Privacy policy
This policy explains how Luz Quarter ("we") uses personal data in its venue operations system, STIR, and in the WhatsApp account that STIR uses to send operational messages. It applies to our staff, to the owner and managers who use STIR, to anyone who messages our WhatsApp business number, and to anyone who applies for a job with us.
Who is responsible
Luz Quarter is the data controller. For anything about your data, email [email protected].
What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Staff details: name, role, contracted hours, rota, clock-in and clock-out times, a hashed PIN | Running shifts, paying the right hours, and the staff portal | Employment contract; legal obligations (working-time records) |
| Work records: tasks completed, photos taken as proof of a task, notes added to them, and the automated photo checks | Keeping the venue to standard, and giving each person private feedback on their own performance and training | Legitimate interest in running the venue safely and well |
| Training: modules completed, quiz results, sign-offs | Making sure required training (including allergen training) is done | Legal obligations; legitimate interest |
| WhatsApp: phone number, profile name, and the messages exchanged with our business number | Sending operational updates and questions, and recording the answers | Consent (you choose to message us or opt in); legitimate interest for the owner's own channel |
| Job applications: name, email, phone, languages, whether you can work in Portugal, availability, experience, CV (if you upload one), how you heard about the job | Considering you for the job and contacting you about it | Steps taken at your request before a possible employment contract; your consent if you ask us to keep your details for future roles |
| Sales records from our till (Vendus), including which staff login rang a sale | Stock control and reconciling the till | Legal obligations (accounting); legitimate interest |
We do not sell personal data, use it for advertising, or make decisions with legal effects about anyone purely by automated means. Performance scores are shown to the person and their manager as guidance and are always reviewed by a person.
Who processes it for us
We use these providers to run STIR. Each processes data only on our instructions:
- Meta Platforms (WhatsApp Business Platform): delivering WhatsApp messages.
- Supabase: the database and photo storage.
- Render: hosting the STIR application.
- Anthropic: the AI that reviews task photos and drafts summaries. Data sent to it is not used to train its models.
- Vendus: our till and invoicing system.
- Resend: sending operational emails.
- Google: sign-in to STIR and reading our business mailboxes.
Some of these providers process data outside the European Economic Area. Where they do, they rely on the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
- Working-time and payroll records: as long as Portuguese labour and tax law requires (generally 5 years).
- Task records, photos and performance data: while you work with us, and up to 12 months after.
- WhatsApp messages: up to 12 months.
- Job applications that don't lead to a job: deleted 6 months after the job closes or 12 months after you applied, whichever comes first (12 months from applying if you asked us to keep your details).
- Sales and accounting records: 10 years, as Portuguese accounting law requires.
Job applicants
When you apply for a job through our jobs page, we collect your name, email address and phone number, the languages you speak, whether you can work in Portugal (only "yes" or "I would need a visa or permit"), when and how much you can work, what you tell us about your experience, your CV if you upload one, and how you heard about the job.
We use this only to consider you for the job and to contact you about it. We do this because you asked us to, as a step before a possible employment contract. If you tick "keep my details for future roles", we keep them on the basis of your consent, which you can withdraw at any time.
Your application is seen only by the owner and the managers who handle hiring. Your CV is stored privately and is never published. We send you a confirmation and other replies by email, through our email provider (Resend). We may use an AI service (Anthropic) to help write job adverts and to summarise an application against the job; it never decides, ranks or rejects anyone, and a person makes every decision.
If you are not hired, we delete your application 6 months after the job closes or 12 months after you applied, whichever comes first. If you asked us to keep your details, we keep them for 12 months from when you applied. If you are hired, your application becomes part of your staff record.
You can ask to see, correct or delete your application at any time: reply to any email we sent you, or email [email protected].
Your rights
You can ask to see the data we hold about you, have it corrected or deleted, object to or restrict how we use it, and receive a copy in a portable format. You can withdraw consent to WhatsApp messages at any time by replying STOP or by telling us. Email [email protected] and we will reply within one month.
If you are not happy with how we handle your data, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).
Deleting your data
To have your data deleted, including your WhatsApp conversation with us, email [email protected] from the address or number we know you by, with "Delete my data" in the subject. We delete it within 30 days and confirm when it is done. We keep only records that the law requires us to keep, and only for as long as it requires.
Changes
If we change this policy, we will update the date at the top of this page.