Privacy Notice Platform

Information pursuant to Articles 12, 13 and 14 GDPR for users of the Thank You Vibes Platform

1. Introduction and Scope

1.1 The protection of your personal data is important to us. We process personal data exclusively in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data, Law 125(I)/2018.

1.2 This Privacy Notice applies to the Thank You Vibes Platform (the "Platform"). The Platform comprises:

a) the web application at admin.thank-you.app (the "Dashboard");
b) the mobile applications "Thank You Vibes" (the "Apps");
c) the guest pages that guests access by QR code (the "Guest Pages").

1.3 The Platform is offered exclusively to businesses such as hotels (each a "Customer"). This Privacy Notice is addressed to the following groups of persons (each a "data subject"):

a) persons who use the Dashboard on behalf of a Customer, in particular company administrators, place administrators and sales representatives ("Authorised Users");
b) contact persons of Customers and of prospective Customers ("Contact Persons");
c) staff members of Customers who receive tips through the Platform ("Workers");
d) guests who give tips or feedback on the Guest Pages ("Guests").

1.4 The website thank-you.app is covered by the separate Privacy Notice Website 118.

2. Controller and Data Protection Officer

2.1 Controller. The controller for the processing described in this Privacy Notice as our own processing is:

TY APP TECHNOLOGIES LIMITEDKentavron 7,Flat/Office 4014041 Germasogeia, Limassol,Cyprus

Registration number HE 484442

E-mail: legal@thank-you.app

Telephone: +357 97 54 55 58

("we" or "us").

2.2 Customer as controller. The Customer is the controller for the personal data that we process on its behalf as its processor under the Data Processing Agreement 114. This applies in particular to Worker master data, tip allocation and payout data, Guest feedback and the data entered in the Compliance Module. For this processing, the Customer's privacy notice applies, and you may exercise your rights against the Customer. If you contact us about such processing, we forward your request to the Customer without undue delay.

2.3 Data protection officer. We have not appointed a data protection officer because the requirements of Article 37 GDPR are not met. For all questions on data protection, please contact legal@thank-you.app.

3. General Information on the Processing

3.1 Legal bases. We process personal data only where one of the following legal bases applies:

a) the processing is necessary for the performance of a contract with you or for steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR);
b) the processing is necessary for compliance with a legal obligation to which we are subject, in particular under accounting and tax law (Art. 6(1)(c) GDPR);
c) the processing is necessary for the purposes of our legitimate interests or the legitimate interests of a third party, and your interests or fundamental rights and freedoms do not override those interests (Art. 6(1)(f) GDPR). The specific legitimate interests are stated in clause 4 for each processing operation;
d) you have given your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal (Art. 7(3) GDPR).

3.2 Special categories of data. We do not process special categories of personal data within the meaning of Article 9 GDPR. Please do not enter such data, for example health data, in free-text fields of the Platform.

3.3 Internal access. Within our company, only those persons receive access to personal data who need it to perform the respective task (need-to-know principle). All persons with access are bound to confidentiality.

3.4 Recipients. We disclose personal data to third parties only where a legal basis applies. Recipients are our processors (clause 8), the payment service provider Stripe as an independent controller (clause 4.4.3) and, where we are legally obliged to do so or where this is necessary to establish, exercise or defend legal claims, authorities, courts and our professional advisers, who are bound to professional secrecy.

3.5 Sources of the data. Where we do not collect personal data from you directly (Art. 14 GDPR), we receive it from the following sources:

a) from the Customer, which creates the accounts of Authorised Users and the profiles of Workers and enters the data for the Compliance Module;
b) from our payment service provider Stripe, which transmits payment status and transaction identifiers to us;
c) from the VIES system of the European Commission, which confirms the validity of VAT identification numbers.

We do not obtain personal data from publicly accessible sources.

3.6 No automated decision-making. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

4. Processing Operations

4.1 Authorised Users

4.1.1 Data. When a Customer sets up an account for you, we process your first and last name, business e-mail address, telephone number, role and permissions, the places and pools assigned to you, your language setting and, if you provide them, your profile photo and date of birth. When you use the Dashboard, we also process login data, the date and time of your actions (audit log), your acceptance of contract documents and your messages in the support function.

4.1.2 Purposes and legal bases. We process this data:

a) to provide the Platform to the Customer and to manage your access (Art. 6(1)(b) GDPR, insofar as you act as the Customer's contracting party; otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in performing the contract with the Customer);
b) to keep the Platform secure, to prevent misuse and to trace changes (Art. 6(1)(f) GDPR, based on our legitimate interest in the security and integrity of the Platform);
c) to document the conclusion of the contract and the acceptance of contract documents with document number, version, time and accepting user (Art. 6(1)(f) GDPR, based on our legitimate interest in being able to prove the conclusion and content of the contract);
d) to answer support requests (Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR, based on our legitimate interest in providing support to our Customers).

4.1.3 Source. The Customer provides your name, e-mail address, role and permissions. All other data is collected from you directly or arises from your use of the Dashboard.

4.1.4 Retention. We store account data for as long as your access exists and delete it thirty (30) days after your access has been removed by the Customer or after the end of the contract with the Customer. Audit logs are deleted twelve (12) months after the respective entry. Records of the acceptance of contract documents are retained for the term of the contract with the Customer and for ten (10) years thereafter.

4.2 Customers and Contact Persons

4.2.1 Data. We process the name, business contact details and function of Contact Persons as well as company data, billing address, VAT identification number, bank details, contract and invoice data, and correspondence.

4.2.2 Purposes and legal bases. We process this data:

a) to conclude and perform the contract, to invoice our fees and to collect payments (Art. 6(1)(b) GDPR);
b) to verify VAT identification numbers in the VIES system of the European Commission and to comply with accounting and tax obligations (Art. 6(1)(c) GDPR);
c) to manage the business relationship with the Customer, where the Contact Person is not itself our contracting party (Art. 6(1)(f) GDPR, based on our legitimate interest in communicating with our Customers).

4.2.3 Retention. We store contract and invoice data for the term of the contract and thereafter until the expiry of the statutory retention periods, generally seven (7) years from the end of the financial year concerned. We store correspondence for as long as it is required for the performance of the contract or as evidence, at the latest until the expiry of the limitation periods for claims arising from the contract.

4.3 Workers

4.3.1 Data. The Customer creates your Worker profile. It contains your name, e-mail address, telephone number, position and unit, the place and pool assigned to you, your bank details (IBAN), the tips you have received and your transaction history. When you first log in, we record your confirmation and consent with version, time, language and technical identifiers.

4.3.2 Role and legal bases. We process your Worker profile, tips and payouts on behalf of the Customer, which is your employer or principal (clause 2.2). We process the record of your confirmation and consent as our own controller in order to be able to prove it (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR, based on our legitimate interest in being able to prove the confirmation and consent).

4.3.3 Source. The Customer provides your profile data. The record of your confirmation arises from your first login.

4.3.4 Retention. We store the record of your confirmation and consent for as long as your Worker profile exists and for three (3) years thereafter. For data processed on behalf of the Customer, the retention periods agreed with the Customer apply.

4.3.5 Further information. The Worker Notice 123 explains how the tipping function works for you.

4.4 Guests

4.4.1 Data. When you give a tip, the Platform processes the amount and currency, the date and time, the QR code and recipient, the payment status and the transaction identifiers of our payment service provider Stripe, your IP address, information about your browser and device, and risk indicators for fraud prevention. If you give feedback, the Platform processes your ratings and free-text answers. If you enter your e-mail address, the Platform processes it as well.

4.4.2 Role and legal bases.

a) We process the transaction data on behalf of the Customer in order to allocate and report the tip (clause 2.2).
b) We process your IP address, your browser and device information and the risk indicators as our own controller in order to secure the payment process and to prevent fraud and misuse (Art. 6(1)(f) GDPR, based on our legitimate interest and the legitimate interest of the Customer in a secure payment process free from fraud).
c) Your feedback is processed on behalf of the Customer, which uses it to improve its service (clause 2.2).

4.4.3 Payment data. You pay through Stripe Payments Europe, Limited, Ireland and, where you use them, Apple Pay or Google Pay. You enter your card data directly with these providers; it does not reach us. Stripe processes payment data as an independent controller under its own privacy notice (clause 8.3).

4.4.4 Retention. We delete or anonymise IP addresses and device information one hundred and eighty (180) days after the transaction. If a chargeback, dispute or suspected case of fraud concerning the transaction is pending, we store them until it has been concluded. We store transaction data for as long as the Customer's accounting requires, generally seven (7) years from the end of the financial year concerned.

4.4.5 Further information. The Guest Notice 124 is displayed on the Guest Pages.

4.5 Compliance Module

When a Customer uses the Compliance Module, it may enter personal data of its hotel manager and of other responsible persons named in official forms, in particular name, function, contact details and the data required by the respective form. We process this data exclusively on behalf of the Customer (clause 2.2).

4.6 Mobile Applications

4.6.1 Data and services. The Apps use the following services of Google Firebase:

a) Firebase Authentication for registration and login: e-mail address, password (stored only by Firebase as a hash value), user ID and session tokens;
b) Cloud Firestore for profile data and settings;
c) Firebase Cloud Messaging for push notifications: device token;
d) Firebase Remote Config for configuration and feature settings;
e) Firebase Cloud Functions, which transmit notifications and updates to our server;
f) Firebase App Check, which verifies that requests come from an unmodified version of our Apps.

4.6.2 Purposes and legal bases. We process this data to provide the Apps (Art. 6(1)(b) GDPR), to keep them secure (Art. 6(1)(f) GDPR, based on our legitimate interest in protecting the Platform against misuse) and to send you push notifications (Art. 6(1)(b) GDPR). You can switch off push notifications at any time in the settings of your device.

4.6.3 Retention. We delete your App account thirty (30) days after you delete it, after the Customer removes your access or after the end of the contract with the Customer. Device tokens are deleted when you log out or when your App account is deleted, and in any case when the device has not connected to the App for one (1) month.

4.7 System E-Mails

4.7.1 Data. To send system e-mails such as invitations, login links, password resets and notifications, we process your e-mail address, name, the content of the e-mail and delivery data (time of sending, delivery status, bounces).

4.7.2 Purposes and legal bases. We send these e-mails to provide the Platform (Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR, based on our legitimate interest in performing the contract with the Customer). The e-mails are sent through Twilio SendGrid (clause 8.2).

4.7.3 Retention. Delivery data is deleted ninety (90) days after sending.

4.8 Error and Performance Monitoring

4.8.1 Data. To detect errors and performance problems, the Platform transmits technical data to the monitoring services Sentry and Laravel Nightwatch, in particular the time and type of the error, the request concerned, the user ID, the IP address and browser and device information.

4.8.2 Purposes and legal bases. We process this data to operate the Platform securely and without errors (Art. 6(1)(f) GDPR, based on our legitimate interest in the stability and security of the Platform).

4.8.3 Retention. Monitoring data is deleted ninety (90) days after it has been recorded.

5. Retention and Erasure

5.1 We store personal data only for as long as is necessary for the respective purpose. The retention periods are stated in clause 4 for each processing operation.

5.2 After the end of the respective retention period, we delete the data or anonymise it so that it can no longer be attributed to you. Data in backups is overwritten in the regular backup cycle, at the latest ninety (90) days after deletion in the live system.

5.3 Where statutory retention obligations apply, we restrict the processing to compliance with those obligations and delete the data when they expire.

6. Place of Processing and Transfers to Third Countries

6.1 Place of processing. All servers and databases of the Platform are located in the European Union. The application server and the database are located in Frankfurt, Germany. The services listed in clause 8 store the data of the Platform in the European Union, with the exception of Firebase Cloud Messaging and Firebase Remote Config, which Google does not tie to a region.

6.2 Access from third countries. Some of our processors are companies based in the United States or belong to a group based there. In individual cases, in particular for support and troubleshooting, personal data may be accessed from the United States. This applies to Laravel Holdings Inc., Google, Twilio (SendGrid) and Functional Software, Inc. (Sentry).

6.3 Safeguards. Where the recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). Otherwise, the transfer is based on the standard contractual clauses of the European Commission pursuant to Decision (EU) 2021/914 (Art. 46(2)(c) GDPR). You can request a copy of the standard contractual clauses at legal@thank-you.app.

7. Cookies and Local Storage in the Dashboard

7.1 The Dashboard sets only technically necessary cookies:

a) a session cookie that keeps you logged in; it is deleted when you log out or at the end of the session;
b) the cookie "XSRF-TOKEN", which protects against cross-site request forgery; it is deleted at the end of the session.

7.2 The Dashboard also stores your display settings (theme, sidebar, collapsed sections) in the local storage of your browser. You can delete them at any time in your browser settings.

7.3 The storage of and access to this information on your device is strictly necessary to provide the Dashboard you have requested. No consent is required for this (Art. 5(3) of Directive 2002/58/EC). The subsequent processing is based on Art. 6(1)(f) GDPR, based on our legitimate interest in the secure operation of the Dashboard.

7.4 We do not use analytics, tracking or marketing cookies.

8. Processors and Independent Controllers

8.1 Processors. We use the following processors, with which we have concluded data processing agreements pursuant to Article 28 GDPR:

Laravel Holdings Inc., 60 Broad Street, 24th Floor #1559, New York, NY 10004, United States

Services: hosting of the application server (Laravel VPS on the infrastructure of DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, United States, data centre Frankfurt, Germany), server management (Laravel Forge) and application monitoring (Laravel Nightwatch)

Place of processing: European Union

Privacy policy: https://laravel.com/privacy, for Nightwatch: https://laravel.com/legal/nightwatch/privacy-policy; DigitalOcean: https://www.digitalocean.com/legal/privacy-policy

Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland

Services: managed MySQL database (Cloud SQL, region Frankfurt, Germany), Firebase Authentication, Cloud Firestore, Cloud Functions and App Check, Google Workspace (e-mail correspondence)

Place of processing: European Union

Privacy policy: https://cloud.google.com/terms/cloud-privacy-notice; Firebase: https://firebase.google.com/support/privacy

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States

Services: Firebase Cloud Messaging and Firebase Remote Config

Place of processing: Google does not tie these services to a region; processing may also take place in the United States

Twilio Ireland Limited, 70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland

Service: sending of system e-mails (Twilio SendGrid)

Place of processing: European Union (SendGrid EU data residency)

Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, United States

Service: error monitoring

Place of processing: European Union (Frankfurt, Germany)

8.2 The current list of sub-processors that we use for processing on behalf of Customers is set out in document 117.

8.3 Independent controllers. The following providers process personal data as independent controllers under their own terms and privacy notices:

Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland

Service: payment processing for tips and payouts to Customers

Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

Service: Apple Pay, where you use it to pay a tip

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Service: Google Pay, where you use it to pay a tip

9. Security of Processing

9.1 We implement appropriate technical and organisational measures pursuant to Article 32 GDPR to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.

9.2 These measures include in particular encryption of all data transmissions (TLS, at least version 1.2), encryption of data at rest, role-based access rights, firewalls, regular backups with restore tests, monitoring and an incident response procedure. We review the measures regularly and adapt them to the state of the art.

10. Your Rights

10.1 Under the conditions of the GDPR, you have the following rights:

a) the right of access to your personal data (Art. 15 GDPR);
b) the right to rectification of inaccurate data (Art. 16 GDPR);
c) the right to erasure (Art. 17 GDPR);
d) the right to restriction of processing (Art. 18 GDPR);
e) the right to data portability (Art. 20 GDPR);
f) the right to withdraw a consent at any time with effect for the future (Art. 7(3) GDPR).

10.2 Right to object (Art. 21 GDPR). You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

10.3 To exercise your rights, please contact legal@thank-you.app. We respond without undue delay and in any event within one (1) month of receipt of the request (Art. 12(3) GDPR). For processing carried out on behalf of a Customer, please contact the Customer (clause 2.2).

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority competent for us is:

Commissioner for Personal Data Protection

Kypranoros 15, 1061 Nicosia, Cyprus

www.dataprotection.gov.cy

12. Obligation to Provide Data

12.1 Authorised Users and Workers must provide the data required for their account. Without this data, the Platform cannot be used.

12.2 Contact Persons must provide the data required to conclude and perform the contract. Without this data, the contract cannot be concluded.

12.3 Guests are not obliged to provide personal data. Without the data required for the payment, a tip cannot be given.

13. Future Functions

If we introduce new functions or services that involve processing not described in this Privacy Notice, we will inform you in advance in accordance with Articles 13(3) and 14(4) GDPR and update this Privacy Notice.

14. Status and Changes

14.1 We update this Privacy Notice when the Platform, the services we use or the law changes. The current version is available in the Dashboard, in the Apps and on the Guest Pages.

14.2 Version and effective date are stated at the top of this Privacy Notice.