Privacy policy

Version 2026-09-26

Who is responsible for your information?

True Bar Checks is owned and operated by True Software Studio Ltd.. For our own business administration, billing, security and support activities, we determine how the relevant information is used. For training and venue records entered by a business, that business normally determines the purposes of processing and we provide the software on its instructions. The exact controller/processor arrangements must be documented in the production service agreement.

Staff, customers and witnesses should normally direct requests about a venue’s records to that venue first. Contact True using the privacy details above for information we control or for help identifying the responsible business.

Information the app handles

• Business and account information: names, email addresses, roles, venue settings, password hashes, staff PIN hashes, invitations and access status.
• Training evidence: lesson progress, questions and answers, course version, results, typed declarations, relevant premises conditions, completion and refresher dates, and manager sign-offs.
• Venue records: refusal reasons, toilet-check results, incident/accident descriptions, times, locations, relevant people and actions, and manager reviews.
• Service information: session and security data, audit events, technical errors, billing customer and subscription identifiers, and encrypted push-subscription details for devices that enable reminders.

We do not collect payment-card details in the app; checkout is handled by Stripe when connected. The app does not provide an ID-photo upload or an automated facial-recognition feature. External PASS verification tools are separate services.

Why information is used

Information supports sign-in, access control, the requested training and records, billing, service messages, reminders, troubleshooting and protection against misuse. Our own processing requires an appropriate lawful basis, which may include performance of a contract with the account holder, legitimate interests in delivering and securing the business service, and compliance with specific legal duties where they apply. The final notice must identify those bases against the confirmed production purposes.

Each venue is responsible for identifying its own lawful basis for staff and customer records. If it records health information or allegations of offences, it must also establish the additional legal conditions and safeguards required. Agreeing to the service terms does not constitute blanket consent to all personal-data processing.

Who can see information?

Within a workspace, owners can view business records, staff can view their own records, and shared iPad accounts can submit PIN-attributed entries without browsing historical logs. The app separates businesses’ workspaces. Authorised service administration may be needed for support, security and lawful requests.

Production service providers may include the hosting and backup provider, transactional email provider, Stripe and the browser/device push service. A final provider list, relevant locations and any international-transfer safeguards must be added once those providers are selected. We do not claim that all data remains in the UK without that deployment information.

How long information is kept

The app retains records until an authorised administrator applies the agreed retention process. Deactivating a staff member stops access but does not delete historical evidence. The venue must choose and justify its retention schedule for training and operational records, including records relating to former staff. This build does not yet automatically erase records at the end of a retention period.

Before live use, True and the customer must agree the retention periods or criteria for account, billing, security, training and incident information, including backups and account closure. Necessary evidence should not be deleted prematurely, and personal information should not be kept indefinitely without a justified purpose.

Security and data minimisation

Passwords and staff PINs are hashed. Push-subscription data is encrypted. Access restrictions, request validation and an audit history support safe operation. Production security also depends on HTTPS, secret management, host controls, backups and ongoing maintenance. No service can promise absolute security.

Record only relevant facts. Do not copy full ID numbers, photographs of IDs or unnecessary medical details into free-text fields. Follow your business’s privacy and safeguarding procedures.

Your rights and complaints

Depending on the circumstances and applicable law, you may be entitled to access, correct, erase or restrict information, object to certain uses, or receive information in a portable format. Where processing relies on consent, it can be withdrawn without affecting earlier lawful processing. These rights have conditions and exceptions; contact the responsible venue or True as explained above.

You can raise a concern with us and complain to the UK Information Commissioner’s Office. The final published notice must include a working privacy contact. The current app does not make automated decisions about a person’s legal entitlement to sell alcohol: assessment scores support human manager review.

Cookies, reminders and external links

See our Cookie policy for session and security storage. Device notification permission is optional; disable it in your browser or device settings. Opening an external verification app or website brings that provider’s own privacy terms into play. True does not receive the result of an external ID check through an integration in this build.

Changes

We will update this notice when the service, providers or processing arrangements change. The version date above identifies this draft. Material changes relevant to customers must be communicated before they apply where required.