Privacy Policy

Actual is a software platform designed for the hospitality industry. Actual provides hospitality operators and businesses with tools to manage tip distribution, payroll processing, employee scheduling, and operational workflows (the "Actual Services"). The Actual Services are provided by Atlas Restaurant Management Systems Inc., doing business as "Actual" ("Actual," "we," "us," or "our"), a Canadian company headquartered in Ontario.

This Privacy Policy explains how Actual collects, uses, and discloses Personal Information in connection with the Actual Services and Actual's websites, including www.onactual.com. We handle Personal Information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws.

This Privacy Policy applies to:

1. businesses that have entered into an agreement with Actual to access the Actual Services (each, a "Customer");
2. employees, staff, and contractors of a Customer who access the Actual Platform (each, a "Permitted User"); and
3. visitors to Actual's websites (each, a "Website Visitor").

Capitalized terms used but not defined in this Policy have the meanings given to them in the Actual Terms of Service, Actual Terms of Use, or Data Processing Agreement, as applicable.

We collect personal information only to the extent necessary to provide Actual Services.

1. Customer data
   1. Sales, revenue, and transaction data
   2. Scheduling and labour information
   3. Payroll and compensation records
   4. Purchasing, costing, and inventory data
   5. Account credentials and administrator contact information
   6. Banking information
2. User data
   1. Full name and contact details (email address, phone number, mailing address)
   2. Employment role, department, and work location
   3. Work schedule and attendance records
   4. Tip allocations, gratuity calculations, and payout records
   5. Banking and direct deposit information, collected and transmitted via our authorized payment and payroll processors
   1. Social Insurance Number (SIN) (payroll only), date of birth, and income information, where required for payroll processing and tax reporting, handled by our payroll processor
   2. Identity verification data, where required to establish or authenticate a disbursement account, handled by our payment processor
   3. User-generated notes and communications within the platform
3. Technical and usage data
   1. IP addresses, device identifiers, and browser information
   2. Log data and activity within the Actual platform
   3. Cookie and session data

We do not use your personal information for advertising, and we do not sell personal information to any third party.

1. To provide and operate Actual Services which includes processing payroll, managing tip distributions, and delivering platform functionality.
2. To support legal compliance. Assisting clients with employment standards compliance, tax reporting, and record-keeping requirements.
3. To facilitate payments and disbursements. Tip disbursements and payroll disbursements are processed through authorized third-party processors. Personal and financial information is shared with these processors solely for this purpose.
4. To improve our platform. Using aggregated and de-identified usage data to develop features and improve user experience.
5. To communicate with clients. Sending service notices, support responses, product updates, and security alerts.

Under PIPEDA, we process personal information based on:

1. Consent. We obtain consent appropriate to the sensitivity of the information collected. For sensitive information such as SINs and banking details, we take additional care in collection and handling.
2. Contract performance. Processing necessary to fulfil our agreements with our Customers.
3. Legal obligation. Processing required to comply with applicable laws, including the Income Tax Act and the Employment Standards Act, 2000 and equivalent provincial, territorial or state legislation.

We share personal information only as necessary and only with parties who are contractually bound to protect it.

1. With our Customers. User data processed through our platform is accessible to the relevant employer, our Customer. Customers determine how they use this data within the bounds of our agreement and applicable law.
2. Service providers and sub-processors. Third parties engaged by Actual to process personal information on our behalf including payroll service providers, payment service providers, and cloud hosting providers may access personal information as necessary to perform their functions.Actual enters into written agreements with its service providers and sub-processors that include data protection obligations appropriate for the nature of the processing and consistent with applicable privacy law. A current list of authorized sub-processors is available upon written request to legal@onactual.com.
3. For legal compliance. We may disclose information where required by law, court order, or regulatory authority.
4. In connection with a business transaction. In the event of a merger, acquisition, or asset sale, personal information may be transferred subject to the same protections in this Policy.
5. Aggregate data. We use aggregated and de-identified data for benchmarking and product insights. This data cannot reasonably be used to identify any individual.

Business clients who have entered into the Actual Terms of Service may refer to the Actual Data Processing Agreement at www.onactual.com/legal/data-processing-agreement for further detail on how personal information is processed on their behalf.

Users have rights under PIPEDA, applicable Canadian provincial privacy legislation, and applicable US state privacy laws, including:

1. The right to access personal information we hold about you.
2. The right to request correction of inaccurate or incomplete information.
3. The right to request deletion of your personal information, subject to legal retention obligations.
4. The right to withdraw consent, where processing is based on consent, subject to legal or contractual limitations.Withdrawing consent may limit or prevent our ability to provide the Services

To exercise any of these rights, contact us at legal@onactual.com.

We implement administrative, technical, and organizational measures reasonably designed to protect Personal Information against unauthorized access, disclosure, or loss

We retain personal information only as long as necessary for the purposes described in this Policy, or as required by law. Further detail on retention of Customer personal information processed on behalf of our Customers is set out in the Actual Data Processing Agreement at www.onactual.com/legal/data-processing-agreement.

We use cookies and similar technologies to enhance user experience and analyze service usage patterns. You may adjust your cookie preferences through your browser settings.

Our primary infrastructure is hosted in Canada. Some processing is performed by sub-processors with operations in the United States and other jurisdictions. When personal information is transferred outside Canada, we take reasonable steps to ensure appropriate contractual safeguards are in place consistent with PIPEDA's accountability principle. Details of sub-processor jurisdictions are available upon written request to legal@onactual.com.

We may update this Privacy Policy from time to time. The date at the top of this document reflects when the Policy was last updated.

Privacy Officer, Actual

Atlas Restaurant Management Systems Inc. d/b/a Actual

Email: legal@onactual.com