These documents are being finalised. Any details marked “to follow” will be added shortly.

Staff IT and data policy

This policy is for everyone who works at Capri Mirfield, Capri Newmillerdam or Capri @ The Vine. It sets out how you must use our tills, computers, email, Wi-Fi and phones, and how you must look after customer and staff information. Please read it when you join and ask your manager if anything is unclear.

1. Your logins and passwords

You will be given your own login for the till system (Lightspeed) and, where your job needs it, your own Microsoft 365 email account. Your login is personal to you. Never share your password or PIN, never use someone else's login, and never write passwords where others can see them. Use a password that is long and hard to guess, and do not use it for anything else. Tell your manager straight away if you think someone knows your password.

2. Tills and payments

Only use the till under your own login, and log out or lock it when you walk away. Never write down, photograph or keep a customer's card number or security code. Deposits taken by phone must be keyed straight into the card machine and nothing about the card written down.

3. Computers, email and Wi-Fi

Restaurant computers and email are for work. Lock the screen whenever you leave a computer. Do not install software, plug in unknown USB sticks or turn off antivirus or updates. Be careful with emails asking you to click a link, open an attachment, change bank details or pay an invoice, even if they seem to come from someone you know. If something looks wrong, do not click it, and tell your manager.

The staff Wi-Fi password is for staff only and must not be given to customers or friends. Customers should use the customer Wi-Fi. Wi-Fi passwords are changed regularly and when staff leave.

4. Phones and messaging

You may use work messaging groups to organise shifts and service, but keep customer details out of them as far as possible. Do not take photos of bookings, the booking diary, customers, CCTV screens or anything else with personal information on it. Do not post anything about customers or colleagues on social media. If you lose a phone that has work messages or work email on it, tell your manager the same day.

5. Customer information

Only look at or use customer information you need for your job. Allergy and dietary notes must be used only to serve that customer safely. Never give a customer's details to anyone outside the business, including over the phone, unless a manager has confirmed it is allowed. Marketing must only go to customers who have ticked the consent box.

6. Paper records

Booking sheets, staff forms and anything else with personal information on it must be kept out of sight of customers, stored in the locked filing system when not in use, and shredded when no longer needed. Never put personal information in the general bin.

7. CCTV

CCTV is used for safety and security, as set out in our CCTV policy. Only managers and directors may view recordings. You must not copy, photograph or share CCTV images.

8. Checking our systems

To keep our systems and information safe, we may check how business systems such as the till, email and network are used, for example to investigate a security problem or a suspected breach of this policy. Any checks will be proportionate and in line with the law. Your staff privacy notice explains how we use your information.

9. Reporting problems

If personal information is lost, stolen, sent to the wrong person or seen by someone who should not see it, or you think a computer, till or account may have been hacked, tell your manager or (details to follow) straight away, even if you are not sure. You will not be in trouble for reporting a genuine mistake quickly. Our data procedures explain what happens next.

10. When you leave

On your last day, hand back any keys, equipment and paperwork, and do not keep any customer or business information. Your logins will be removed and any shared passwords you knew will be changed.

11. Breaking this policy

Breaking this policy may lead to disciplinary action. Misusing personal information can also be a criminal offence under the Data Protection Act 2018.

Last updated: 3 November 2026