Restauranghubben privacy policy

Your privacy matters to us. This privacy policy covers Restauranghubben's website, web app and mobile app for iOS and Android, which uses a native wrapper. It explains how we process personal data when you visit the website, contact us, represent a customer company or use the service.

In short, we only use personal data for clear and legitimate purposes, such as providing and protecting the service, managing customer relationships and meeting legal obligations. We do not sell personal data and do not use personal data for behavioural advertising or tracking across different apps (cross-app tracking) in the mobile app.

This English version is provided for convenience. In the event of any discrepancy, the Swedish version prevails.

1. Who is responsible for personal data?

Restauranghubben is provided by:

Responsibility depends on the context in which personal data is processed.

When Restauranghubben is the controller

Restauranghubben is the controller for processing carried out for our own purposes, including when we:

• operate the public website,
• handle enquiries, customer relationships, contracts and invoicing,
• manage contact persons at customers and partners,
• provide support,
• protect the service, prevent misuse and handle technical logs,
• carry out product development using aggregated or, where possible, anonymised data,
• send information or marketing in accordance with applicable rules.

When Restauranghubben is a processor

When a customer company, such as a restaurant or restaurant group, uses the service for its staff, the customer is normally the controller for the personal data that the company and its users register in the service. Restauranghubben then processes the data as a processor on the customer's documented instructions and under a data processing agreement.

This applies, for example, to user accounts, department membership, staff messages, activity sign-ups, document acknowledgements and sign-offs and comments in routine and cleaning lists. Questions about such processing should primarily be directed to the company or employer that gave you access to Restauranghubben. We help the customer handle data subject rights when required.

2. What personal data do we process?

The data processed depends on how you interact with Restauranghubben.

Website visitors

• IP address and basic technical information about your device and browser.
• Choices made in the cookie centre.
• Usage and statistics data, but only after consent where such consent is required.
• Information you provide yourself in contact or enquiry forms.

Customer contacts and prospective customers

• Name, job title, company and department.
• Email address, phone number and other contact details.
• Contract, subscription, invoicing and payment-related data. We do not store full card details where payment is handled by a payment provider.
• Correspondence, meeting notes and support history.

Users of the service

• Name, email address, company/restaurant, department, role, permissions and user/account identifiers.
• Profile details and profile picture the user or the customer's administrator chooses to add.
• Employees' allergy information when the customer uses this feature. Allergies may constitute health data and sensitive personal data under the GDPR; the customer company is normally the controller for this processing.
• Registration numbers of employees' vehicles when the customer uses this feature.
• Chat messages and other free-text messages.
• Photos, images, documents and other content the customer or user uploads or creates.
• Activity sign-ups, read receipts and document acknowledgements, sign-offs, checklists, check-offs and comments in routine and cleaning lists, and other usage activity.
• Technical information such as login and session data, device information, IP addresses, timestamps and security logs.
• Push tokens, device/subscription identifiers, external user identifiers and notification settings when push notifications are used.

Customer data is normally processed on the customer company's instructions to provide staff and restaurant features. Processing for Restauranghubben's own purposes is described in sections 1 and 4.

Sensitive personal data and health data

Allergy information is used only for the intended staff and restaurant functionality. Restauranghubben normally processes it as a processor for the customer company. The customer is responsible for a legal basis under GDPR Article 6 and, for sensitive personal data, an applicable exception under Article 9, as well as informing data subjects.

Allergy information is not used for marketing, profiling or external AI training. Sensitive personal data must not be sent to AI features unless necessary, explicitly intended and legally permitted; see also section 5.

Users should not enter sensitive personal data or other privacy-sensitive information in free-text fields unless necessary and permitted. If a customer company chooses to process such data, the customer is responsible for ensuring there is a legal basis, that data subjects are informed and that the processing otherwise complies with applicable law.

3. Where do we get the data from?

We normally receive personal data:

• directly from you when you contact us or use the service,
• from the customer company or administrator who creates and manages your account,
• automatically from your device when you use the website or service,
• from suppliers who help us with authentication, hosting, support or payments, for example,
• from publicly available business sources when relevant to a business relationship.

4. Why do we process the data and on what legal basis?

Where processing is based on a balancing of interests, we have assessed that the processing is necessary for the purpose and that our interest does not override your rights and interests. You have the right to object to such processing.

The main purpose of personal data in the mobile app is app functionality. Internal usage statistics, such as active sessions and time in the service, are also processed to monitor and improve the product. This analysis is not behavioural advertising or cross-app tracking. The data is processed within our existing database solution, not through external advertising tools.

5. AI and document features

When the customer enables or uses such a feature, Google Gemini through Lovable's AI gateway may be used for menu, beverage, document and translation features, such as interpreting uploaded files, structuring information, translation and suggestions. Only the content needed for the task should be sent to the relevant provider.

Customer data and personal data must not be used for external AI training. Restauranghubben must use provider settings and agreements that do not permit such training on customer data, together with appropriate security measures. This is a requirement for the processing, not permission for a provider to train on the data.

Sensitive personal data, including allergy and other health information, must not be sent to AI features unless necessary, explicitly intended and legally permitted. The customer's approval does not replace the requirement for a legal basis under Article 6 and an applicable exception under Article 9. Other personal data and confidential information must also be limited to what is needed and may lawfully be processed for the task.

Restauranghubben does not use automated decision-making that produces legal effects or similarly significantly affects a person, unless we expressly inform you of this in advance.

6. Cookies and similar technologies

We use cookies and similar technologies, such as local storage, to make the website and service work. Strictly necessary technologies may be used without consent. Statistics, non-essential functional technologies and marketing are only enabled after you have made a voluntary choice.

You can change or withdraw your choice at any time via Cookie settings in the public footer or the Open cookie settings button on this page. Withdrawing consent should be as easy as giving it.

The cookie centre shows current information about each technology, including name, provider, purpose, category, type, retention period and whether a third party receives information.

Push notifications in the web and mobile apps

OneSignal is used as the push notification provider. On iOS, Apple Push Notification service (APNs) is the technical delivery channel. Push tokens and device/subscription identifiers may be associated with the user's account through an external user identifier to target relevant notifications, for example about messages and new content.

Push data is used for app functionality, not for advertising or cross-app tracking. You can manage or withdraw push permission in your operating system settings; web push permission is managed in your browser settings.

7. Who may receive the data?

We only share personal data when necessary and with an appropriate basis. Recipients may include:

• the customer company that administers the user,
• providers of hosting, databases, file storage, authentication, security and technical support,
• providers of email, push notifications and other communication,
• payment, finance and accounting providers,
• AI or document interpretation providers when such a feature is used,
• analytics or marketing providers, subject to consent,
• authorities, courts or other recipients when we are required to disclose data by law or to establish, exercise or defend legal claims.

Suppliers that process personal data on our behalf may only do so in accordance with contract and our documented instructions. We do not sell personal data.

Providers used in the service

8. Processing outside the EU/EEA

We aim to process data within the EU/EEA. If personal data is made available in a country outside the EU/EEA, we ensure the transfer has a legal basis and is covered by appropriate safeguards, such as a European Commission adequacy decision or standard contractual clauses together with supplementary measures where needed.

Contact us if you would like more information about a specific transfer and the safeguards used.

9. How long do we keep the data?

We do not keep personal data longer than necessary for each purpose. The following periods apply unless a contract, the customer's documented instructions or law requires otherwise:

Backups may persist for a limited rotation period and are then overwritten in line with our backup routines. Data may be kept longer if needed to meet legal requirements or to establish, exercise or defend legal claims.

10. How do we protect the data?

We use appropriate technical and organisational security measures based on the risks of the processing. These may include access control, separation between customer companies, logging, secure authentication, encrypted transfer, backups, up-to-date systems and routines for detecting and handling incidents.

Only people who need the data for their work should have access to it. No technical solution is entirely risk-free, but we work continuously to prevent unauthorised access, alteration, loss and disclosure.

11. Your rights

Depending on the circumstances, you have the right to:

• receive information about how your personal data is processed,
• request access to the personal data processed about you,
• have inaccurate or incomplete data corrected,
• request erasure,
• request restriction of processing,
• object to processing based on legitimate interest,
• always object to direct marketing,
• receive certain data in a structured, commonly used and machine-readable format where the right to data portability applies,
• withdraw consent at any time without affecting the lawfulness of processing already carried out.

These rights are not absolute. For example, legal requirements or the need to handle legal claims may mean that certain data cannot be erased immediately.

If, as an employee, you wish to request access to, correction or erasure of data for which the customer company is the controller, such as allergies, vehicle registration numbers or chat, you should normally contact your employer or the customer company's administrator. We assist the customer under the data processing agreement. For processing where Restauranghubben is the controller, you can contact us at info@restauranghubben.com. We may need to verify your identity before handling a request.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY). More information is available at imy.se.

12. Children and young users

The public website is aimed at businesses and is not specifically designed for children. Young people may, however, receive an account through their employer. The customer company is then responsible for ensuring the processing is lawful, proportionate and adapted to the young person's situation. Restauranghubben processes such data according to the customer's instructions and applicable safeguards.

13. Changes to this policy

We may update this policy when the service, our practices or applicable rules change. The latest version is always available on this page, with the date of the last update shown at the top. In the event of material changes, we will inform you appropriately, for example in the service or by email.

14. Contact

If you have questions about this policy or how Restauranghubben processes personal data, you are welcome to contact: