Application privacy annexes
What each application collects, why, and how to delete an account.
How to read these annexes
Each annex supplements the master Privacy policy for one application. Where an annex and the master policy differ, the annex governs for that application.
In every case, where the application is used on behalf of a venue, hotel, operator or employer, that organisation is the controller and Castis is the processor.
Spatio Staff — iOS and Android
Purpose. Tasks, device registration and monitoring, housekeeping status, attendance, messaging and multi-factor authentication for staff of an organisation that subscribes to the platform.
Data collected. Name, employee or account identifier, employer organisation and workspace, role and permissions, shift and attendance records, tasks assigned and completed, messages, device identifier and application version, crash diagnostics.
Permissions requested. Camera — to scan device codes and capture proof of task completion. Location — only while clocking in or out, to validate presence at a work site; not collected in the background. Notifications — to deliver task, alert and message notifications. Microphone — only if push-to-talk is enabled for your role.
Not collected. Contacts, photo library, health data, advertising identifiers. No third-party advertising or analytics software development kits are embedded.
Account deletion. Staff accounts are created and owned by your employer. See the Delete your account page, which explains how a personal account is deleted and which employment records the employer is required to retain.
eTiket — iOS and Android
Purpose. Purchasing, holding and presenting tickets for attractions and public venues, and entry validation at the gate.
Data collected. Name, e-mail address, telephone number, ticket and order records, entry and redemption events, device identifier, application version, crash diagnostics.
Payment. Card and payment credentials are collected and processed by the payment provider. Castis receives a transaction reference and status, not the full card number.
Permissions requested. Camera — to scan a ticket code. Notifications — for order and entry confirmations. Location — optional, only to show nearby venues, and only with permission.
Account deletion. Available in the application under Account, and by request at the Delete your account page. Completed transaction records are retained for the period required by tax and consumer protection law.
Guest Concierge — web and QR
Purpose. Guest requests, property information and service ordering, from a guest's own device or an in-room television.
Data collected. Room or stay reference, request content, language preference, and technical data necessary to deliver the session. Where a guest is identified, that identification comes from the venue's property management system.
Controller. The venue operator. Requests for access or deletion should be made to the venue, which we will assist.
Retention. Request and service records are retained by the venue under its own policy, within the retention configured for its tenant.
PlayTelly TV — webOS, Android TV and set-top box
Purpose. Delivering television channels, in-room information and guest services to a screen in a room or a public space.
Data collected. Device identifier, room or space assignment, channel and playback events, playback quality measurements, application version and diagnostics.
Personal identification. The television client does not require a personal account. Where a guest session is active, the stay reference comes from the venue's systems and ends when the stay ends.
Advertising. Where in-room advertising is enabled by the venue, measurement is at the level of the screen and the session, not a personal profile.
Kitchen Display and Queue Display
Purpose. Displaying order queues, preparation status and service calling on a fixed screen inside a venue.
Data collected. Order and queue records supplied by the venue's own systems, device identifier and diagnostics. No personal account is used and no camera, location or microphone permission is requested.
Distribution. These applications are installed under managed device enrolment by the venue, not downloaded from a public store.