Privacy Policy
Dear Customer,
We are pleased that you are interested in data protection. We would like to give you an easily understandable overview of our data processing practices and our privacy compliance measures in relation to our website, mobile applications and related services (collectively referred to as the “Platform”). Our goal is to provide you with an excellent experience while keeping your personal data secure.
1. Who we are
1.1 We are Lionize (Private) Limited (“we”, “us” or “our”), a private limited company incorporated in Pakistan under the Companies Act, 2017, but usually we simply use the name Sauce.
1.2 In respect of the processing activities conducted on our Platform, we are the data controller responsible for what happens with your personal data. This means we are the party determining how your personal data is processed, for what purposes and by what means.
1.3 If you have any question about data protection at Sauce, you may contact us at any time at team@lionize-ai.com.
1.4 By visiting our Platform, registering an account or making a reservation, you agree to this Privacy Policy. This Privacy Policy applies to all personal data obtained by us through your use of our Platform. It does not apply to any website controlled by a third party not affiliated with us to which our Platform may link (“Third Party Sites”). The privacy policies of those Third Party Sites shall apply in those cases.
2. Privacy is your right and the choice is yours
2.1 As a customer you may choose what information you share with us. Please be aware, however, that when signing up to our Platform you are required to accept our Terms and Conditions. We need certain information from you in order to perform our obligations under that contract. It is entirely up to you whether you provide such information or choose not to use our Platform.
2.2 You may take the following steps to control and manage how much personal data you share with us:
2.2.1 Location: you may decline or withdraw location permission at any time through your device settings. If you do so, we will not be able to show you restaurants nearest to you.
2.2.2 Direct marketing: if you do not wish to receive marketing communications from us, you may unsubscribe at any time through the Platform or by using the unsubscribe link in any marketing message.
2.2.3 Optional profile information: information such as your date of birth, dietary requirements and seating preferences is optional. You may choose not to provide it, although this may reduce the quality of service a Restaurant Partner is able to provide to you.
2.2.4 Cookies and web-tracking: you may set your device or web browser to decline cookies and other web-tracking technologies. If you deactivate web-tracking, you will no longer see personalised content, offers or advertisements.
3. Your legal rights
Right to access. You have the right to be informed which data we store about you and how we process it. We will respond to your access request as soon as practicable and will inform you if we are unable to meet your request, with reasons, or require additional time.
Right to rectification. If you notice that stored data is incorrect, you may ask us to correct it, or correct it yourself through your profile on the Platform.
Right to erasure. You may request deletion of your personal data, or delete your account through the Platform. Please note that certain records must be retained by us to comply with applicable tax, accounting and regulatory obligations, and cannot be deleted on request.
Right to withdraw consent. You may withdraw your consent to our collection, use and disclosure of your personal data at any time for any or all of the Purposes. Upon receiving your withdrawal request we may require reasonable time to process it and to notify you of the consequences, including any effect on our ability to continue providing services to you.
To exercise your rights you may submit your request at team@lionize-ai.com at any time, and we will process such requests in accordance with this Privacy Policy and our obligations under applicable law. We aim to respond within thirty (30) days.
4. An overview of the personal data we process
In this section you can find general information about the categories of personal data we process. Personal data is information that directly identifies you, such as your name, or enables us to identify you indirectly, for example a user identifier linked to your profile.
4.1 Profile data (master data)
This includes your name, mobile number, email address, password and, where you provide it, your date of birth.
Why do we process this category? This is your master data, which we require in order to provide our services. Without a mobile number or email address and a password, you cannot create a profile. We require your date of birth to confirm that you are not a minor and, where you consent, to recognise your birthday.
4.2 Reservation data
This includes your name, the Restaurant Partner selected, date, time, party size, occasion, seating preference, any note you provide to the Restaurant Partner, and your reservation reference.
Why do we process this category? In accordance with the principle of data minimisation, we provide Restaurant Partners only with the information they require in order to hold your table and serve you.
4.3 Dietary and allergen data
This includes allergies, intolerances and dietary requirements which you choose to record on your profile or attach to a reservation.
Why do we process this category? We transmit this information to the Restaurant Partner you have booked so that its kitchen and floor staff are aware before you are seated. Provision of this information is optional. Please note the important limitation set out at clause 6 of our Terms and Conditions.
4.4 Reservation history data
This includes your past reservations, Restaurant Partners visited, reservation references, cancellations, failures to attend, points earned and redeemed, and offers claimed.
Why do we process this category? Each time you make a reservation this information is added to your profile. You can view it at any time in the Platform. We use it to operate the loyalty programme, to recommend Restaurant Partners, and to improve our services.
4.5 Location data
This includes your city, and where you grant permission, your device’s longitude and latitude.
Why do we process this category? We use this to display Restaurant Partners nearest to you and to show availability relevant to your location. Precise location is processed only where you grant permission and may be withdrawn at any time.
4.6 Device information and access data
This includes your device identifier, device type, operating system and version, application version, time of access, configuration settings and IP address.
Why do we process this category? Each time you access the Platform this information is recorded for technical reasons. We also use parts of this information to detect suspicious behaviour at an early stage and to protect the Platform.
4.7 Payment data
This includes your selected payment method, the last four digits of your card, the card type, and encrypted or tokenised card references held by our payment service provider.
Why do we process this category? We require this information to collect Reservation Deposits, place card authorisations, bill Membership fees, and issue refunds. Sauce does not store your full card number. Full card details are held by our licensed third party payment service provider.
4.8 Customer care data
This includes your name, mobile number, email address, the content of your queries or complaints, and any social media identifier where you contact us through a social media channel.
Why do we process this category? If you contact us we collect this data because we need to know who we are speaking with and what the matter concerns in order to assist you.
4.9 Marketing contact and communications data
This includes your name, mobile number, email address and device identifier.
Why do we process this category? If you have consented to receive marketing communications from us, we require this information to send them and to address you personally.
4.10 User-generated content
This includes reviews, ratings, comments and photographs which you submit through the Platform.
Why do we process this category? To publish your content on the Platform and to help other diners make informed choices.
5. Data we process about Restaurant Partners and creators
In addition to diner data, we process the following categories of data in connection with the businesses and individuals who partner with us. This section is provided for completeness and transparency.
5.1 Restaurant Partners
Where a restaurant partners with Sauce, we collect the trading name and legal entity name, entity type, registered and outlet addresses, National Tax Number (NTN), Sales Tax Registration Number (STRN), the Computerised National Identity Card (CNIC) number of the proprietor or authorised signatory, bank account details including IBAN for settlement, and the name, mobile number and email address of the owner or authorised signatory and of the operations manager.
Why do we process this category? To onboard the Restaurant Partner, calculate and settle amounts payable, issue tax invoices, and comply with our obligations under the Income Tax Ordinance, 2001, the Sales Tax Act, 1990, and applicable provincial sales tax legislation, including withholding and reporting obligations.
5.2 Restaurant Partner staff
Staff of a Restaurant Partner who use the Sauce restaurant application or dashboard provide their name and are issued a login or personal identification number. We record which staff member confirmed a guest arrival or closed a booking.
Why do we process this category? To reconcile reservations and resolve disputes. We do not collect the CNIC, salary, employment records or personal contact details of Restaurant Partner staff. Those remain with the Restaurant Partner as employer.
5.3 Creators
Where a content creator is engaged by Sauce, we collect the creator’s name, CNIC number, Active Taxpayer List status and National Tax Number where held, bank account details including IBAN, social media handles and audience figures, and performance data including code usage, reservations driven and amounts earned.
Why do we process this category? To calculate and pay amounts due to the creator, to determine the applicable rate, and to withhold and deposit tax and file withholding statements as required under the Income Tax Ordinance, 2001. Creator CNIC and bank details are used for payment and tax compliance only. They are disclosed to the tax authorities where the law requires and to our payment service provider, and are never disclosed to Restaurant Partners, diners or other creators.
6. Our detailed processing activities and purposes
We process your personal data only in accordance with relevant data protection laws and only where it is lawful and you can reasonably expect it to be processed. We process personal data for the following purposes (“Purposes”):
6.1 Creating and operating your account
When creating an account you will be asked to enter your master data. Your mobile number and email address are particularly important as we use them to identify you when you log in. We ask that you choose your password carefully and do not reuse a password used on other services.
Categories of personal data: Profile data (master data); Device information and access data.
6.2 Processing and confirming your reservation
Once you select a Restaurant Partner and confirm a reservation, we record the reservation in your profile and transmit the necessary details to the Restaurant Partner so that your table can be held and prepared.
Categories of personal data: Profile data; Reservation data; Dietary and allergen data; Location data; Device information and access data.
6.3 Sharing your reservation with the Restaurant Partner
Once your reservation is confirmed, the Restaurant Partner you have booked is provided with your first name and last initial, party size, date and time, the occasion where given, any dietary requirements or seating preferences you have recorded, your visit history at that Restaurant Partner and average spend at that Restaurant Partner, and whether you have previously failed to attend a reservation with them.
A Restaurant Partner receives information relating to its own guests and may also see your general dining preferences and cuisine interests on the Platform, to help them serve you better. A Restaurant Partner does not receive your contact details or your financial information. Restaurant Partners have no claim whatsoever to your personal data and may not use it for any purpose other than serving you and marketing their own restaurant, may not export or sell it, and lose access to it when their partnership with Sauce ends. These restrictions are contractual obligations under the Restaurant Partner agreement.
Categories of personal data: Reservation data; Dietary and allergen data; Reservation history data.
6.4 Targeted promotional campaigns for Restaurant Partners
A Restaurant Partner may commission a campaign directed at diners matching defined criteria, for example diners whose average spend exceeds a stated amount, diners who favour a particular cuisine, or diners who have not previously visited that Restaurant Partner.
Such campaigns are executed entirely by Sauce within the Platform. The Restaurant Partner selects the criteria and Sauce delivers the communication. The Restaurant Partner is provided only with aggregate figures, namely the number of diners matched and the number who subsequently booked. At no point does a Restaurant Partner receive your name, mobile number, email address or any other means of contacting you directly. Sauce does not provide its diner database to any Restaurant Partner under any circumstances.
You may opt out of receiving such campaign communications at any time through the Platform, without any effect on your ability to make reservations.
Categories of personal data: Profile data; Reservation history data; Location data.
6.5 Creator codes and referral links
Where you make a reservation using a creator’s code, or subscribe to Membership through a creator’s referral link, we record that the reservation or subscription was attributed to that creator so that the creator may be paid.
Creators do not receive your name, contact details or any information identifying you. A creator is provided only with aggregate counts of reservations and subscriptions attributed to their code.
Categories of personal data: Reservation data; Reservation history data.
6.6 Payment processing and refunds
We process payment data in order to collect Reservation Deposits, place and release card authorisations, bill Membership fees and issue refunds. Payment card details are captured and held by our licensed third party payment service provider and are not stored by Sauce. Restaurant Partners never receive your payment data.
Categories of personal data: Payment data; Profile data; Reservation data.
6.7 Loyalty programme and Membership
We process your reservation history in order to calculate points earned, determine tier eligibility, apply savings caps, and administer Membership benefits.
Categories of personal data: Profile data; Reservation history data.
6.8 Fraud detection, prevention and platform security
In order to protect our customers, our Restaurant Partners and our Platform, we monitor activity on our website and mobile applications. We use technical measures to ensure that suspicious behaviour patterns are detected early and prevented. This includes detecting duplicate accounts, abuse of promotional offers, and reservations made without genuine intention to attend.
Certain of these processes are automated and could affect the use of your registered account. If any such decision leads to a negative result for you and you do not agree with the outcome, you may contact us through the Platform. All of our fraud detection processes are open to human review and we will assess the circumstances of your case individually.
Categories of personal data: Profile data; Device information and access data; Payment data; Reservation history data.
6.9 Direct marketing
If you have consented to receiving marketing communications from us, we may send you offers, information about newly added Restaurant Partners, limited-time table offers and occasional customer surveys by email, SMS, WhatsApp or in-application push notification.
You are always free to opt out. Where you do so, we will retain your contact details on a suppression list so that we can continue to comply with your objection. Withdrawal of consent for marketing purposes will not affect your ability to use the services provided on the Platform.
We record, in a pseudonymised manner, key performance indicators to assess the effectiveness of our marketing campaigns, including aggregated open and click-through rates.
Categories of personal data: Marketing contact and communications data; Profile data; Reservation history data; Location data.
6.10 Transactional notifications
We send you reservation confirmations, reminders, changes and cancellation notices. These are necessary for the performance of our contract with you and are not marketing communications. You cannot opt out of these while you hold an active reservation or Membership.
Categories of personal data: Profile data; Reservation data.
6.11 Customer relationship management
Your satisfaction is our objective. In order to answer your questions and understand the matter in full, we store the content of your communications with us in our customer relationship management system. The content of the information we store depends on the information you provide to us as part of that communication.
Categories of personal data: Customer care data; Reservation history data.
6.12 Mergers, acquisitions and change of ownership
In the event of a merger with or acquisition by another company, we will disclose certain limited information to that company. Prior to disclosure we will ensure that the recipient company undertakes to protect your personal data to a comparable standard to that under applicable law and this Privacy Policy. We will endeavour to keep the extent of the data shared to the minimum required to conclude the transaction.
7. Who we share your personal data with
We never give your data to unauthorised third parties. However, in order to operate our business we engage selected service providers and give them limited and strictly monitored access to certain data in order to fulfil the Purposes. All data recipients must meet applicable data protection requirements and undertake to protect your personal data to a comparable standard.
Restaurant Partners. As described at clause 6.3, and strictly limited to the information set out there.
Payment service providers. Our payment service provider processes card and account transactions on our behalf, including collection of Reservation Deposits and Membership fees, placement and release of card authorisations, and issue of refunds. Full card details are held by the payment service provider and not by Sauce.
Service providers and data processors. We use service providers for cloud hosting, communications delivery, analytics and platform improvement. These providers process your personal data only in accordance with our instructions and have no right to process personal data for their own independent purposes. Because we use different processors and change them from time to time it is not possible to identify every individual recipient in this Privacy Policy, but we will be happy to disclose the name of the processors in use at any time on request.
Professional advisers. We work with third parties such as our auditors, lawyers and tax advisers who receive data from us on the basis of a contract and process it for legal reasons or to protect our legitimate interests. These parties are bound by a duty of confidence.
Tax and regulatory authorities. We disclose data to the Federal Board of Revenue and applicable provincial revenue authorities where required by law. This includes withholding statements identifying creators and other vendors, and any reporting required of an online marketplace, which may include Restaurant Partner tax registration numbers and transaction values.
Prosecuting authorities, courts and other public bodies. We may be obliged to disclose personal data to public authorities by reason of legal obligation, and it is also in our interest to prevent damage, enforce our claims and reject unjustified claims.
We do not sell your personal data to data brokers or advertisers. We may share aggregated, anonymised insights and diner dining preferences with Restaurant Partners through the Platform to help them serve you better, but we do not hand over our diner database or provide your contact details to any Restaurant Partner for their independent use.
8. How long we store your data
8.1 We retain your data for as long as it is needed to fulfil the Purposes for which it was collected, to comply with our legal and regulatory obligations, and to protect our legitimate interests. Different retention periods apply depending on the purpose of the processing.
8.2 In addition to our own deletion rules, there are legal retention periods which we must observe. Records relating to transactions, settlements, tax invoices, withholding and financial reporting must be retained for the period prescribed under applicable tax and corporate law, which is presently six (6) years. This includes creator CNIC and withholding records and Restaurant Partner tax registration and settlement records.
8.3 Where you have not used your account for a period of more than three (3) years we may delete your account in order to comply with the principle of storage limitation. Before doing so you will receive notification at the email address registered to your account.
8.4 We will continue to store your data where we have a right to do so under applicable law, in particular where the data is required for the establishment, exercise or defence of legal claims.
9. Security of your personal data
9.1 We apply technical and organisational measures appropriate to the sensitivity of the data we hold. Personal data is encrypted in transit and at rest. Internal access is restricted on a need-to-know basis. Identity and banking records are subject to tighter access controls than ordinary account data.
9.2 Payment card data is captured and stored by our licensed third party payment service provider in accordance with applicable payment card industry standards. Sauce does not store full payment card numbers.
9.3 No system can be guaranteed entirely secure. In the event of a personal data breach affecting your data, we will notify you and the relevant authorities as promptly as reasonably practicable and will explain the nature of the incident and the steps you should take.
10. Personal data of other individuals
If you provide us with the personal data of another individual through your use of the Platform, for example the name of a guest attending with you or the details of a person on whose behalf you are making a reservation, you undertake that you are authorised by that individual to disclose their personal data to us and that the individual has consented to their personal data being collected, used and disclosed by us for the Purposes.
11. Children
The Platform is intended for persons aged eighteen (18) years and above. We do not knowingly collect personal data from any person below the age of eighteen. Where we become aware that we have done so, we will delete that data.
12. Where your data is held
Your personal data may be stored on servers located outside Pakistan. Wherever your data is held, it remains protected by this Privacy Policy and by contractual safeguards agreed with our service providers requiring protection to a comparable standard.
13. Right of modification
We reserve the right to change this Privacy Policy in order to ensure compliance with relevant legal and statutory provisions. We will inform you of any significant change, such as a change of purpose or the introduction of a new purpose of processing.
14. Contact us
For any question concerning your privacy, or to make a request in respect of your personal data, please reach out to us at team@lionize-ai.com.