PRIVACY POLICY FOR MERCHANTS (APPLICABLE TO SERVERS AND MERCHANT’S PERSONNEL)
Last updated: 22 October 2026
If you are a merchant using sunday to better manage your business (a “Sunday Merchant” or a “Merchant”) or if you are a waiter or an individual working in an Establishment or associated with a Merchant’s business, we may collect and use your personal information in connection with the provision of our services (the “Services”), including the operation of our back-office platform and our proprietary application Sunday for Staff (“Sunday for Staff”).
We will update this Privacy Policy from time to time to reflect any changes or proposed changes to our use of your personal data, or to comply with changes in applicable law or regulatory requirements. We encourage you, as a waiter or an individual working in an Establishment or associated with a Merchant’s business (“you” or a “data subject”), to review this Privacy Policy periodically to keep up to date on how we use your personal data. If we update this Privacy Policy, we will update the effective date at the top of the page.
Certain words and phrases in this Privacy Policy have specific definitions when they start with capital letters. Where a defined term is used, it either has the meaning set out in section 14 below (Definitions) or the meaning given to it in the relevant clause of this Privacy Policy.
Section 1 – Purpose of this Privacy Policy
This Privacy Policy explains our approach to any personal data that we might collect on you or which we have obtained from a third party, and the purposes for which we process such personal data. This Privacy Policy also sets out your rights in respect of our processing of your personal data.
When we talk about “personal data”, we mean any information which relates to an identified or identifiable living individual. Individuals might be identified by reference to a name, an identification number, location data, an online identifier (such as an IP address) or to other factors that are specific to them, such as their physical appearance.
This Privacy Policy is intended to assist you in making informed decisions when using Sunday for Staff and the Services. Please take a moment to read and understand it.
This Privacy Policy only applies to the use of your personal data obtained by us, whether from data subjects directly or from a third party. It does not apply to personal data collected by third parties during communications with data subjects or during data subjects’ use of their products or services (for example, where they follow links to third party websites over which we have no control, or they purchase goods or services from those third parties).
Section 2 – About us and how to contact us
Sunday for Staff and the Services are made available by various companies in the sunday group of companies (each a “Group Company“). Where this Privacy Policy refers to ” sunday”, ” we”, ” us”, “our”, this means one or more of the particular Group Companies that provide the particular product or service to you. If you work in the United States, Sunday App, Inc PBC is the business responsible for the collection and processing of your personal data (or, where applicable under state privacy laws, the “business” as defined therein). If you have any questions about this Privacy Policy or want to exercise your rights as a data subject set out in this Privacy Policy, you can contact us at dataprivacy@sundayapp.com.
Section 3 – What personal data we collect
We may collect and process different types of personal data about data subjects for different processing purposes. The types of personal data we collect depends on how you use our back-office platform, Sunday for Staff and the Services and includes the following:
| Identity data | First name; last name. | |
| Account creation data | Email address; password; phone number; date of birth ; country of residence; access rights. | |
| Account data | Email address; password; profile picture or avatar; contact preferences; performance data (e.g., share of bills viewed on a phone, tip rate, guest ratings, rank within the Establishment). | |
| Contact data | Email address; phone number. | |
| Transaction data | Payouts of rewards. | |
| Financial data | Bank account number; route transit number; address details. | |
| Technical data | IP address; browser type and operating system; geolocation; unique token assigned to a device; user interaction with Sunday for Staff (for debugging purposes). | |
For California residents, the personal data we collect falls within the following CCPA categories: Identifiers (name, email address, phone number, IP address and device identifiers); Characteristics of protected classifications (date of birth); Professional or employment-related information (performance data, such as share of bills viewed on a phone, tip rate, guest ratings and rank within the Establishment); Commercial information (reward payouts); Financial information (bank account and routing numbers used for payouts); Internet or network activity (use of Sunday for Staff); and Geolocation data. We do not collect sensitive personal information beyond what is necessary to provide the Services.
Section 4 – How we collect and receive personal data
We collect and receive personal data using different methods:
| Personal data you provide to us | You may give us your personal data directly, for example, when you use Sunday for Staff or the Services. |
| Personal data received from third parties | We may receive personal data about you from third parties, including from the Merchant (e.g. phone numbers). Such third parties may include the Merchant’s point of sale (POS) and third parties that provide technical services to us so that we can provide our website, Sunday for Staff and the Services. |
Section 5 – How we use your personal data
| Purpose / Activity | Business purpose |
| Provide Merchant and data subjects with the use of our platform and other related services and facilitate the operation of the Establishment (e.g business performance, daily operation, reviews, billing and accounting) | Performing services on behalf of sunday, including providing the Services to Merchants and their staff. |
| Facilitate the creation of a user account and provide you a personalised experience through it | Performing services on behalf of sunday, including providing, maintaining and servicing your account. |
| Send emails, SMS/MMS, WhatsApp and/or push notifications to servers and staff members regarding the Services, including updates and performance information. | Performing services on behalf of sunday, including sending service-related communications. |
| Display in Sunday for Staff a leaderboard of staff members at the same Establishment, based on performance indicators (e.g., share of bills viewed on a phone). The leaderboard shows the first name and rank of the staff members concerned and is visible only to other staff members of that Establishment. | Performing services on behalf of sunday, including providing performance information to staff members. The Establishment can hide names or the leaderboard. You can ask not to appear on the leaderboard by contacting support@sundayapp.com. |
| Provide sunday KPIs emails to Establishments | Performing services on behalf of sunday, including providing analytics to Merchants. |
| Reward payouts to staff through payout/payment partners | Performing services on behalf of sunday, including processing payments. |
| Prevent fraudulent use of our Services | Detecting security incidents; protecting against malicious, deceptive, fraudulent or illegal activity. |
| Provide support and assistance | Performing services on behalf of sunday, including responding to inquiries and providing customer support. |
| sunday CRM | Performing services on behalf of sunday, including maintaining our relationship with Merchants and their staff. |
| Use data analytics to improve our website, products/services | Undertaking internal research for product development and improvement; debugging to identify and repair errors. |
| Direct/product marketing | Advertising and marketing, where permitted by applicable law or with your consent (including prior express written consent for marketing text messages). We use your contact data, including your phone number and email address, to send you marketing communications about our services and programs (e.g., challenges, trainings, rewards) by email, SMS/text message, WhatsApp and push notification. Where required by law (including for marketing text messages in the US), we rely on your prior express written consent. You can opt out at any time, free of charge, including by replying STOP to any marketing text message or by contacting dataprivacy@sundayapp.com. |
We may use your personal data to comply with applicable laws, lawful requests, and legal process ; audit our internal processes for compliance with legal and contractual requirements or our internal policies; and prevent, identify, investigate and deter fraudulent, harmful, unauthorised, unethical or illegal activity, including cyberattacks and identity theft.
Section 6 – If you fail to provide your personal data
If you fail to provide personal data when we request it, we may not be able to provide you the products and services you have requested from us or to process an application to register an account. Please note that the information that we need from you is usually identified by asterisks.
Section 7 – How we obtain your consent
Where our use of your personal data requires consent, you can provide such consent at the time we collect your personal data following the instructions provided, or by informing us using the contact details set out in the “About us and how to reach us” section above.
Section 8 – Third-party links
This Privacy Policy only applies to personal data processed by us through your use of the Services and/or in connection with our business operations. However, from time to time, our website or application may contain links to third-party websites and services. We have no control over these websites and services and this Privacy Policy does not apply to your interaction with the relevant third parties.
When you use a link to go to another website or you request a service from a third party, your browsing and interactions on any other websites, or your dealings with any other third-party service provider, is subject to that website’s or third-party service provider’s own rules and policies. We do not monitor, control or endorse the privacy practices of any third parties. We encourage you to become familiar with the privacy practices of every website you visit or third-party service provider that you use in connection with your interaction with us and to contact them if you have any questions about their respective privacy notices and practices.
Section 9 – Sharing personal data
When processing your personal data, we may need to share it with third parties (including other entities within our group of companies), as set out in the table below. This list is non-exhaustive and there may be circumstances where we need to share personal data with other third parties.
| Third-party Service Providers | We may share your personal data with third party service providers to: provide you with the Services; to provide technical support. |
| Payment Service Providers | We use third party payment service providers to process payments. These payment service providers may use your payment data in accordance with their privacy policies. |
| sunday Group Companies | We may share some or all of your personal data with our parent company or other Group Companies. |
| Other staff members of the Establishment | Your first name and your rank on the leaderboard are visible to other staff members at the same Establishment, unless the Establishment has hidden names or the leaderboard, or you have asked not to appear on it. |
| Merchant (your employer) | We share with the Merchant of the Establishment where you work activity and performance data (e.g., bills and tables served, share of bills viewed on a phone, guest ratings) so that it can manage its business. |
Data Storage. We are located in the US and maintain servers globally to ensure the resilience of our services. Your personal data may be stored and processed in any country where we or our service providers operate. Where personal data is transferred internationally, we implement appropriate safeguards, including standard contractual clauses where required by applicable law, to ensure an adequate level of protection. By using the Services, you acknowledge that your personal data may be transferred to and processed in countries outside your state of residence.
Do Not Sell or Share My Personal Data. We do not sell your personal data for monetary consideration and we do not share it for cross-context behavioral advertising. We disclose performance data to the Merchant where you work as part of the Services, as described in this Section 9.
Section 10 – How long we keep your personal data
We retain personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for compliance purposes.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Section 11 – Confidentiality and security of your personal data
We are committed to keeping the personal data you provide to us secure and we have implemented information security policies, rules and technical measures to protect the personal data under our control from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction or accidental loss. In addition, all our employees and data processors (i.e. those who process your personal data on our behalf) are obliged to respect the confidentiality of the personal data of all users of our website and those who purchase our products and services.
PCI Compliance. To the extent applicable to the Services, we are responsible for providing the Services in a manner that is consistent with the highest certification level (PCI Level 1) provided by the PCI-DSS requirements. sunday’s certification is confirmed annually by a qualified security assessor (QSA).
Section 12 – Automated Decision-Making
As part of the Services, we do not engage in automated decision-making and/or profiling, which produces legal or similarly significant effects.
Section 13 – Your privacy rights
California Residents (CCPA/CPRA). If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:
- Right to Know. You may request that we disclose the categories and specific pieces of personal data we have collected about you, the categories of sources, our business purposes for collecting it, and the categories of third parties with whom we share it.
- Right to Correct. You may request that we correct inaccurate personal data we hold about you.
- Right to Delete. You may request deletion of your personal data, subject to certain exceptions.
- Right to Limit Use of Sensitive Personal Information. To the extent we collect sensitive personal information, you may request that we limit its use to what is necessary to perform the Services.
- Right of Non-Discrimination. We will not discriminate or retaliate against you for exercising any of these rights.
Other US State Residents. Residents of other states with applicable privacy laws may have similar rights to access, correct, delete, and opt out of certain processing of their personal data. Please contact us at dataprivacy@sundayapp.com to exercise these rights.
Users located outside the United States. If you work in an Establishment located in the European Economic Area, the United Kingdom or Switzerland, your privacy rights are governed by our applicable local privacy policy, available at https://sundayapp.com/en-gb/privacy-policy-waiters-personnel/ (UK) or https://sundayapp.com/fr/privacy-policy-waiters-personnel/ (EU/France).
Exercising These Rights. To exercise any of these rights, contact us at dataprivacy@sundayapp.com. We will respond within 45 days as required by law. We may ask you to verify your identity before processing your request.
Section 14 – Definitions
The following words and phrases have the following meanings in this Privacy Policy:
| Establishment | any type of venue open to the public in which a Merchant provides to customers food and/or beverage services (e.g. bar, festival, restaurant, food court, stadium, and similar) in which you work. |