Privacy Policy

Controller

[Placeholder: Company name, street and number, postal code and city], Germany

Represented by: [Placeholder: Name of the managing director(s)]

Email: sales@Xpresskasse.de

Data protection officer: [Placeholder: Name and contact, if appointed]

Overview of processing

We operate a POS and ordering platform for restaurants. In providing the platform, we process in particular: account and access data (name, email address, password hash), restaurant and location data, order and customer data, fiscal and cash register data (TSE transactions), uploaded files (e.g. logos) and support requests.

Hosting and server logs

The application is hosted at [Placeholder: add hosting provider and server location]. When you access the pages, technically required data is processed (e.g. IP address, time, requested resource, user agent) to ensure operation and security. The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in secure operation).

Registration and login

Using the POS requires a user account. For this we process your email address and a password (hashed). Optionally you can use sign-in via Google, passkeys or two-factor authentication; the data required for each method is processed. A session cookie is set to manage your session. Legal basis: Art. 6 (1) lit. b GDPR.

Fiscal and cash register data (TSE)

To fulfil fiscal and cash register obligations, order and payment data is connected to and signed by a certified cloud TSE ([Placeholder: add provider, e.g. fiskaly]). Data is retained in accordance with statutory retention obligations (in particular § 147 AO, GoBD) for up to 10 years. Legal basis: Art. 6 (1) lit. c GDPR.

Order and customer data

For the restaurants managed on the platform, we process order data (order items, delivery or pickup information, guest contact details). Where we act as a processor, processing is based on a data processing agreement ([Placeholder: add DPA]).

Cookies and consent

We use technically necessary cookies: NEXT_LOCALE (saved language) and a consent cookie (your consent decision). Non-essential cookies or analytics services are only set with your consent ([Placeholder: add any analytics services actually used]). You can withdraw your consent at any time by deleting the cookies in your browser.

Recipients and third-country transfers

We use carefully selected service providers: hosting [Placeholder], certified TSE [Placeholder: provider], object storage for uploads (S3-compatible) [Placeholder: provider and region]. Mapbox (USA) may be used for map and address features; the basis is the EU Standard Contractual Clauses (Art. 46 GDPR). The marketing website loads images from Unsplash (USA).

Retention period

We store account data until the account is deleted. Fiscal and cash register data is subject to statutory retention periods (up to 10 years). Server logs are deleted after [Placeholder: retention period].

Your rights

You have the right to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw any consent you have given at any time. You also have the right to lodge a complaint with a data protection supervisory authority.

Changes to this privacy policy

We will update this policy if the legal situation or our processing changes. The version published on this page applies.