Version 1. This describes how personal data is processed in TableFai, for guests who book and for staff who work in the service.
1. Who is responsible?
- The restaurant is the controller of bookings, its guest register and the messages it sends to its guests. TableFai processes that data for the restaurant as a processor, under a data processing agreement. Questions about a particular booking or a restaurant's guest register go first to the restaurant.
- Tizfai Technologies AB, company registration number 559284-7379, Kumminvägen 1, 611 46 Nyköping, Sweden ("TableFai") is the controller of guest accounts on tablefai.com, staff sign-ins, security logs, verification with BankID through Tizfai Identity, demo requests from our website and the invoicing of restaurants.
2. Guests
| Data | Why | Legal basis |
|---|---|---|
| name, e-mail, mobile number, language, the booking's details | to take and manage the booking, to send its confirmation, reminders and changes | contract (Article 6(1)(b)) |
| requests, allergies, dietary preferences | so that the restaurant can take care of you; stored encrypted | contract; for health data your explicit consent or another basis in Article 9 for which the restaurant is responsible |
| visits, no-shows, cancellations | the restaurant's guest register and terms | the restaurant's legitimate interest |
| payments (amount, the card's brand and last four digits) | deposits, prepayment and fees under the restaurant's terms; card numbers are handled only by Stripe | contract |
| BankID verification (name and pseudonym, never the personal identity number) | when the restaurant requires verification for larger parties | contract |
| reviews | publishing verified reviews | legitimate interest |
| marketing consent | the restaurant's mailings, only if you ticked the box | consent (Article 6(1)(a)) |
| guest account (e-mail, name, preferences, sign-ins) | so that you can see and manage your bookings | contract |
3. Staff
| Data | Why | Legal basis |
|---|---|---|
| name, e-mail, role, restaurants, password (as a hash) | sign-in and access | contract with the employer / legitimate interest |
| devices, sign-ins, one-time codes | security: a new device needs a code, a notice on a new sign-in | legitimate interest (security) |
| activity log (who changed what and when) | accountability for the restaurant and for TableFai | legitimate interest |
4. Demo requests
If you ask for a demo we keep your name, restaurant, e-mail, phone and message to contact you, for 12 months. Legal basis: legitimate interest.
5. Recipients
The data is shared with the restaurant you book with and with our sub-processors: Hetzner Online GmbH (servers in Germany and Finland), Stripe (payments) and Comviq (Tele2 Sverige AB) (SMS). E-mail is sent through TableFai's own mail server, SMS through our own SMS service and BankID verification through Tizfai Identity, all run by Tizfai Technologies AB in the EU. We never sell personal data.
6. Transfers outside the EU/EEA
We process the data within the EU/EEA. If a provider (for example Stripe) transfers data outside the EU/EEA, it does so under the European Commission's standard contractual clauses or an adequacy decision.
7. How long?
- Bookings and guest registers: as long as the restaurant keeps them; after a restaurant's account has ended, at most 12 months.
- Guest account: until you erase it. Sign-ins and codes are deleted 30 days after they end.
- Sent messages: their content is not kept once sent; the record of the sending is deleted after 30 days.
- The activity log is kept as long as the account exists, for accountability.
- Invoices to restaurants: 7 years under the Swedish Accounting Act.
- Demo requests: 12 months.
8. Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, to object to processing based on legitimate interest and to receive your data in a machine-readable format (data portability). Consent can be withdrawn at any time.
In your guest account you can export and erase your data yourself. The restaurant can export and erase the data in its guest register. Contact us at info@tizfai.com or the restaurant to use your rights.
You have the right to complain to the Swedish Authority for Privacy Protection (imy.se).
9. Security
We use encrypted transfer, encrypt notes, requests and allergies in the database, store passwords and sign-in tokens as hashes, limit access by role and restaurant, and log changes.
10. Cookies
TableFai uses no tracking or advertising cookies. See the cookie statement.
11. Changes
We may update this policy. The latest version is always on tablefai.com.
12. Contact
Tizfai Technologies AB, Kumminvägen 1, 611 46 Nyköping, Sweden, info@tizfai.com.