phone number (for M-Pesa STK payment prompts, SMS order notifications, table reservation confirmations, and loyalty points accrual), optional email address, dining table selection, and customer review ratings.
2.4 Device & Network Telemetry
IP address (used for rate-limiting and security audit trails), browser/device type, POS terminal register identifiers, and service worker cache state for offline local-network continuity.
3 How We Use Your Information
Your information is used exclusively to provide, secure, and maintain our hospitality platform, notify you about operational events, provide customer support, and improve RestoBar OS:
- Order & Kitchen Fulfillment: Routing dine-in, counter, and QR table orders to Kitchen Display Systems (KDS) and Bar Order Trackers (BOT) with real-time preparation telemetry.
- Inventory & Financial Integrity: Recording append-only recipe ingredient deductions, supplier purchase orders, stock transfers, blind cashier shift reconciliations, and consolidated nightly Z-reports.
- Transactional Notifications: Sending instant SMS/WhatsApp and email confirmations for demo bookings, staff password activation tokens, table reservations, order preparation updates, and fiscal receipts.
- Security & Fraud Prevention: Enforcing Role-Based Access Control (RBAC), detecting unauthorized discount or void attempts, and maintaining immutable audit logs for venue owners.
4 M-Pesa Express (STK Push) & Payment Data Privacy
When a cashier, waiter, or diner initiates an M-Pesa Express (STK Push) payment on RestoBar OS, only the customer's mobile phone number and invoice amount are transmitted over encrypted TLS channels to our payment gateway (Safaricom Daraja / FinAPI v2.4 Sovereign Engine).
RestoBar OS never collects, processes, or stores your M-Pesa PIN, credit/debit card numbers, or CVV security codes. All PIN entry occurs strictly on the customer's mobile SIM toolkit, and RestoBar OS only receives the resulting cryptographic transaction reference (e.g., M-Pesa receipt code, timestamp, and settlement status) for automated receipt generation and shift reconciliation.
5 Legal Basis for Processing (Kenya Data Protection Act, 2019 & GDPR)
We process personal data in strict compliance with the Kenya Data Protection Act, 2019 (regulated by the Office of the Data Protection Commissioner — ODPC) and international GDPR principles under the following lawful bases:
- Performance of a Contract: To deliver POS, KDS, inventory, and reservation services requested by venues and their guests.
- Statutory & Fiscal Obligations: To enable hospitality venues to maintain accurate tax, VAT, catering levy, and KRA eTIMS-ready accounting records.
- Legitimate Business Interests: To prevent internal cash/stock shrinkage, secure multi-tenant infrastructure, and ensure high system availability.
- Explicit Consent: When diners opt into loyalty rewards, submit public reviews, or when prospects schedule a live product demonstration.
6 Data Security & Multi-Tenant Safeguards
We implement robust technical and organizational security measures, including the latest role-based access controls and encrypted databases, to ensure your data is safe against unauthorized access, alteration, disclosure, or destruction:
7 Data Sharing & Trusted Sub-Processors
We never sell, rent, or trade your business data, menu performance metrics, or diner contact lists to third-party marketers or data brokers. Data is shared only with essential infrastructure sub-processors strictly required to operate the platform (such as Safaricom M-Pesa payment gateways, transactional SMS/WhatsApp dispatch providers, and secure cloud infrastructure hosts), each bound by strict confidentiality and data protection obligations.
8 Data Retention & Archival
We retain venue operational and financial records for as long as your subscription account remains active and as required by Kenyan tax and commercial accounting laws (typically up to 7 years for statutory fiscal invoices and ledger records). Diner loyalty records are retained until the diner or venue requests deletion.
9 Your Data Rights & Self-Service Account Deletion
Under the Kenya Data Protection Act, 2019, you have the right to request access to your personal data, correct inaccuracies, object to processing, request data portability, or request permanent erasure of your personal profile.
Want to Delete Your Diner Loyalty Profile & Anonymize Order Phone Records?
Diners can immediately erase their loyalty account and anonymize their phone number across past orders using our automated SMS OTP verification tool—no support ticket required.
10 Cookies, Local Storage & Offline PWA Caching
RestoBar OS uses strictly necessary session cookies, CSRF security tokens, and Progressive Web App (PWA) Service Worker caching so that POS registers, Kitchen Displays, and Bar stations continue operating smoothly even during temporary internet disruptions. We do not use intrusive third-party behavioral advertising cookies inside your POS workspace.
11 Contact Us & Data Protection Officer
If you have any questions about this Privacy Policy, data protection practices, or wish to exercise your statutory rights, please contact our team directly:
Ready to Secure Your Restaurant & Bar Operations?
Experience tamper-proof recipe inventory, blind cashier shift audits, and instant M-Pesa STK Push reconciliation. Launch your venue workspace in 60 seconds or book a tailored 1-on-1 live walkthrough.