Last updated: 1st of May 2026

1. Introduction
   Chaadu B.V. (we) is committed to protecting the privacy of our diverse user base, including hospitality professionals, employers, and guests, by securely managing data to facilitate a digital reputation platform.

2. Role Disclosure (GDPR Compliance)

• Data controller: we act as the controller for account information, billing details, and data collected directly from guests during the tipping/feedback process.
• Data processor: we act as a data processor for the professional profile information and guest-submitted reviews used to generate performance reports for employers.

3. Data We Collect

• Employer data: name, business contact info, company details, and payment information.
• Guest data: name, feedback text, and payment details (processed securely via third-party providers) for tipping. Guests can participate without creating a full account. Tips are processed securely via third-party providers; we do not store full credit card details on our servers.
• Employee/Professional data: name, address, age, biography information, professional information/history and performance metrics as provided by employers/guests.

4. Use of AI
   We utilize Large Language Models (LLMs) to e.g., facilitate translation and analyze guest feedback to generate constructive growth plans and actionable insights for staff development.

• No training on personal data: we do not use identifiable guest names, employee names, or private client data to train global AI models.
• Sub-processors: our AI infrastructure providers are bound by strict data processing agreements.

5. Data Retention (The “Auto-Purge” Rule)

• Review and Feedback Data: to uphold data minimization, guest-specific data used for AI generation is automatically deleted or anonymized after 12 months of inactivity.
• Transaction records: tipping and payment records are held for the duration required by financial regulations and tax laws (typically 5 – 7 years).
• Account data: held for the duration of the business relationship and up to 1 year after closure to facilitate final administrative tasks, ensure financial audit compliance, and address any potential legal or billing inquiries.

6. Your Rights
   Under the GDPR, all users (professionals, employers, and guests) have the right to access, correct, or delete their personal data, object to processing, and exercise data portability.

• General requests: users may contact us to exercise their privacy rights regarding the data we hold.
• Guest feedback requests: inquiries specifically regarding guest feedback and tipping information should be directed to us. We manage these inquiries directly and will coordinate with the relevant establishment as needed to fulfill them.
• Professional ownership and portability: professional profiles and reputation data (reviews/achievements) are owned by the individual staff member. Profiles are fully portable, allowing professionals to retain their reputation when moving between employers or working independently.

7. International Transfers
   Data transferred outside the European Economic Area (EEA) is protected by standard contractual clauses or other recognized legal safeguards.