Privacy notice for staff

The controller for the data of our staff is the business named above, as the employer.

This notice applies to everyone who works for us and uses our staff app: the till, the service handsets, the kitchen display, the time clock and the admin area. It adds to the information you received with your employment contract.

Unless stated otherwise, the legal basis is the performance of the employment relationship (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

For your access we store your name, the name shown on screen, your login name, your role and permissions and, for the admin area, your email address. Your PIN is stored only as a check value (hash); nobody in the business can read it in plain text. The purpose is that only authorised people use the till and the staff app, and that every action can be attributed to a person.

The till, handsets and kitchen display are paired with our system. We store which device is paired and who signed in and out on which device and when, together with the session keys this needs. The purpose is the security of the system and the attribution of actions (Art. 6(1)(f) GDPR). Retention: 90 days.

When you clock in and out, we store the start, end and breaks of each shift to the minute, and your planned shifts from the rota. The purpose is recording working time as the Working Hours Act and the Minimum Wage Act require, and payroll (Art. 6(1)(b) and (c) GDPR).

Retention: time records and the rota are deleted automatically 2 years after the end of the shift. What must be kept longer for payroll is held in the payroll records.

The till and the order management record who did what: who created, changed, accepted or completed an order; who voided an item or a receipt or issued a refund; who put cash in, took it out or paid it out; who opened and counted the till and closed the day; and who edited tables and guest records. Each entry stores your ID, the time and the action.

The purpose is the traceability of till transactions required by the Fiscal Code and the Cash Register Security Regulation, cash reconciliation, and protection against errors and misuse (Art. 6(1)(c) GDPR with §§ 146a, 147 AO; Art. 6(1)(f) GDPR). An automatic check looks through these logs for anything unusual, such as a void after payment, a bill cut after the interim bill, the cash drawer opened without a sale, high discounts or a difference at the till close. Each flag names the person, the time and the action. The owner sees all flags. Shift managers see the open flags of the current day with names, so they can talk to the person during the shift; they do not see flags about themselves. A flag is not an accusation: it is discussed with you before anything is decided. We delete reviewed flags after 12 months; open and escalated cases stay until they are closed. We do not use the logs to monitor performance or behaviour in general. Only on a specific suspicion of theft or fraud do we analyse them in a targeted way, and we inform you about it.

Retention: till and accounting records, which these entries are part of, are kept for as long as the retention periods of the Fiscal Code require (up to 10 years).

A tip a guest adds when paying is stored with the order and so attributed to the person who settled it. The purpose is distributing and documenting tips. Tips are split by hours worked. The owner and the shift lead see the evaluation.

If you deliver for us, you use the driver app on a paired phone, which may be your own. We store when you start your delivery shift, which orders are given to you or you take, when you set off and deliver, a problem at the door with your note, the cash tip you enter, the change float the till gives you, and what the till counts when you are back. Your location is not recorded. The purpose is organising deliveries and accounting for cash (Art. 6(1)(b) and (c) GDPR). Entries in the cash book are kept as long as the other till data.

For the delivery, the app shows you guests' names, phone numbers, delivery addresses and notes, only for orders given to you and only until they are delivered. You may use these details only for the delivery. How we process guests' data is set out in our privacy policy for guests.

If you switch it on yourself, we show guests your photo, the name you chose for guests (first name or nickname, never your surname) and a short greeting: on the page where guests track their order while the kitchen cooks, and on the feedback page when a guest wants to thank you. Guests only see this through their own order link or their table's QR code, never on public pages.

The legal basis is your consent alone (Art. 6(1)(a) and Art. 7 GDPR, § 26(2) BDSG). It is voluntary: not giving it has no disadvantage for you at all. Only you can switch it on, with your PIN on the till under “Shown to guests”. You can withdraw it there at any time; your photo is then no longer shown to guests within a minute. Every change is stored with its time so we can show your consent. A new photo needs a new consent.

Retention: the photo and greeting are kept in non-public storage and deleted when you have the photo removed or leave the business. Thanks from guests that name you are shown to you on the till; they are not used to assess your performance.

The data is held by Supabase Inc. as our processor (Art. 28 GDPR); transfers to the USA are covered by EU standard contractual clauses. Till transactions are signed by the technical security device of fiskaly GmbH. During a cash inspection or tax audit the tax office may inspect the till data.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we rely on our legitimate interest, you may object on grounds relating to your particular situation (Art. 21). Write to info@alsafi-heidelberg.de for any of these. You may also complain to a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

Without your access and the time clock you cannot use the staff app; there is no solely automated decision-making.