Privacy notice for employees of business customers

Your employer has a company account with us, through which you can order on the company’s account or with a subsidy. The controller for the processing described here is the business named above.

Your employer has sent us, or entered in the company portal, the following details: your name, your email address and, where given, your phone number, your staff number and your department. From these we assign an ID under which your orders are recorded. When you order, the order details are added.

• to assign orders on the company account to you and your employer;
• to print your ID on kitchen tickets and till receipts, so the order reaches the right person;
• to send your employer statements and invoices that list your orders with date and amount;
• to ask for approval where your employer approves orders above an amount;
• to send you emails about the company account, such as this notice or an invitation.

The legal basis is our and your employer’s legitimate interest in running and billing the company account (Art. 6(1)(f) GDPR) and, when you order yourself, the contract for your order (Art. 6(1)(b) GDPR).

Your employer and we are each independent controllers: your employer for passing your details to us and for what it does with the statements; we for the processing on our side.

Your employer receives the statements with your orders. The data is held by Supabase Inc. as our processor, and emails are sent via Amazon SES; transfers to the USA are covered by EU standard contractual clauses or the EU-US Data Privacy Framework. More in our privacy policy.

We keep your details in the company account for as long as your employer lists you there. If it removes you, we block the access; [TBD: set a deletion period for removed employees]. Orders, invoices and till receipts are kept for as long as the retention periods of the Fiscal Code and the Commercial Code require (up to 10 years).

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). Write to info@alsafi-heidelberg.de or contact your employer. You may also complain to a data protection supervisory authority. There is no solely automated decision-making.