unTill Air. Nothing holds you back. POS and payments in one app.
unTill Air. Nothing holds you back. POS and payments in one app.
Last updated: 30.09.2026
At unTill Air, we care about your privacy and want to be transparent about how we handle your personal data. This Privacy Policy explains, in plain language, how unTill AIR B.V. ("unTill Air", "we", "us") processes personal data when you visit our website, sign up for and manage an unTill Air account, receive support, or engage with our marketing. unTill Air provides a cloud-based point-of-sale (POS) software-as-a-service solution for the hospitality and retail sectors.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Dutch data protection law.
This Policy applies to the individuals whose personal data we process as a controller, in particular: the account holder and other authorised users who sign up for and manage an unTill Air account, visitors to our website and prospects who request a demo or subscribe to our newsletter. It does not apply to the personal data that our customers enter into the platform about their own staff or guests, which is governed by the DPA (see section 1).
To help you read this Policy, some key terms have the meaning given to them in the GDPR. "Personal data" means any information relating to an identified or identifiable natural person, such as a name, email address, telephone number or online identifier. A "controller" is the party that determines the purposes and means of the processing, whereas a "processor" processes personal data on behalf of, and on the documented instructions of, a controller. Information that relates solely to a business, and not to an identifiable individual, is generally not personal data. Where this Policy refers to "you", we mean the individuals described above.
It is important to distinguish between two different roles in which unTill Air processes personal data:
As a controller (this Policy). For the activities described in this Policy - such as account creation, subscription and invoicing - unTill Air determines the purposes and means of the processing and therefore acts as an independent controller. This Policy applies only to that processing.
As a processor (separate DPA). When our business customers use the unTill Air service to run their own operations, they enter data into the platform (for example about their staff or guests). For that data, our customer is the controller and is responsible for complying with applicable data protection law, including for having a valid legal basis and for handling requests from their own staff or guests; unTill Air acts only as a processor, on the customer's instructions. That processing is not governed by this Policy but by a separate Data Processing Agreement (DPA) between unTill Air and the customer.
The controller for the processing described in this Policy is:
unTill AIR B.V.
Korte Eeweg 11, 4424 NA Wemeldinge, the Netherlands,
registered with the Dutch Chamber of Commerce under number 90937287.
You can exercise your data protection rights or ask questions about this Policy by contacting privacy@untill.com.
Most personal data we process is provided by you directly. In some cases, we receive personal data about you from other sources.
Where we process personal data to enter into or perform our contract (such as account, subscription and invoicing data) or to comply with a legal obligation (such as invoicing and fiscal records), the provision of that data is a contractual and/or statutory requirement. If you do not provide this information, we may be unable to create or administer the account, provide the service, process billing, or meet our legal obligations.
Below we describe each processing activity. In everything we do with personal data, we aim to follow the core principles of the GDPR. We collect only the personal data we genuinely need for the purposes described below (data minimisation), we are transparent about how we use it, we take reasonable steps to keep it accurate and up to date, we protect it with appropriate technical and organisational measures, and we do not keep it for longer than necessary. If we ever intend to use your personal data for a new purpose that is not compatible with the purposes set out in this Policy, we will inform you beforehand and, where the law requires it, ask for your consent.
Account creation and sign-up
When the account holder (the person who signs up on behalf of a business) creates an unTill Air account, we process the information provided during sign-up, including first name, last name, company name, business type, country, email address, telephone number, password (stored in hashed form), and marketing consent status. We process this data in order to create and administer the account, authenticate the user at login, configure the applicable feature set, and manage the customer relationship. The legal basis is the performance of a contract with the account holder (Article 6(1)(b) GDPR). Where the account holder acts on behalf of a business, we additionally rely on our legitimate interest in entering into and administering the contract with that business (Article 6(1)(f) GDPR).
Subscription management and invoicing
For subscription administration and invoicing we process billing name and address (street, number, postal code, city), country, VAT number and, where applicable, other tax identifiers, subscription plan, and subscription/payment status data (such as trial start/end dates, next billing date, activation and cancellation status, payment method name and status, internal payment references, and invoice details).
We process this data to manage subscriptions, process billing, and maintain our accounts. The legal basis is the performance of a contract (Article 6(1)(b) GDPR) and, for the retention of invoicing records, compliance with a legal obligation (Article 6(1)(c) GDPR).
Customer support
When you contact us - for example to request support, to ask a question, or otherwise to get in touch with us - we process your contact details, the content of your request or message, and any related communications. We use this data to respond to and handle your request, to communicate with you, and to manage the customer relationship. We also process your telephone number for two-factor authentication during onboarding, to help secure your account. The legal basis is the performance of a contract (Article 6(1)(b) GDPR) and, for two-factor authentication and for handling general enquiries, our legitimate interest in assisting you and in securing accounts (Article 6(1)(f) GDPR). Support may be provided through automated, AI-assisted channels, and your request and the related conversation are processed in order to answer it.
Marketing
If you request a demo through our website - for example by scanning a QR code on the website and leaving your email address - we process your contact details through HubSpot. If you consent to receive our newsletter, we process your email address to send it. We process this data in order to respond to demo requests and to send marketing communications and newsletters. The legal basis is your consent (Article 6(1)(a) GDPR) or our legitimate interest for commercial purposes. You may withdraw your consent at any time, for example via the unsubscribe link in each newsletter or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.
Customer stories and testimonials
With your consent, we publish customer stories and testimonials on our website and in our marketing materials. In doing so, we process your name, job title, company name, your quote and, where applicable, photo or video material. The legal basis is your consent (Article 6(1)(a) GDPR). You may withdraw your consent at any time, after which we will remove or anonymise the relevant customer story. The withdrawal does not affect the lawfulness of processing before the withdrawal.
Security and service improvement
We process technical and usage data to operate, secure, maintain and improve our service. Where we use usage data to analyse and improve the service beyond what is necessary to provide and secure it, we do so on the basis of aggregated and fully anonymised data, which no longer constitutes personal data under the GDPR. We process this data in order to ensure the security, integrity and continuity of the service, to prevent fraud and abuse, and to improve our service. The legal basis is our legitimate interests in the security, reliability and improvement of our service (Article 6(1)(f) GDPR): our interest lies in protecting our systems and customers against unauthorised access and disruption and in developing a better, more reliable product, and we balance this against your interests and process only what is necessary for these purposes.
unTill Payments (payments and onboarding)
Payment functionality for unTill Payments is provided through Adyen, an independent, licensed payment provider. When you activate unTill Payments, the information required to set up and verify your payment account (such as identity and bank-account details) is collected and processed directly by Adyen through its own hosted onboarding, as an independent controller, in order to meet Adyen's legal obligations (including 'know your customer' and anti-money-laundering requirements). This Policy does not describe that onboarding and verification processing carried out by Adyen, please refer to Adyen's privacy documentation. In connection with unTill Payments we process personal data ourselves such as payout and transaction data and data relating to the administration of your payment account, in order to provide, administer and account for the service, and to comply with our own legal and tax obligations. Subscription payments for unTill Air are processed via our payment partner Chargebee.
We share personal data only with the following categories of recipients, and only to the extent necessary:
We do not sell personal data. Where a party acts as our processor, we enter into a data processing agreement with appropriate safeguards. In addition, we may disclose personal data where we are required to do so by law or by a binding request from a competent authority, court or supervisory body, or where disclosure is necessary to establish, exercise or defend legal claims. We may also share personal data with other parties where you have given us your consent to do so. In all cases we disclose only the personal data that is necessary for the relevant purpose.
We may also disclose personal data to a third party in the context of a merger, acquisition, reorganisation, or sale of all or part of our business or assets. In such a case we will ensure that the recipient continues to protect your personal data in a manner consistent with this Policy and applicable law, and we will inform you where required.
We store personal data within the European Union, in data centres located in the EU. Our hosting is provided by Hetzner Online GmbH (Germany and Finland).
Some of our service providers may process personal data outside the European Economic Area (EEA) or may be part of international groups. Where personal data is transferred outside the EEA, we ensure that appropriate safeguards under Chapter V GDPR are in place, such as an adequacy decision by the European Commission or the European Commission's Standard Contractual Clauses, together with any supplementary measures required.
We do not keep personal data longer than necessary for the purposes for which it is processed. The following retention periods apply for personal data:
Anonymised data may be retained indefinitely as it is no longer personal data.
Where a legal obligation, dispute or enforcement of our rights requires longer retention, we keep the relevant data for the period necessary for that purpose.
Under Chapter III GDPR, you have the right to:
To exercise these rights, contact us at privacy@untill.com. We may take reasonable steps to verify your identity before acting on a request, to ensure we do not disclose data to the wrong person. We will respond within the statutory time limits (in principle one month, extendable by two further months where permitted, in which case we will inform you within one month of receipt).
You also have the right to lodge a complaint with a data protection supervisory authority in the EU Member State where you live or work, or where the alleged infringement took place. In the Netherlands this is the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl).
We do not make decisions producing legal or similarly significant effects concerning you based solely on automated processing.
We take appropriate technical and organisational measures to protect your personal data. These include, among others: encryption of data in transit (TLS); role-based access control and, where applicable, multi-factor authentication; access limited to authorised personnel bound by confidentiality; network security measures and logging; and encrypted backups within the EU/EEA. Our hosting provider maintains recognised security certifications, including ISO/IEC 27001:2022 and BSI C5 Type 2.
You are responsible for keeping your account credentials confidential and for activities carried out under your account. Please notify us without delay at privacy@untill.com if you suspect any unauthorised use of your account.
Our website and service may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties, and we are not responsible for how they process your personal data. We encourage you to review their privacy statements.
We use cookies or similar techniques on our website. For more information about which cookies and techniques we use, for what purposes, and about any advertising or tracking purposes, please see our Cookie Policy at https://untillair.com/cookie-policy.html.
We may update this Policy from time to time to reflect changes in our services, technology or legal obligations. The version date at the top indicates when it was last updated. If we make material changes, we will let you know through an appropriate channel - for example by email - before they take effect, so that you are always aware of how we handle your personal data.
We are always happy to help. If you have any questions about this Privacy Policy, about the way we handle your personal data, or if you would like to exercise any of your rights, please contact us at privacy@untill.com. If you have a concern, we would welcome the opportunity to resolve it with you directly before you approach a supervisory authority - though you always retain the right to do so.
Try unTill Air 14 days for free - no payment details needed. Customise the app effortlessly for your business.
We’ve gathered all the information you need, so you can quickly and easily find the answers you’re looking for.
We’ve gathered all the information you need, so you can quickly and easily find the answers you’re looking for.