Data Sharing and Integrations

Last updated: 22/05/2026

This page explains how data sharing and integrations operate through Trac.

1. Customer control

Customers control which integrations are enabled for their organisation, subject to applicable agreements, permissions, and third-party system requirements.

Where an Integration Partner initiates or manages an integration, that Integration Partner is responsible for ensuring it has the necessary authority from the relevant organisation.

2. Authorisation

Data should only be shared through Trac where:

• the relevant organisation has authorised the integration;
• the relevant data controller has provided instructions or permission where required;
• the data sharing is lawful;
• any third-party system requirements have been met.

3. Types of systems

Trac may support integrations with:

• management information systems;
• point of sale systems;
• finance systems;
• online payment systems;
• catering systems;
• middleware providers;
• reporting and analytics platforms;
• other third-party systems.

4. Data flows

Depending on the integration, Trac may receive, transmit, structure, enrich, transform, or make data available between authorised systems.

Data flows depend on the agreed integration, authorised data scopes, technical configuration, and third-party system restrictions.

5. Data minimisation

Only data necessary for the agreed purpose should be requested, accessed, transmitted, or processed.

Customers and Integration Partners should regularly review data scopes to ensure they remain appropriate.

6. Revocation

Customers may request that integrations are disabled.

Third-party systems may also revoke, suspend, or restrict access.

Where access is revoked or restricted, related Trac functionality may be affected.

7. Responsibilities

Customers and Integration Partners are responsible for:

• ensuring lawful data sharing;
• managing internal permissions;
• ensuring data accuracy;
• complying with third-party terms;
• informing relevant users or data subjects where required.

Caterlytix is responsible for operating Trac in accordance with applicable agreements.

8. Third-party systems

Caterlytix is not responsible for the availability, performance, security, or data practices of third-party systems.

Third-party systems may impose their own permissions, controls, rate limits, and terms.