Alexander Bryant
Lauerstraße 8
69117 Heidelberg
Phone: +49 160 7270899
A Data Protection Officer has not been appointed, as fewer than 20 persons are regularly engaged in the automated processing of personal data (Section 38 BDSG).
We process personal data only insofar as this is necessary to provide our software and to fulfil statutory obligations. In detail:
a) Website Visit / Server Log Files
When you access our website, the hosting provider automatically collects information (IP address, timestamp, browser type, page accessed). This serves to ensure smooth operation of the service.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and stability of the service).
b) User Account / Contract Performance
To provide the software, the user's name, email address, and role are processed.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
c) Working Time Recording
Digital time recording (clocking in/out, shift scheduling) is carried out to fulfil the statutory record-keeping obligation under Section 16(2) ArbZG (German Working Time Act).
Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 16(2) ArbZG.
d) GPS Location Data
GPS location data is collected exclusively with the explicit consent of the employee and serves to verify the place of work when clocking in/out. Consent may be withdrawn at any time.
Legal basis: Art. 6(1)(a) GDPR (consent).
e) Payroll / Reporting Obligations
Personnel data (name, date of birth, tax ID, social security number, bank details) is processed for the purpose of payroll accounting and to fulfil tax and social security reporting obligations.
Legal basis: Art. 6(1)(c) GDPR in conjunction with EStG (Income Tax Act), SGB IV, SGB V.
f) Team Chat
The internal chat function serves operational communication between employees and supervisors.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient operational communication).
g) IfSG Health Briefings
The documentation of briefings pursuant to Section 43 IfSG (German Infection Protection Act) is legally required for gastronomy businesses. The date of the initial briefing, follow-up briefings, and supporting documentation are stored.
Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 43 IfSG.
h) Leave and Absence Management
The management of leave requests, leave balances, sick notes, and absence calendars is carried out for the performance of the employment contract and to fulfil statutory obligations.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligation, in particular BUrlG (Federal Leave Act), EFZG (Continued Remuneration Act)).
i) Push Notifications
With active consent, push subscription data (endpoint, keys) is stored in order to send notifications about shift changes, messages, and other relevant events. Consent may be withdrawn at any time.
Legal basis: Art. 6(1)(a) GDPR (consent).
j) Tip Management
As part of tip management, tip pools, distribution amounts, and tronc master assignments are processed.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
k) Operations Management
Management of operational resources, maintenance logs, and contracts. Personal data is only processed insofar as employees are assigned as contact persons or responsible parties.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient business operations).
Personal data is only disclosed where this is required by law or necessary for the performance of a contract:
Our primary hosting and database infrastructure is located in Germany (Hetzner Online GmbH, Nuremberg/Falkenstein). However, some optional third-party services we rely on involve transfers outside the EEA and are therefore only activated when required:
An up-to-date list of sub-processors with country of processing is maintained in our data processing agreement (DPA), which is available on request. We continuously evaluate EU-based alternatives (see German version, section 11a).
Personal data is deleted as soon as the purpose of processing no longer applies and no statutory retention obligations prevent deletion. The following retention periods apply:
After expiry of the statutory retention periods, data is automatically deleted or anonymised.
In the context of personnel management, special categories of personal data within the meaning of Art. 9(1) GDPR may be processed. This concerns in particular:
Legal basis: Art. 9(2)(b) GDPR in conjunction with Section 26 BDSG (processing for the purposes of the employment relationship, insofar as this is necessary for the exercise of rights or the fulfilment of legal obligations arising from employment law, social security law, and social protection law).
The provision of your personal data is partly required by law (e.g. working time recording under Section 16 ArbZG, health certificate under Section 43 IfSG) and partly necessary for the performance of the contract (e.g. shift scheduling, payroll). Without the provision of the required data, we cannot provide our contractual services.
GPS location recording is voluntary (consent); non-provision has no negative consequences -- time recording works without GPS.
You have the following rights vis-a-vis the data controller regarding your personal data:
To exercise your rights, please contact: alexander.bryant2718@gmail.com
For data portability requests, we provide your data in a commonly used, machine-readable format (CSV or JSON). Requests are processed within 30 days of receipt (Art. 12(3) GDPR).
This application uses automated processing to support workforce planning:
None of these processes constitutes solely automated decision-making within the meaning of Art. 22(1) GDPR, as human review is always involved. You have the right to request a manual review of any automated recommendation.
Personal data of employees may also be entered into the system by the employer (owner/management), e.g. when creating an employee profile. In this case, the data is not collected directly from the data subject (Art. 14 GDPR). The data subject is informed about the processing upon first login and asked for consent.
Categories of data collected: name, email, date of birth, employment type, hourly wage, tax ID, social security number, IBAN, tax class, health insurance. Source: employer's records from the employment contract.
The information is provided in accordance with Art. 14(3) GDPR no later than one month after collection of the data or upon the first communication with the data subject.
The processing of employee data is subject to additional regulations beyond the general provisions of this privacy policy:
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent supervisory authority for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI)
To protect your personal data, we have implemented the following technical and organisational measures:
The software uses only technically necessary session cookies that are required for the operation of the application and the maintenance of the user session. These cookies are automatically deleted at the end of the browser session.
As no tracking, analytics, or marketing cookies are used, a cookie banner is not required (Section 25(2) No. 2 TDDDG).
This software is hosted by:
Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen, Germany
A data processing agreement (Auftragsverarbeitungsvertrag) pursuant to Art. 28 GDPR has been concluded with the hosting provider. The hosting provider processes data exclusively in Germany.
To provide our services, we use the following sub-processors:
The current status of this register is published on this page and documented in the version history below. Under the data processing agreement, the client has the right to object to the engagement of new sub-processors.