TABLEFLOW PRIVACY POLICY

1. Purpose of this Policy

This Privacy Policy explains how TableFlow collects, uses, stores, and protects users’ personal data.

This Policy applies to:

• Visitors to the TableFlow website;
• Restaurant representatives and administrators;
• Guests who make Reservations through the Platform;
• Persons who contact the TableFlow support team.

2. Who Is Responsible for Data Processing

TableFlow may act in different capacities depending on the circumstances.

Restaurant account and TableFlow service data

The controller responsible for processing data relating to Restaurant administrator accounts, commercial relationships, invoices, support, and Platform security is:

Company: Kovzy LLC

Identification number: 405416526

Email: alex@kovzy.com

Guest Reservation data

When a Guest makes a Reservation at a specific Restaurant, that Restaurant generally determines the purposes and means of processing.

In that case:

• The Restaurant acts as the data controller;
• TableFlow performs technical processing on the Restaurant’s instructions and may act as a data processor.

The Restaurant is responsible for using Guest data lawfully and providing the required information.

3. Data We Collect

Guest Reservation data

Reservation data may include:

• First and last name;
• Telephone number;
• Email address;
• Reservation date and time;
• Number of Guests;
• Selected Restaurant or branch;
• Dining room, space, or table category;
• Reservation status;
• Comments or special requests submitted by the Guest;
• Time of creation, modification, or cancellation of the Reservation.

Guests should not include excessive or particularly sensitive information in the comments field unless it is necessary to receive the service.

Restaurant representative data

This may include:

• First and last name;
• Position;
• Business telephone number;
• Email address;
• Restaurant name and address;
• Authentication data;
• Account activity history;
• Service plan and payment information;
• Correspondence with TableFlow support.

Technical data

Technical data may be processed automatically when the website or Platform is used, including:

• IP address;
• Device type;
• Operating system;
• Browser type;
• Language settings;
• Login time;
• Pages and features used;
• System logs and error information;
• Security-related events;
• Cookies and similar technologies.

4. Purposes of Processing

Data may be processed for the following purposes:

• Creating a Reservation and forwarding it to the relevant Restaurant;
• Confirming, changing, or cancelling a Reservation;
• Contacting a Guest regarding a Reservation;
• Managing Restaurant administrative accounts;
• Displaying availability and Reservations;
• Providing customer support;
• Administering service fees;
• Ensuring Platform security;
• Detecting fraudulent or unauthorized activity;
• Resolving technical errors;
• Improving Platform functionality and user experience;
• Complying with legal obligations;
• Establishing, exercising, or defending legal claims.

5. Legal Bases for Processing

Depending on the circumstances, data may be processed:

• To perform a contract with the user or Restaurant;
• To take steps requested by the user before entering into a contract;
• To comply with a legal obligation;
• To protect the legitimate interests of TableFlow or the Restaurant;
• On the basis of the user’s consent;
• To establish, exercise, or defend a legal claim.

Where processing is based on consent, the user may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Whether Providing Data Is Mandatory

To create a Reservation, the user must provide the data marked as mandatory in the relevant form.

Failure to provide required information may prevent:

• Completion of a Reservation;
• Confirmation of a Reservation;
• Contact with the Guest;
• Creation of a Restaurant account;
• Provision of a specific service.

7. Data Sharing

Personal data may be shared with:

• The Restaurant at which the Guest makes a Reservation;
• Authorized TableFlow employees;
• Hosting and cloud infrastructure providers;
• Email and notification service providers;
• Technical support and security providers;
• Public authorities or law-enforcement bodies where required by law;
• A purchaser or legal successor in the event of reorganization, merger, or asset transfer, subject to legal safeguards.

TableFlow does not sell users’ personal data.

8. Data Retention

Personal data is retained only for as long as necessary for the relevant purpose.

Indicative retention periods:

• Active Reservation data — until completion of the Reservation and for a reasonable period thereafter determined by the Restaurant;
• Reservation history — 12 months, unless longer retention is necessary;
• Restaurant account data — for the duration of the agreement;
• Contractual and financial documents — for the period required by law;
• Support correspondence — 12 months after completion of the request;
• Technical security logs — 12 months;
• Marketing data — until consent is withdrawn or the relevant purpose expires.;

After the retention period expires, data will be deleted, destroyed, or anonymized unless continued retention is required by law.

9. Marketing Communications

TableFlow sends advertising or informational messages only where an appropriate legal basis exists.

Users may opt out of marketing communications at any time:

• By using the unsubscribe function in the message;
• By contacting TableFlow by email;
• Through account settings, if such functionality is available.

Reservation confirmations, security notifications, and communications necessary for service delivery are not marketing communications.

10. Cookies

The TableFlow website may use cookies and similar technologies to:

• Maintain user sessions;
• Remember language and other settings;
• Provide authentication and security;
• Analyze website usage;
• Identify technical problems.

Strictly necessary cookies are used for website functionality.

Analytics or marketing cookies should be enabled only where there is an appropriate legal basis and, where required, the user’s prior consent.

A separate Cookie Policy and consent management banner should be made available on the website.

11. Data Security

TableFlow uses appropriate organizational and technical measures to protect data, including where applicable:

• Restricting user access;
• Protecting passwords and authentication;
• Encrypted communications;
• Logging system activity;
• Data backups;
• Software updates;
• Security incident management procedures;
• Confidentiality obligations for employees and suppliers.

Absolute security of data transmitted over the internet cannot be guaranteed, but TableFlow takes reasonable measures to reduce risks.

12. Rights of Data Subjects

Subject to applicable law, users may have the right to:

• Receive information about the processing of their data;
• Access data held by TableFlow and obtain a copy;
• Request correction of inaccurate or incomplete data;
• Request cessation of processing, deletion, or destruction of data;
• Request restriction or blocking of data;
• Withdraw consent;
• Object to processing in applicable cases;
• Request data portability where applicable;
• Complain to the competent authority or a court.

The Georgian Law on Personal Data Protection provides data subjects with rights to information, access, correction, and other rights established by law.

13. Submitting a Request

To submit a request regarding personal data, the user should contact:

Email: alex@kovzy.com

Subject: Personal Data Request

The request should preferably include:

• First and last name;
• Contact information;
• The relevant Restaurant or Reservation;
• Description of the request.

TableFlow may reasonably verify the identity of the person making the request to prevent disclosure of data to an unauthorized person.

Where the request concerns a specific Restaurant’s use of Guest data, TableFlow may forward the request to that Restaurant or provide the Restaurant's contact information.

14. Security Incidents

In the event of a personal data breach, TableFlow will:

• Investigate the incident;
• Take measures to limit harm;
• Restore data security;
• Maintain necessary records relating to the incident;
• Notify the competent authority and affected data subjects where required by law.

15. Updates to this Policy

TableFlow may update this Policy from time to time to reflect changes in services, technology, or law.

The updated version will be published on the website with a new date.

Users may receive additional notice of material changes.

16. Contact Information

For privacy-related questions, contact:

Company: Kovzy LLC

Email: alex@kovzy.com

Telephone: +995 599 700 309