Privacy NoticeArticles 12 and 13 GDPR
Current version: 01/2026
1. Introduction, scope
1.1. This privacy notice describes how we process personal data in connection with the use of the website www.thank-you.app operated by TY APP TECHNOLOGIES LIMITED (hereinafter the “Website”) and the browser-based version of the “Thank You Vibes” that can be accessed via QR code or link (hereinafter the “Web App”). It also covers the browser-based administration back end connected to the Web App (the “Admin Area”) for companies and hotels as well as – to the extent described in more detail in section 4.4 – the use of the mobile staff app that is operated on the same back-end systems (together the “Online Offering”).
1.2. The protection of personal data and compliance with data protection law, in particular Regulation (EU) 2016/679 (“General Data Protection Regulation” – GDPR) as well as applicable national data protection and telecommunications provisions, is of the highest priority to us.
1.3. This privacy notice provides an overview of which categories of personal data we process, for which purposes we process them, on which legal bases we rely, to whom data may be disclosed, how long data are stored and which rights data subjects have.
1.4. Terms such as “personal data”, “processing”, “controller”, “processor” etc. are used in the sense of the definitions in Article 4 GDPR.
1.5. The current version of this privacy notice can be accessed, saved and printed at any time on our website.
2. Controller, data protection contact
2.1. The controller within the meaning of Article 4(7) GDPR is:
TY APP TECHNOLOGIES LIMITED
Registration number: HE 484442
Registered office: 61–63 Lord Byron Street, 6th floor, office 602, 6023 Larnaca, Cyprus
E-mail: legal@thank-you.app
2.2. At present, the statutory requirements for the mandatory appointment of a data protection officer (Article 37 GDPR) are not met. Should this change, the corresponding contact details will be added to this privacy notice.
3. Processing of personal data in general
- necessary for the performance of pre-contractual measures or a contract with you (Article 6(1)(b) GDPR),
- necessary for compliance with legal obligations (e.g. statutory retention obligations under commercial and tax law, payment services regulation) (Article 6(1)(c) GDPR),
- necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms requiring the protection of personal data (Article 6(1)(f) GDPR), or
- based on consent given by you (Article 6(1)(a) GDPR).
3.2. Where we process special categories of personal data within the meaning of Article 9(1) GDPR (e.g. health data), this will only be done in the exceptional cases set out in Article 9(2) GDPR. Such processing is generally not envisaged in the context of the Website and the Web App.
3.3. If you give us your consent to process your data, you may withdraw this consent at any time with effect for the future (see sections 13 and 16). The lawfulness of the processing carried out until the withdrawal remains unaffected.
3.4. Personal data will only be disclosed, transmitted or otherwise made accessible to third parties where and insofar as this is necessary for the purposes described in this privacy notice, required on the basis of a legal provision or a regulatory/judicial order, or covered by a consent.
3.5. Within our company, only those departments and staff members will have access to personal data who need such data in order to perform their tasks (need-to-know principle).
3.6. No decision-making based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR takes place in the context of the Website, the Web App, the Admin Area or the mobile app.
4. Collection and processing of personal data from the data subject
We generally process personal data directly from the data subjects, in particular when visiting the Website, using the Web App or the Admin Area, using the mobile staff app, contacting us or within the framework of a contractual relationship. Processing takes place solely on one of the legal bases set out in section 3.
4.1. Visit to the Website and Web App
4.1.1. The publicly accessible marketing pages of the Website (e.g. homepage, service and product description, “How it works”, policy pages) provide static content only. These pages can be used without registration and without entering personal data; personal data are collected only to the extent technically required (see below). When you access our Website or Web App, certain technical information (access data, “server log files”) is automatically processed in order to enable the display of the pages and to ensure the stability and security of our offering (for details see section 7).
4.1.2. In addition, cookies and similar technologies are used depending on your browser settings and consents (see section 8).
4.1.3. The legal basis for processing strictly necessary technical data is our legitimate interest in a secure, stable and functional web presence (Article 6(1)(f) GDPR). The legal basis for optional cookies is your consent (Article 6(1)(a) GDPR).
4.1.4. Retention period: Server log files are generally stored for 12 Months unless a longer storage period is required for security or evidential reasons.
4.1.5. Optional access protection (HTTP Basic Authentication): In certain operating modes (e.g. protected test or staging environments), access to the Website or Web App may be additionally protected by HTTP Basic Authentication. In this case, user name and password are processed solely for the immediate verification of the access data in the HTTP headers and are not stored permanently in our systems.
4.2. Contact / Lead capture (“Contact Us” / “Get Started”)
4.2.1. If you contact us via the contact or lead form integrated on the Website (“Contact Us”, “Get Started” or similar designations), we process – depending on the specific configuration – in particular the following data:
- Mandatory fields: First name, last name, business e-mail address, company name, company size, confirmation of the relevant conditions (e.g. terms/privacy).
- Optional information: Telephone number, country, city, role/function in the company, information on how you heard about us, free-text message.
- Meta/communication data: Time of the enquiry, technical log data, internal lead identifiers where applicable.
4.2.2. Form entries are validated on the server side and stored as a lead data record in a dedicated data structure. Processing takes place via an API endpoint (e.g. “/api/leads”); the lead data are persisted in a Firebase Firestore collection (e.g. “leads”). There is no automated transfer of these leads to third parties; they are used exclusively internally for handling and tracking the enquiry.
4.2.3. The purpose of processing is to handle your enquiry, to contact you (e.g. to arrange demos, prepare offers), to document communication and – where relevant – to prepare a contractual relationship with you or your company (e.g. hotel, chain or other business partner).
4.2.4. The legal basis is Article 6(1)(b) GDPR (pre-contractual measures) and our legitimate interest in properly handling enquiries and documenting business communication (Article 6(1)(f) GDPR).
4.2.5. Retention period: Enquiries, lead records and correspondence are generally stored for 24 months after completion of processing; if a contractual relationship is established, the retention periods set out in sections 4.4/4.5 apply.
4.3. Use of the browser-based tipping function (Web App) by guests (“tippers”)
4.3.1. When guests access the Web App via QR code or link to provide a tip to a member of staff of a hotel, we process – depending on the specific configuration – in particular the following data:
- Transaction data: Date and time, amount, currency, payment status, QR code used or assignment to the beneficiary employee/team/hotel, transaction ID.
- Context data: Hotel/location, room number or table ID where applicable, service/department (e.g. housekeeping, restaurant).
- Optional data provided by the guest: Free-text message, rating, name, e-mail address for digital payment confirmations/receipts.
- Technical data: IP address, device information, browser type and version, language settings where applicable (see also section 7).
The tipping function is operated via our back-end services. Transaction and context data are primarily stored in a relational database (MySQL) as the “source of truth” and are additionally mirrored in specific Firestore collections (e.g. “transactions”) for real-time synchronisation.
4.3.2. Payment data (in particular credit card and Apple Pay/Google Pay data) are generally processed exclusively by the payment service provider we have integrated. We receive only information as to whether the payment was successful, as well as technically necessary payment references (e.g. masked card number, token, transaction ID, card type) in order to enable assignment to the tip and for settlement purposes. We do not store full card or wallet data (e.g. full card number, CVC).
4.3.3. The purpose of processing is to provide the digital tipping function, to process the payment, to assign tips to the entitled employees/hotels, to provide reporting to hotels and to comply with statutory retention obligations under commercial and tax law and to assert or defend claims (e.g. in case of queries or chargebacks).
4.3.4. The legal basis is Article 6(1)(b) GDPR (performance of the payment/use contract concluded with the guest) and Article 6(1)(c) GDPR (statutory retention obligations). Where we analyse transaction data for the purposes of fraud prevention, system security, reporting and product improvement, this is based on our legitimate interests (Article 6(1)(f) GDPR).
4.3.5. Retention period: Transaction and settlement-related data are generally stored for the duration of the statutory retention periods (as a rule up to 7 years after the end of the relevant financial year); thereafter only as long as necessary for the assertion or defence of legal claims.
4.4. Accounts for hotel administrators and staff (Admin Area and staff app)
4.4.1. Hotels and other companies can use the Thank You Vibes for their staff. Administration takes place via a multi-tenant Admin Area based on Laravel Filament. Depending on the configuration, the following data in particular are processed:
- Hotel/company data: Company name, address, industry, contact person, contract data, services booked, licence/tariff information.
- Admin account data: Name, position, business contact details, login data (user name, e-mail), role and permission profiles (e.g. Super Admin, Company Admin, Hotel Admin, Sales Representative), assignment to companies/hotels.
- Staff data: Name, unique staff ID, position/department, assignment to a hotel/location, language settings and further profile data where applicable (e.g. display name, optional profile picture).
- Account/wallet data for the payout of tips: e.g. IBAN or other payment identifiers required for distributing and paying out tips.
- Usage and configuration data: Login and activity logs, tipping history and totals, configurations and settings in the dashboard, sales pipeline information, commission data, feature flag information (remote config), audit logs for key admin actions.
- Technical data: System and device information, device tokens (e.g. for push notifications via Firebase Cloud Messaging) and tenant/scope information to ensure tenant separation (tenant isolation).
The Admin Area is designed as a multi-tenant back office application for managing companies (tenants), hotels (sub-entities), users and roles, payments, sales pipelines, commissions, configurations, reporting and audits. Data are primarily stored in a MySQL database (authoritative data store); selected data records are mirrored in Firestore collections (e.g. “companies”, “hotels”, “userspresence”, “transactions”, “notifications”, “remoteconfig”) for real-time synchronisation.
4.4.2. The purpose is to set up and manage user accounts, assign and pay out tips, provide reporting at hotel and staff level (e.g. overviews and statistics), manage sales pipelines and commissions, and ensure IT security, abuse prevention and traceability of admin actions (audit logs).
4.4.3. The legal basis is Article 6(1)(b) GDPR (performance of contracts with the hotel as our contracting partner or with registered users) and Article 6(1)(f) GDPR (legitimate interests in a secure and transparent tipping system, tenant separation, traceability of transactions and admin actions, product improvement). Where we are legally obliged to retain certain data or to disclose data to authorities, processing is additionally based on Article 6(1)(c) GDPR.
4.4.4. Retention period: Data on user accounts are processed for the duration of the contractual relationship with the respective hotel/company and thereafter as long as statutory retention obligations or legitimate interests (e.g. assertion or defence of claims) exist. Inactive accounts are generally deleted after 7 years unless longer retention obligations apply.
4.4.5. Additional processing in the mobile staff app
Where staff also use the mobile Thank You Vibes (e.g. iOS/Android app), we process, in addition to the data listed in section 4.4.1, in particular the following:
- Authentication and account status: E-mail address (login), Firebase UID, authentication tokens, password reset token, authentication timestamps. Passwords are processed exclusively by Firebase Authentication, stored in hashed and salted form, and are not visible to us in plain text. Multi-factor authentication (MFA) may be implemented optionally.
- Profile and identity: Display name, optional profile photo (uploaded to Firebase Storage), structured identity and address data where applicable (e.g. country, city) as well as KYC-related data where required by applicable law or contract (e.g. to comply with tax or employment law obligations). All identity data are stored in user-specific Firestore documents and protected by security rules.
- Settings and preferences: Local preferences (e.g. language, UI settings, notification settings) are stored on the end device; selected preferences are also synchronised to Firestore to enable consistency across devices. Location data may be used temporarily – if you grant the relevant permissions on your device – to pre-populate default values (country, currency) or determine contextual information for transactions. Location data are not stored permanently as separate movement profiles.
- Tip defaults and transactions: User-defined tip presets are stored in UID-specific Firestore collections. Transaction data (tipping history) are managed primarily in MySQL and additionally in Firestore as described in section 4.3; location-related information may optionally be stored in individual transaction records where this is required for documentation and traceability.
- QR code generation: User- and hotel-specific QR codes are generated on the server side and stored in Firebase Storage; referencing metadata are managed in Firestore. The codes serve to uniquely assign tips and are linked, for example, to rooms, tables or staff.
- Support and feedback: Haptic and audio feedback is processed locally on the device; no additional personal data are transmitted to our servers for this purpose. Where support requests are submitted from within the app by e-mail or via contact functions, section 4.2 applies in addition.
The above data processing serves to provide the functionality of the staff app, to enable a secure and traceable tipping and payout model, to store configurations and preferences and to ensure the integrity and security of the system. The legal bases are Article 6(1)(b) GDPR (performance of contract), Article 6(1)(f) GDPR (IT security, fraud prevention, product improvement) and – where location or KYC data are not legally required – Article 6(1)(a) GDPR (consent).
4.5. Contractual partners (hotels, other business partners) and their contact persons
4.5.1. In the context of contractual relationships with hotels and other business partners (e.g. payment service providers, marketing/IT service providers) we process data of our contractual partners and of their contact persons, in particular: Master and contact data, Contract data, Billing and payment data.
4.5.2. The purpose is the initiation, management and performance of contractual relationships and compliance with statutory documentation and retention obligations.
4.5.3. The legal basis is Article 6(1)(b) and (c) GDPR; in addition we rely on our legitimate interests in an efficient and legally compliant business process (Article 6(1)(f) GDPR).
4.5.4. Retention period: For the duration of the contractual relationship and thereafter for the duration of statutory retention periods and limitation periods for related claims.
4.6. Newsletter / direct marketing (if implemented)
4.6.1. If you register for a newsletter or expressly agree to receive information, we process your e-mail address and, where applicable, your name.
4.6.2. The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw this consent at any time with effect for the future.
4.6.3. Where we use e-mail contact details obtained in connection with an existing customer relationship for direct marketing of our own similar products, such use may be based on our legitimate interests (direct marketing, Article 6(1)(f) GDPR). You may object to this use at any time.
4.7. Applications
4.7.1. If you apply to us, we process your application documents (in particular master data, contact data, CV, certificates, cover letter, communication data).
4.7.2. The legal basis is Article 6(1)(b) GDPR (pre-contractual measures in the context of the application process) and – where necessary – Article 9(2)(b) and (h) GDPR.
4.7.3. Retention period: Application documents are generally retained for 6 Months after completion of the application process unless longer storage is required on the basis of explicit consent or due to ongoing proceedings.
4.8. Employees of TY APP TECHNOLOGIES LIMITED
4.8.1. Data of our own employees are processed exclusively for the establishment, performance and termination of the employment relationship and for compliance with employment, social security and tax law obligations.
4.8.2. The legal basis is Article 6(1)(b) and (c) GDPR, and additionally Article 9(2)(b) GDPR where special categories of data are concerned.
5. Collection of data from third parties
5.1. Where necessary, we also process data that have not been collected directly from the data subject, for example: in the context of credit or sanctions list checks of hotels or companies, or from publicly accessible sources (e.g. commercial register, trade register, company websites).
5.2. We also receive data from third parties (e.g. our contractual hotels) where these provide us with staff data for the use of the Thank You Vibes. Hotel operators are obliged to inform their staff about such transfer.
5.3. The legal basis is Article 6(1)(b), (c) or (f) GDPR, depending on the specific context.
6. Duration of processing, retention periods, transfers to third countries
6.1. We store personal data only for as long as this is required for the respective processing purposes, statutory retention obligations exist or we have a legitimate interest in storage.
6.2. As soon as data are no longer required for the purposes mentioned and no statutory retention obligations prevent deletion, the data are deleted or anonymised.
6.3. For hosting and operating the Website, the Web App, the Admin Area and the mobile staff app we use, among other things, infrastructure from Google Firebase / Google Cloud Platform (GCP). In this context, personal data may be transferred to recipients in countries outside the EU/EEA (in particular the USA). Where no adequacy decision of the European Commission is in place, transfers are based on appropriate safeguards within the meaning of Articles 44 et seq. GDPR (in particular EU standard contractual clauses and supplementary technical and organisational measures).
6.4. In the context of payment processing (see section 9), data may be transferred to payment service providers established within or outside the EU/EEA (e.g. to Stripe Payments Europe, Limited, based in Ireland). Where required, appropriate safeguards within the meaning of the GDPR are also implemented for such transfers.
6.5. In exceptional cases, transfers may also be based on one of the derogations set out in Article 49 GDPR.
7. Server log files (access data)
- IP address and unique device identifier,
- date and time of access,
- URL accessed and referrer URL,
- amount of data transferred,
- browser type and version used, operating system.
7.3. The legal basis is our legitimate interest in secure and stable technical operation of the Website, the Web App, the Admin Area and the mobile app (Article 6(1)(f) GDPR).
7.4. Retention period: Server log files are stored for 12 Months and then deleted unless further reasons (e.g. IT security incidents, ongoing proceedings) require longer retention.
8. Cookies and similar technologies (static cookie policy)
8.1. General
8.1.1. Our Website and Web App use cookies and similar technologies (e.g. local storage, pixels). Cookies are small text files that are stored on your end device and contain certain information.
8.1.2. We use strictly necessary cookies that are essential for the operation of the Website/Web App, and optional cookies where you have consented to this.
8.1.3. Our application code for the marketing Website currently (as of 12/2025) does not set any additional tracking or marketing cookies; any cookies serve technical purposes only (e.g. session management, security).
8.2. Legal bases
8.2.1. Strictly necessary cookies are processed on the basis of our legitimate interest in a functioning and secure web presence (Article 6(1)(f) GDPR).
8.2.2. Non-essential cookies are only set if you have given your prior consent (Article 6(1)(a) GDPR).
8.3. Cookie settings in the browser
You can configure your browser to prevent cookies from being stored or to display a notification before a new cookie is set. You can delete cookies that have already been stored at any time via the browser settings.
9. Payment processing via payment service providers
9.1. For the processing of digital tips, payment service providers are integrated. At present, Stripe Payments Europe, Limited, Ireland (“Stripe”) is used as a payment service provider; other payment service providers may be added in the future. Details on data processing by Stripe can be found in Stripe’s own privacy notice.
9.2. When using the Web App, payment data (e.g. card number, expiry date, CVC) are entered directly into an input mask of the payment service provider. We do not receive these sensitive payment data in full form, but only technical references and abstracted information.
9.3. Payment service providers act – depending on the specific setup – as independent controllers or as joint controllers within the meaning of Article 26 GDPR.
9.4. The legal basis for integration is Article 6(1)(b) GDPR (performance of the payment/tipping contract) and Article 6(1)(f) GDPR (legitimate interest in secure and efficient payment processing).
10. Integration of third-party services and content
10.1. Where we in future integrate content or services of third parties on the Website or in the Web App (e.g. map services, embedded videos, fonts, CDNs), this may involve the transfer of personal data to such third parties.
10.2. Depending on the service, processing is either based on our legitimate interests (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR).
11. Processors
11.1. We engage processors within the meaning of Article 4(8) and Article 28 GDPR for specific activities (e.g. hosting, e-mail dispatch, development, support, monitoring). We conclude data processing agreements with such processors pursuant to Article 28 GDPR.
- Hosting / infrastructure: Google Cloud Platform / Firebase (Google LLC, USA)
- E-mail and communication services: Google Cloud Platform (Google LLC, USA)
- Error and performance monitoring: Google Cloud Platform / Firebase (Google LLC, USA), Sentry (Functional Software, Inc.)
11.3. A list of the processors currently used can be made available on request.
12. Security of processing
12.1. We implement appropriate technical and organisational measures in accordance with Article 32 GDPR. These include in particular measures to safeguard the confidentiality, integrity and availability of systems.
- MySQL as the leading system (“source of truth”) for key business and transactional data,
- Firestore as a non-authoritative but highly available real-time and synchronisation layer,
- Strict role-based access control (RBAC) and tenant isolation,
- No storage of raw passwords or full payment data in our systems,
- Comprehensive audit logs for security-relevant and administrative actions.
12.3. Our security measures are reviewed regularly and adjusted where necessary to reflect the state of the art.
13. Rights of data subjects
13.1. Data subjects have the following rights under the applicable statutory provisions in particular:
- Right of access (Article 15 GDPR): You may request information as to whether and which personal data we process about you.
- Right to rectification (Article 16 GDPR): You may request the rectification of inaccurate data.
- Right to erasure (Article 17 GDPR): You may request the erasure of your personal data.
- Right to restriction of processing (Article 18 GDPR): You may request the restriction of processing.
- Right to data portability (Article 20 GDPR): You have the right to receive your data in a structured format.
- Right to object (Article 21 GDPR): You may object to processing based on Article 6(1)(e) or (f) GDPR.
- Withdrawal of consent (Article 7(3) GDPR): You may withdraw any consent given at any time.
- Right to lodge a complaint (Article 77 GDPR): You have the right to lodge a complaint with a supervisory authority.
14. Exercising your rights, right to lodge a complaint
14.1. You may exercise your rights at any time by contacting:
TY APP TECHNOLOGIES LIMITED
61–63 Lord Byron Street, 6th floor, office 602, 6023 Larnaca, Cyprus
E-mail: legal@thank-you.app
14.2. Irrespective of this, you have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority of your habitual residence, your place of work or the place of the alleged infringement is competent in particular.
15. Currency and amendment of this privacy notice
15.1. This privacy notice is currently valid and is dated 01/2026.
15.2. Due to the further development of our Website, Web App, Admin Area or mobile app or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy notice. The current version can be accessed on our website at any time.