Alexander Bryant
Lauerstraße 8
69117 Heidelberg
Phone: +49 160 7270899
A Data Protection Officer has not been appointed, as fewer than 20 persons are regularly engaged in the automated processing of personal data (Section 38 BDSG).
We process personal data only insofar as this is necessary to provide our software and to fulfil statutory obligations. In detail:
a) Website Visit / Server Log Files
When you access our website, the hosting provider automatically collects information (IP address, timestamp, browser type, page accessed). This serves to ensure smooth operation of the service.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and stability of the service).
b) User Account / Contract Performance
To provide the software, the user's name, email address, and role are processed.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
c) Working Time Recording
Digital time recording (clocking in/out, shift scheduling) is carried out to fulfil the statutory record-keeping obligation under Section 16(2) ArbZG (German Working Time Act).
Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 16(2) ArbZG.
d) GPS Location Data
GPS location data is collected exclusively with the explicit consent of the employee and serves to verify the place of work when clocking in/out. Consent may be withdrawn at any time.
Legal basis: Art. 6(1)(a) GDPR (consent).
e) Payroll / Reporting Obligations
Personnel data (name, date of birth, tax ID, social security number, bank details) is processed for the purpose of payroll accounting and to fulfil tax and social security reporting obligations.
Legal basis: Art. 6(1)(c) GDPR in conjunction with EStG (Income Tax Act), SGB IV, SGB V.
f) Team Chat
The internal chat function serves operational communication between employees and supervisors.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient operational communication).
g) IfSG Health Briefings
The documentation of briefings pursuant to Section 43 IfSG (German Infection Protection Act) is legally required for gastronomy businesses. The date of the initial briefing, follow-up briefings, and supporting documentation are stored.
Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 43 IfSG.
h) Leave and Absence Management
The management of leave requests, leave balances, sick notes, and absence calendars is carried out for the performance of the employment contract and to fulfil statutory obligations.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligation, in particular BUrlG (Federal Leave Act), EFZG (Continued Remuneration Act)).
i) Push Notifications
With active consent, push subscription data (endpoint, keys) is stored in order to send notifications about shift changes, messages, and other relevant events. Consent may be withdrawn at any time.
Legal basis: Art. 6(1)(a) GDPR (consent).
j) Tip Management
As part of tip management, tip pools, distribution amounts, and tronc master assignments are processed.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
k) Operations Management
Management of operational resources, maintenance logs, and contracts. Personal data is only processed insofar as employees are assigned as contact persons or responsible parties.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient business operations).
Personal data is only disclosed where this is required by law or necessary for the performance of a contract:
api.open-meteo.com for shift-planning weather widgets; no third-country transfer, no DPA required — see §4a)To support shift planning, the dashboard, terminal, operational calendar and coverage view display current weather data (temperature, precipitation, weather code for the restaurant location).
The weather data is sourced from:
Data transmitted: Restaurant geo coordinates (statically configured, no live GPS), end-device IP address on direct client fetch (dashboard widget), user agent, HTTP referer (app subdomain). For terminal weather and the 8-day forecast, the request runs server-side (server action weather.actions.ts) so that only the application server's IP — not the individual employee IP — is sent.
Recipient location: Bremen, Germany. No third-country transfer (Art. 44 GDPR not triggered).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in weather-driven shift and demand planning typical for hospitality operations). IP addresses are considered personal data under BGH I ZR 90/20 and CJEU C-582/14 (Breyer); disclosure is therefore made in accordance with Art. 13(1)(e) GDPR.
Per Open-Meteo's own privacy notice (open-meteo.com/en/terms), no personal data of end users is retained. No tracking, no cookies, no profiling. The weather data licence is CC-BY 4.0; attribution is rendered via the in-app WeatherAttributionFooter.
Our primary hosting and database infrastructure is located in Germany (Hetzner Online GmbH, Nuremberg/Falkenstein). However, some optional third-party services we rely on involve transfers outside the EEA and are therefore only activated when required:
An up-to-date list of sub-processors with country of processing is maintained in our data processing agreement (DPA), which is available on request. We continuously evaluate EU-based alternatives (see German version, section 11a).
Personal data is deleted as soon as the purpose of processing no longer applies and no statutory retention obligations prevent deletion. The following retention periods apply:
After expiry of the statutory retention periods, data is automatically deleted or anonymised.
In the context of personnel management, special categories of personal data within the meaning of Art. 9(1) GDPR may be processed. This concerns in particular:
Legal basis: Art. 9(2)(b) GDPR in conjunction with Section 26 BDSG (processing for the purposes of the employment relationship, insofar as this is necessary for the exercise of rights or the fulfilment of legal obligations arising from employment law, social security law, and social protection law).
The provision of your personal data is partly required by law (e.g. working time recording under Section 16 ArbZG, health certificate under Section 43 IfSG) and partly necessary for the performance of the contract (e.g. shift scheduling, payroll). Without the provision of the required data, we cannot provide our contractual services.
GPS location recording is voluntary (consent); non-provision has no negative consequences -- time recording works without GPS.
You have the following rights vis-a-vis the data controller regarding your personal data:
To exercise your rights, please contact: alexander.bryant2718@gmail.com
For data portability requests, we provide your data in a commonly used, machine-readable format (CSV or JSON). Requests are processed within 30 days of receipt (Art. 12(3) GDPR).
This application contains automated individual decisions within the meaning of Art. 22(1) GDPR inside the Compliance Autopilot. There are currently 29 decision categories classified as "solely automated with legal effect" (i.e. the system blocks a shift assignment, prevents clock-in or marks a contract as invalid without a mandatory manual approval step). Following CJEU C-634/21 (Schufa, 07.12.2023), Art. 22 already applies where the downstream step de facto adopts the algorithmic result.
Decision categories in use (selection):
A complete, continuously up-to-date list of all automated decisions — including the underlying logic, the data categories processed and the specific legal basis (required by Art. 13(2)(f) / Art. 14(2)(g) GDPR) — is available at Algorithmic Management.
Your rights under Art. 22(3) GDPR
For each of these automated decisions you have the right to
These rights can be exercised through the contest form at My Account → Data Protection → Contest Decision. Contests are reviewed within 30 days (Art. 12(3) GDPR). The automated decision may, in justified cases, be suspended during the review.
Non-automated recommendations
The following processes are not solely automated decisions within the meaning of Art. 22(1) GDPR because the final choice is always made by the manager / owner:
Personal data of employees may also be entered into the system by the employer (owner/management), e.g. when creating an employee profile. In this case, the data is not collected directly from the data subject (Art. 14 GDPR). The data subject is informed about the processing upon first login and asked for consent.
Categories of data collected: name, email, date of birth, employment type, hourly wage, tax ID, social security number, IBAN, tax class, health insurance. Source: employer's records from the employment contract.
The information is provided in accordance with Art. 14(3) GDPR no later than one month after collection of the data or upon the first communication with the data subject.
The processing of employee data is subject to additional regulations beyond the general provisions of this privacy policy:
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent supervisory authority for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI)
To protect your personal data, we have implemented the following technical and organisational measures:
The software uses only technically necessary session cookies that are required for the operation of the application and the maintenance of the user session. These cookies are automatically deleted at the end of the browser session.
As no tracking, analytics, or marketing cookies are used, a cookie banner is not required (Section 25(2) No. 2 TDDDG).
This software is hosted by:
Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen, Germany
A data processing agreement (Auftragsverarbeitungsvertrag) pursuant to Art. 28 GDPR has been concluded with the hosting provider. The hosting provider processes data exclusively in Germany.
To provide our services, we use the following sub-processors:
api.open-meteo.com) for shift/demand-planning widgets. Geo coordinates and (on direct client fetch) the end-device IP address are transmitted. No employee personal data. Open-Meteo acts as independent controller; no DPA required. No third-country transfer (DE server). Licence CC-BY 4.0.The current status of this register is published on this page and documented in the version history below. Under the data processing agreement, the client has the right to object to the engagement of new sub-processors.