Last updated · 17 August 2026
Privacy Policy
SessionPilot respects your privacy and is committed to protecting personal data.
This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you visit our website, use the SessionPilot platform, create an account, contact us, or otherwise interact with our services.
We process personal data in accordance with applicable data-protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), where applicable.
1
The plain-English version
SessionPilot is a restaurant operations platform.
We collect and use personal data to provide the Service, manage accounts, support customers, process subscriptions, maintain security, and improve our platform.
When a restaurant uses SessionPilot to manage its employees, shifts, attendance, tasks, training, or other operational information, the restaurant will generally determine why and how that information is processed. In those situations, the restaurant is generally the data controller, while SessionPilot acts as a data processor on the restaurant's behalf.
For information we collect directly for our own purposes—such as account administration, customer support, billing, website analytics, and marketing—SessionPilot may act as the data controller.
2
Who is responsible for your data?
The data controller for personal data covered by this Privacy Policy is:
Session Pilot B.V.
Jonkerbosplein 52, 6534 AB Nijmegen
99274019
Email: abhishek.malhotra@sessionpilot.ai
DPO: Abhishek Malhotra
Email: abhishek.malhotra@sessionpilot.ai
A DPO is required only in certain circumstances under the GDPR, including certain large-scale monitoring or large-scale processing of sensitive data.
3
How we collect information
Depending on how you use SessionPilot, we may collect:
Account information
Name
Business email address
Phone number
Job title or role
Organisation name
Restaurant or branch information
Login credentials and authentication information
Restaurant & operational information
Restaurant locations
Opening hours
Operating schedules
Checklists and routines
Standard operating procedures
Tasks and assignments
Maintenance records
Incident reports
Inventory and waste records
Food-safety and compliance records
Documents and uploaded files
Employee information
Where a restaurant uses SessionPilot to manage employees, the platform may contain:
Employee name
Contact information
Employee ID
Role and department
Attendance information
Working hours
Shift schedules
Leave and availability information
Training records
Task completion records
Payroll-related information
The exact information collected depends on how the restaurant configures and uses SessionPilot.
4
How we collect information
We may collect personal data:
directly from you;
from your employer or organisation;
when you create or use a SessionPilot account;
when you contact our support team;
when you submit a form on our website;
when you subscribe to our Service;
through integrations with services you or your organisation connect to SessionPilot;
automatically through cookies and similar technologies.
Where personal data is obtained from another organisation, applicable GDPR transparency requirements may require information about the source of that data to be provided to the individual.
5
Why we use personal data
We use personal data for purposes including:
Providing the Service
Creating and managing accounts
Providing SessionPilot features
Managing restaurant locations
Managing employees and roles
Managing shifts and attendance
Maintaining checklists and operational records
Providing customer support
Account & billing
Processing subscriptions
Managing invoices and payments
Communicating about your account
Managing plan limits and access
Security
Protecting accounts
Detecting suspicious activity
Preventing fraud and abuse
Maintaining the security and reliability of the Service
Investigating security incidents
Communication
Responding to enquiries
Providing service notifications
Sending important account or security information
Providing product updates
Sending marketing communications where legally permitted
Improving SessionPilot
Understanding how the Service is used
Fixing bugs
Improving functionality
Developing new features
Monitoring performance and reliability
We aim to process personal data only for specified and legitimate purposes and to keep the information relevant to those purposes. GDPR principles include lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and security.
6
Legal bases for processing
Depending on the circumstances, we may process personal data on the following legal bases:
Contract ,where processing is necessary to provide SessionPilot or perform our agreement with you.
Legal obligation ,where processing is necessary to comply with applicable law.
Legitimate interests,where processing is necessary for purposes such as security, service improvement, fraud prevention, or business administration, provided those interests are not overridden by your rights and freedoms.
Consent, where we ask for your consent, such as for certain marketing communications or optional cookies.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
7
Restaurant employee data
SessionPilot is designed to help restaurants manage their teams.
When your employer or restaurant uses SessionPilot to manage your employee information, your employer will generally be responsible for determining the purposes and means of processing that information.
SessionPilot generally processes that information on the restaurant's documented instructions as a data processor.
This may include information relating to:
attendance;
working hours;
shifts;
roles;
responsibilities;
tasks;
training;
leave;
payroll-related records; and
operational performance.
The restaurant remains responsible for ensuring that its use of employee information has an appropriate legal basis and complies with applicable employment and data-protection laws.
Where SessionPilot acts as a processor, the processing relationship should be governed by an appropriate data-processing agreement as required by GDPR Article 28.
8
Operational information
Restaurants may use SessionPilot to store information relating to:
temperature checks;
cleaning schedules;
inspections;
HACCP-related records;
incidents;
equipment maintenance;
compliance activities.
These records may sometimes contain information that relates to identifiable employees.
SessionPilot processes such information only for the purposes for which the restaurant has configured the Service and according to the applicable contractual arrangement.
SessionPilot does not independently determine a restaurant's food-safety or compliance requirements.
9
Who we share information with
We may share personal data with:
Service providers
We may use trusted third-party providers for services such as:
cloud hosting;
authentication;
payment processing;
email delivery;
customer support;
analytics;
security;
backups;
infrastructure.
These providers may process personal data only as necessary to provide their services to us and, where applicable, under appropriate contractual safeguards.
Your organisation
If you use SessionPilot as part of a restaurant or organisation, authorised administrators within that organisation may be able to access information associated with your account according to the permissions configured by the organisation.
Legal authorities
We may disclose personal data where required by law, regulation, court order, or valid legal process.
We do not sell personal data.
10
International data transfers
Some of our service providers may process personal data outside the European Economic Area ("EEA").
Where personal data is transferred outside the EEA, we will use an appropriate legal mechanism where required by GDPR, such as an adequacy decision or appropriate contractual safeguards.
The GDPR requires organisations to provide information about relevant international transfers and applicable safeguards.
Information about our current subprocessors and relevant transfer mechanisms can be provided through our Subprocessor List or Data Processing Agreement, where applicable.
11
How we protect your information
We use appropriate technical and organisational measures designed to protect personal data against:
unauthorised access;
accidental loss;
destruction;
alteration;
unlawful processing;
disclosure.
Security measures may include access controls, authentication mechanisms, encryption, monitoring, backups, and other safeguards appropriate to the nature and risks of the processing.
GDPR requires appropriate security measures taking account of the risks associated with processing personal data.
However, no internet-based service can guarantee absolute security.
12
How long we keep information
We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required by law.
Retention periods depend on the type of information.
For example:
Account information may be retained while your account remains active.
Billing records may be retained for the period required by applicable accounting and tax laws.
Support communications may be retained for as long as reasonably necessary to resolve and document support matters.
Security logs may be retained for an appropriate period for security and incident-management purposes.
Customer Data processed on behalf of a restaurant will generally be retained according to the customer's instructions and applicable contractual terms.
When personal data is no longer required, it will be deleted, anonymised, or securely disposed of where appropriate.
13
Cookies & similar technologies
Our website and Service may use cookies and similar technologies.
These technologies may be used for:
essential website functionality;
authentication;
security;
remembering preferences;
analytics;
understanding website usage;
marketing, where applicable.
Where required by applicable law, we will ask for consent before using non-essential cookies.
You can manage certain cookie preferences through our cookie settings.
A separate Cookie Policy may provide additional information about the specific cookies and technologies we use.
14
Your privacy rights
Depending on your circumstances and applicable law, you may have the right to:
access your personal data;
request correction of inaccurate or incomplete data;
request deletion of your personal data;
request restriction of processing;
object to certain processing;
request data portability;
withdraw consent where processing is based on consent;
object to direct marketing;
request information about automated decision-making and profiling where applicable.
The GDPR provides these rights subject to certain conditions and exceptions.
You also have the right to lodge a complaint with your relevant data-protection supervisory authority.
15
Children's privacy
SessionPilot is a business and restaurant operations platform and is not intended for use by children.
We do not knowingly collect personal data directly from children for the purpose of providing the Service.
If you believe that a child has provided personal data to us inappropriately, please contact us so that we can investigate and take appropriate action.
16
Automated decision-making
SessionPilot is primarily designed to help businesses organise and manage restaurant operations.
We do not intend to use personal data for decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals unless permitted by applicable law and appropriate safeguards are provided.
Where applicable, individuals will be informed about such processing and their relevant rights. GDPR transparency requirements include information about the existence of applicable automated decision-making and meaningful information about its logic and consequences.
17
Third-party links & integrations
SessionPilot may contain links to or integrations with third-party services.
Those services operate under their own privacy policies and terms.
We are not responsible for the privacy practices of third-party websites or services that we do not control.
18
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect:
changes to SessionPilot;
changes to our data-processing practices;
changes to applicable laws;
changes to our service providers; or
improvements to our privacy practices.
When changes are material, we will provide appropriate notice where required.
The latest version will always be made available on our website.