Version 1.0 · effective September 28, 2026
Privacy Notice
This is the current version shown during signup and recorded with each acceptance.
1. Controller
The controller for the data described here is the operator of TableServe named in the Imprint. Questions about data go to the privacy address given there.
2. Two roles
For the Customer's account (the business, its owner and the staff logins it creates) the Platform is the controller. For the guests' data that the Customer collects through its menu, orders, reservations and feedback, the Customer is the controller and the Platform is the processor acting on the Customer's instructions under the Data Processing Agreement.
3. What we process about the Customer, and why
Account and logins: name, e-mail address, role, password and PIN as one-way hashes, sign-in times and devices. Purpose: running the service (Art. 6(1)(b) GDPR).
Business details: name, address, VAT id, legal identity as entered in Settings. Purpose: the contract and invoicing (Art. 6(1)(b), (c) GDPR).
Contract records: which document versions were accepted, when, from which address and browser. Purpose: evidence of the contract (Art. 6(1)(b), (f) GDPR).
Invoices and payments: kept for 10 years under § 147 AO and § 257 HGB (Art. 6(1)(c) GDPR).
Support messages and audit logs of security-relevant actions (Art. 6(1)(f) GDPR: running a secure service).
Marketing e-mails only with the Customer's separate consent, which can be withdrawn at any time in Settings (Art. 6(1)(a) GDPR).
4. Guests' data the Customer collects
Orders, requests, reservations (name, phone or e-mail when the guest gives them), feedback and device notification tokens. The Platform keeps them for the Customer for as long as the Customer's retention setting says (default 365 days); reservation contact details are then anonymised automatically. The Customer can export or delete them from its own admin at any time.
5. Cookies
The Platform uses only strictly necessary cookies: the sign-in session, the guest's table session, the chosen language, and the cookie that remembers a cookie choice. No analytics or advertising cookies are set. The banner and the "Privacy settings" entry let anyone see and change this.
6. Recipients
Hosting on servers in Germany; an e-mail delivery provider for transactional e-mails; an encrypted off-site copy of the nightly backup. No data is sold or shared for advertising. Processors are bound by contracts under Art. 28 GDPR. Where a processor is outside the EU/EEA, standard contractual clauses apply.
7. Backups and access
Every night the Platform seals a complete, encrypted copy of each Customer's data into the Customer's own area, kept for 30 nights, and one encrypted copy of the whole system for disaster recovery. Platform staff do not open a Customer's data unless the Customer asks for support that needs it; every such access is logged.
8. Your rights
Access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR), and the right to complain to a supervisory authority. Export and deletion are available directly in the admin; anything else goes to the privacy address in the Imprint.
9. Changes
This notice is versioned. The current version is always available in the Legal Centre and from the admin; the version acknowledged at signup is recorded.