Privacy Policy

1. The essentials in brief

GastroSubs brings hospitality businesses and Helpers together. For that to work, we process personal data. The essentials first:

• We do not pass your data on to advertisers and we do not sell it.
• If you apply for a Shift as a Helper, we transmit your profile to the Business that advertised it. That is the purpose of the platform. Contact details you mark as hidden are not included. Full name and place of residence, by contrast, are always included. The Business receives your address and date of birth only when it takes you on – it then needs them for registration for social insurance.
• Businesses can search for Helpers. In the search, street address, date of birth, gender and contact details are never visible. You can also remove your profile from the Helper search entirely – Businesses then only see you once you apply of your own accord.
• We use no analytics tools, no advertising networks, no third-party fonts and no tracking cookies.
• Our servers are located in Germany. No transfer to countries outside the EU takes place.
• You can delete your account at any time.

The detailed version is set out below. It is long because the General Data Protection Regulation requires complete information – not because a great deal happens out of sight.

2. Controller

The controller within the meaning of Art 4(7) GDPR is:

[company name as entered in the companies register]

[street, number]

[postcode, town], Austria

Companies register number: [FN …], companies register court: [Landesgericht …]

Email: [datenschutz@gastrosubs.net]

Telephone: [+43 …]

Data protection officer: We have not appointed a data protection officer because the conditions of Art 37 GDPR are not met.

3. Where this data comes from and what it is based on

We process data

• that you enter yourself (registration, profile, advertisements, Applications, messages) – Art 13 GDPR provides information on this;
• that arises automatically when you use the platform (server logs, technical details of your device);
• that others enter about you – for example when a Business names a contact person or when a Business adds you to its saved list. Art 14 GDPR provides information on this; section 6 deals with it.

The legal bases we rely on:

4. The individual processing operations

4.1 Accessing the website and the app (server logs)

Which data: IP address, date and time of access, address accessed, volume of data transferred, status code, referring page, browser and operating system identifier.

Purpose: delivery of the page, operational security, detecting and tracing attacks and faults.

Legal basis: lit b for delivery, lit f for security and troubleshooting. Our legitimate interest is stable and secure operation.

Retention period: 7 days, then automatic deletion. Longer in the case of a specific security incident, until the incident has been resolved.

4.2 Registration and user account

Which data – for everyone: email address (also the login name), password (stored only as a hash value that cannot be reversed), role (Business or Helper), time of registration, confirmation status of the email address and the associated confirmation key together with its expiry time.

Additionally for Helpers: first name, surname, date of birth, gender, postcode, town, street, country, mobile number, chosen working days. Voluntary: photo, "About me" text, years of professional experience, skills, search agent.

Additionally for Businesses: company name, invoicing address (street, postcode, town, country), voluntarily the VAT identification number, and for each Business Location the name, address, country, telephone number and, voluntarily, email address, homepage, description and image.

Purpose: creating and maintaining the account, logging in, allocating Shifts, Applications and messages, invoicing for Businesses.

Legal basis: lit b. For voluntary details (photo, "About me", experience, skills, VAT number) lit a or lit b, in so far as they form part of the profile that you determine yourself.

Retention period: for as long as the account exists. After deletion, see section 8.

4.3 Confirmation of the email address, change of the login address

Which data: email address, confirmation key, expiry time; where an address is changed, additionally the new address, which is stored separately until it is confirmed.

Purpose: ensuring that the address exists and belongs to you; protection against the takeover of other people's accounts.

Legal basis: lit b, supplemented by lit f (security).

Retention period: The key becomes invalid on confirmation or on expiry after 24 hours and is overwritten the next time the process is carried out.

4.4 Locating addresses and place validation

Which data: the place name you enter together with the country, and the geographical coordinates of the centre of that place derived from it.

Purpose: radius search, distance display, checking whether a place entered exists in the selected country.

Legal basis: lit b.

How this works: We operate our own place database with around 99,000 municipalities based on the freely available data from GeoNames. The vast majority of queries are answered by this database without any data leaving our system. If it does not know a place, our server – not your device – makes a one-off query to the Photon service (OpenStreetMap) and remembers the result. Only the place name and the country are transmitted in the process. Your IP address and your other data are not transmitted, because the query originates from our server.

Recipient: Photon, operated by komoot GmbH, Germany – and only in the exceptional case described.

Important: The coordinates are always set by the server from the place name; any coordinates sent along with the request are ignored. They designate the municipality, not your home address – your street is not geolocated. This is different only if you use "Use my location" (see 4.5).

4.5 Location request in the browser ("Use my location")

Which data: the coordinates reported by your device (longitude and latitude).

Purpose: radius search from your current location and calculation of the distance to a Shift.

Legal basis: lit a – your consent. You give it in your app's permission dialogue and can withdraw it there at any time.

What happens to them: The coordinates are stored in your profile, where they replace the coordinates that we otherwise derive from your place name (see 4.4). They are thus the basis of every radius search and of every distance figure that concerns you – including the distance displayed to a Business in the Helper search. We do not display the coordinates themselves to Businesses; only the distance in kilometres calculated from them is visible.

Retention period: They remain stored until you request your location again – they are then overwritten – or until you delete your user account. If you enter your place in your profile anew, the coordinates derived from it take their place again.

What this means: The coordinates reported by your device are more precise than the centre of a municipality and may point to your home address. If you do not want that, enter a place name instead of using "Use my location" – the coordinates of the municipality then continue to apply.

4.6 Advertising Shifts (Businesses)

Which data: title, position, date, start and end, place of assignment, pay, number of Helpers required, description, visibility, allocated Business Location, times of creation and of the last review of Applications.

Purpose: publishing the Shift, findability in the search, handling of the Applications.

Legal basis: lit b.

Visibility: Publicly advertised Shifts can be found even without logging in. For visitors without an account we show only the town – never the street, name, contact details or image of the Business Location. Shifts limited to a Business's saved list do not appear in the public search at all.

4.7 Application – the transmission to the Business

This is the platform's central transmission, and is therefore set out in detail.

Which data goes to the Business that advertised the Shift: photo, full first name and surname, place of residence, age (not the date of birth), gender, professional experience, skills, "About me" text, your application message, and those contact details (email address, telephone number) that you have not marked as hidden.

What is not transmitted: your street, your date of birth and those contact details you have hidden. The Business receives the street and the date of birth only with an Acceptance (see 4.7a). Full name and place of residence cannot be hidden.

Purpose: The Business is to be able to decide whether to take you on for the Shift.

Legal basis: lit b – the transmission is the purpose of the contract. You trigger it yourself by sending the Application.

The Business's role: From the moment of receipt, the Business is an independent controller for this data. It then decides for itself on storage and deletion; its own privacy information applies to its applicant management. We are not its processor, and it is not ours. In our General Terms and Conditions we have required it to use your data only for this one Application, not to pass it on and not to build up its own applicant database from it – but we can enforce this only by the means available under the contract.

Retention period with us: for as long as the Application exists. If you withdraw it, it is deleted. If you clear it away using "Archive", it disappears from your list but remains visible to the Business and is retained in the message history.

4.7a Acceptance – the transmission of address and date of birth

What this is about: If a Business takes you on for a Shift, we additionally transmit your address and your date of birth to it. For as long as it is still deciding on your Application, it receives neither – it then sees only your age (see 4.7).

Which data: address (street, postcode, town and country) and date of birth.

Purpose: The Business has to register you for social insurance before work begins and to meet its other obligations under employment and social insurance law. It needs these details for that – it does not need them for the selection decision.

Legal basis: lit b – without these details the assignment cannot be carried out. At the Business, lit c is added: the registration is a statutory obligation (§ 33 ASVG – Allgemeines Sozialversicherungsgesetz, General Social Insurance Act).

Hiding: These two details cannot be hidden; without them an assignment cannot be carried out in compliance with the law.

4.7b Retention of your Application by the Business for future Shifts

What this is about: As a rule, a Business may use the data from your Application only for that one Application. If you give separate consent, it may retain the data beyond that in order to consider you for future Shifts and to contact you for that purpose.

Which data: the same data that is transmitted with the Application (see 4.7).

Legal basis: lit a – your consent. It is voluntary: you can also apply without it, and no disadvantage arises for you. The box is not pre-ticked and is separate from the Application.

Retention period: [24 months] from the giving of the consent, unless you withdraw it earlier.

Withdrawal: at any time and without giving reasons, with effect for the future – using the setting in your user account or informally to [dse@gastrosubs.net]. We pass a withdrawal on to the Businesses concerned without undue delay; they are contractually required to delete the data upon that. The lawfulness of the retention carried out up to the withdrawal remains unaffected.

Not to be confused with "My Helpers": A Business's saved list (see 4.10) is a different thing. It determines who sees Shifts that are not advertised publicly, and not how long your Application data remains with the Business.

4.8 Helper search by Businesses

Which data is visible to Businesses with valid access: photo, full first name and surname, town and distance, age, skills and availability. In the detail view, additionally professional experience and the "About me" text.

Not visible: street, date of birth, gender, email address and telephone number. You disclose gender and the contact details you have not hidden only with an Application (see 4.7), street and date of birth only with an Acceptance (see 4.7a).

You can make yourself invisible: in the account settings you can remove your profile from the Helper search. Businesses then no longer find you there and do not see the details listed above either. Those only become visible once you apply for a Shift on your own initiative – 4.7 then applies. Your own search for Shifts and applying are unaffected.

Purpose: Businesses are to be able to find and approach suitable Helpers.

Legal basis: lit b – findability is the purpose for which you register.

4.9 Messages, conversation threads, invitations

Which data: content of the messages, sender, time, read status on both sides, in the case of invitations the Shifts offered, in the case of requests to join a saved list the response.

Purpose: communication between Business and Helper.

Legal basis: lit b.

Who reads along: Only the two parties involved. We do not read messages without cause. In the event of a report under the Digital Services Act or where there is a justified suspicion of misuse, we may draw on them for review purposes (lit c or lit f).

Hiding: If you hide a conversation, it disappears from your overview. The other side continues to see it, and as soon as a new message arrives it reappears for you. Hiding is therefore not deletion.

Retention period: for as long as one of the two accounts exists and the history has not been deleted.

4.10 Saved list "My Helpers", requests, blocking

Saved list: A Business can save Helpers it has worked with. The link and the time are stored. Anyone who receives an Acceptance is added automatically. The Helper is not notified of this.

Requests: If the parties do not yet know each other, the Business has to ask; the Helper decides. The request and the response are stored. The Helper can also make a request to the Business, in which case the Helper's personal data becomes visible to the Business in the same way as with an Application (see 4.7).

Blocking: If a Helper blocks a Business or vice versa, we store this link together with the time. The other side learns nothing about it – not even on a request for access, because the information would otherwise defeat its own purpose.

Legal basis: lit b, and for blocking additionally lit f (protection of users).

4.11 Search agent and suggestions

Which data: whether the agent is active, the desired radius, the desired positions, the time of the last notification. For matching we use the details from your profile (town, availability, skills).

Purpose: to suggest suitable Shifts to you.

Legal basis: lit b, because you switch the agent on yourself.

How it calculates: The matching is a simple points calculation based on position, distance and day of the week. There is no automated decision within the meaning of Art 22 GDPR – the agent only makes suggestions, and it is people who decide. Whether a Business takes you on is decided by the Business alone.

4.12 Shared links

For every Shift a link can be generated through which it can be accessed together with details of the Business Location and without an account. Anyone who generates such a link deliberately makes those details accessible. Hidden contact details remain hidden there too. The key consists of 32 random bytes and cannot be guessed; it remains valid for as long as the Shift exists.

Legal basis: lit b or lit f on the part of the Business sharing it.

4.13 Businesses' subscriptions, invoices

Which data: company name, invoicing address, VAT identification number, package booked, start and end of the free trial period, billing periods, invoices and payment status.

Purpose: handling and billing of paid access.

Legal basis: lit b for the handling, lit c for the retention.

Retention period: invoices and the associated records for seven years from the end of the calendar year (§ 132 BAO – Bundesabgabenordnung, Federal Fiscal Code). This retention also applies after an account has been deleted; the data is then kept for that purpose alone and is otherwise blocked.

4.14 Reports, moderation, suspensions

Which data: content of the report, the content reported, contact details of the person making the report, our decision together with the reasons for it, measures taken.

Purpose: fulfilment of our obligations under Regulation (EU) 2022/2065 (Digital Services Act), protection of users.

Legal basis: lit c, supplemented by lit f.

Retention period: three years from the decision, so that we can identify repeat cases and evidence our decisions.

4.15 Data backup

We back up the database daily at 3:30 a.m. The backups are kept on the server for 14 days and are then deleted automatically. In addition, we pull backups to a device in Austria so that the data is not lost even if the server fails.

Legal basis: lit f – our legitimate interest in fail-safe operation, which at the same time serves your interest in your data. The backup is also a technical measure under Art 32 GDPR.

What this means for deletions: If you delete your account, your data has disappeared from live operation immediately. It remains in the backups for up to 14 days, because a single person cannot sensibly be deleted from a backup without rendering the backup unusable. We ensure that deleted data from a restored backup does not find its way back into live operation.

5. Local storage on your device

We do not use any cookies for analytics or advertising purposes. We use your browser's local storage for things the app needs:

These entries are held exclusively on your device. You can delete them at any time through your browser settings; you will then have to log in again.

6. Data that does not come from you (Art 14 GDPR)

In a few cases we process data about you that another person has entered:

• Details of a contact person that a Business stores in the profile of a Business Location (name in the description, telephone number, email address). Source: the Business concerned. Legal basis: lit f – our and its legitimate interest in a contact point that can be reached.
• Being added to a Business's saved list (section 4.10). Source: the Business.
• Messages in which someone mentions you. Source: the person writing.

We inform you about such processing with this policy. Those affected are always people who already have an account with us or whose details a Business publishes as its own contact details.

7. Recipients and processors

Not yet in use, but planned – this section will be added to as soon as the time comes:

• a provider for sending emails (confirmation links, notifications),
• a payment service provider for the Businesses' subscriptions,
• where applicable, a tool for audience measurement or error tracking.

8. Retention periods at a glance

After the account has been deleted we remove your profile and your personal data from live operation. What remains:

• invoicing data within the scope of the statutory retention obligation,
• messages in the other side's histories, in so far as that side has a legitimate interest in keeping its own correspondence – then without your profile,
• details that we need in order to defend against or to assert claims.

9. Your rights

You have the following rights against us:

• Access (Art 15 GDPR) – which data we process about you, together with a copy.
• Rectification (Art 16 GDPR) – correction of inaccurate data. You can change much of it directly in your profile.
• Erasure (Art 17 GDPR) – the "right to be forgotten", in so far as no retention obligation stands in the way.
• Restriction of processing (Art 18 GDPR).
• Data portability (Art 20 GDPR) – the data you have provided, in a common, machine-readable format.
• Objection (Art 21 GDPR) to processing that we base on a legitimate interest.
• Withdrawal of consent (Art 7(3) GDPR) – at any time and with effect for the future. The lawfulness of the processing carried out up to that point is unaffected.

For this, contact us informally at <datenschutz@gastrosubs.net> or at the address in section 2. We reply without delay, at the latest within one month. If the request is complex, we can extend this period by two months and will tell you so within the first month.

We can require proof of your identity where there is justified doubt as to who is making the request – this protects you against someone else obtaining information about you.

Right to lodge a complaint: You can complain to a supervisory authority at any time. In Austria this is the

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)

Barichgasse 40–42, 1030 Wien

Telephone: +43 1 52 152-0

Email: dsb@dsb.gv.at

Web: www.dsb.gv.at

10. Automated decisions and profiling

An automated decision in an individual case, including profiling, within the meaning of Art 22 GDPR does not take place. The search agent and the sorting of search results are suggestions and rankings according to objective criteria; whether an Application is accepted is decided exclusively by the Business, and whether you apply is decided exclusively by you.

11. Are you obliged to provide data?

You are not obliged to give us data. Without the details marked as mandatory, however, we cannot maintain an account or provide the platform – without a town, for example, there is no radius search, and without a name there is no Application. You can leave out the voluntary details (photo, "About me", professional experience, skills, VAT identification number) without our withholding anything from you.

12. Security

We take technical and organisational measures under Art 32 GDPR. These include:

• Encrypted transmission over HTTPS with a valid certificate; access over HTTP is redirected.
• Passwords are never stored in plain text, only as a hash value that cannot be reversed.
• The interface is not directly reachable from the internet; it listens only locally on the server behind the web server, and the firewall lets through only ports 22, 80 and 443.
• The application process does not run with system administrator rights.
• Permission check on every access: an Application and its message history are accessible only to the two parties involved; every other access is refused, including directly at the interface.
• Automated tests watch, among other things, over the fact that no Business details become visible without logging in and that no contact details are delivered in the Helper search.
• Daily, verified backups (section 4.15).

13. Minors

An account as a Helper may be created only by a person who has completed their 15th year of age. We do not knowingly process data of people below this age. If we learn of such a case, we delete the account.

14. Note on test operation

This section is removed as soon as live operation starts.

GastroSubs is currently in test operation. This means:

• No real emails are sent; the confirmation link is displayed in the application.
• The platform contains fictitious demo accounts with fictitious Businesses and Shifts. These are not visible to ordinary users and are kept separate from real data.
• We recommend that you do not enter any data in test operation whose publication would harm you.

15. Changes to this policy

We adapt this policy when the platform or the legal position changes. The version published at <https://gastrosubs.net/datenschutz> at the relevant time applies. In the case of material changes we will also inform you by email.