BeställNu POS AB ("BeställNu", "we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data in connection with the use of our website (bestallnu.com), our cloud-based backoffice management tool, our point-of-sale app (BeställNu POS), our staff self-service app (PersonalNu), and our customers' online ordering systems.
1. Roles and Responsibilities (Data Controller vs. Data Processor)
- BeställNu as a Data Controller: We act as a Data Controller for personal data collected from our direct subscribers (restaurant owners, managers) and visitors to our public website.
- BeställNu as a Data Processor: When a restaurant uses BeställNu POS and PersonalNu to run its daily operations (e.g., table reservations, online orders, tip distributions, staff time-tracking, work schedules, leave requests, and staff registers), we process personal data on behalf of the restaurant. In these cases, the restaurant is the Data Controller, and we act as the Data Processor under a signed Data Processing Agreement (DPA).
2. Data Collection, Purposes, and Legal Bases
A. Restaurant Customers & Admins (User Accounts)
Data Types: Name, email address, phone number, hashed password, organization name, VAT number, billing address, and system logs (IP address, browser agent, login timestamps).
Purpose: To provide, manage, and invoice our services, communicate updates, and perform troubleshooting.
Legal Basis: Performance of a contract and compliance with legal accounting obligations.
B. Restaurant Employees (Staff)
Data Types: Name, email, role (e.g., cashier, waiter, kitchen_staff, manager), national personal identity number (personnummer - required for payroll compliance and Skatteverket tax reporting), PIN codes, clock-in/out timestamps, break schedules, wage rates, tax rates, holiday pay rates, and distributed tips.
Purpose: To calculate payroll, allocate tips, generate schedules, and maintain the mandatory staff log (personalliggare) under Swedish tax regulations.
Legal Basis: Contract performance (for the employer) and compliance with legal tax obligations (Skatteverket).
C. Restaurant Guests (Reservations and Online Ordering)
Data Types: Name, phone number, email address, reservation date/time, table number, special requests/allergies entered by the guest, items ordered, payment method, transaction IDs, and tip amounts.
Purpose: To manage table reservations, process online orders, handle split payments, and generate tax-compliant fiscal receipts.
Legal Basis: Performance of a contract (delivering the booking/order) and compliance with legal obligations (Swedish Bookkeeping Act and Skatteverket cash register rules).
D. POS Application Permissions (BeställNu POS)
To operate successfully on restaurant tablets and POS terminals, our app requests the following device permissions:
- Bluetooth & Bluetooth Scan/Connect: Used exclusively to discover and pair with thermal receipt printers and payment terminals (e.g., Worldline).
- Location Services (ACCESS_FINE_LOCATION): Android requires location permissions to perform Bluetooth scans. We do not track, record, or share your device's geographical location coordinates. It is strictly used locally to locate nearby printer hardware.
- Local Network Access: Used on iOS and Android to find and print to IP-based receipt printers on the same Wi-Fi network.
- Storage Access (Read/Write): Used to cache menus locally and store system logs.
E. Staff Self-Service Application (PersonalNu / Planering - Permissions, Data Protection & Ads Declaration)
The PersonalNu mobile application (package name: com.personalnu.planering) is a dedicated self-service mobile app for restaurant staff and employees working at venues using BeställNu. The app enables employees to conveniently view their published work schedules, verify tracked working hours, submit leave and absence requests, and receive operational shift notifications from management.
Personal Data Processed in PersonalNu:
- Authentication and Identity: Swedish national identity number (10 digits, YYMMDD-XXXX) and a 4-digit personal PIN. Staff credentials are authenticated against the restaurant employer's staff directory. Session tokens are held securely in device hardware-backed secure storage (SecureStore) and never transmitted in clear text.
- Work Schedules and Shift Data: Scheduled shifts, assigned job roles, scheduled breaks, and roster updates.
- Time Tracking & Recorded Hours: Clock-in and clock-out timestamps, recorded break times, and total accumulated hours used for payroll calculation.
- Leave and Absence Requests: Date ranges for requested time off, leave categories, optional employee notes, and supervisory decision statuses (pending, approved, rejected).
- Notification Device Tokens: Push notification tokens (Expo Notifications / APNs / FCM) generated uniquely for the device after user permission, used strictly for operational schedule and leave notifications.
Device Permissions Requested by PersonalNu:
- Internet Access (
android.permission.INTERNET): Required for encrypted TLS/HTTPS communication with the BeställNu API. - Push Notifications: Required to alert employees of roster publications, schedule changes, or decisions on submitted leave requests. Requested with explicit device-level consent and manageable at any time via system settings.
- No Sensitive Hardware Permissions: PersonalNu does not request access to device location (GPS), Bluetooth, microphone, camera, contacts, call logs, or external media storage.
Advertising and Marketing Policy (Google Play Ads Declaration):
- PersonalNu contains NO advertisements (Contains NO Ads): The app is completely ad-free. We do not display banner ads, interstitial ads, native ads, or house ads.
- No Ad SDKs or Behavioral Tracking: PersonalNu does not include any third-party advertising SDKs or behavioral ad tracking libraries.
- No Data Monetization: Personal data is never sold, leased, or disclosed to advertising networks or data brokers.
In-App Privacy Policy Access:
A direct link to this Privacy Policy is available at all times within PersonalNu under Settings > About > Privacy Policy.
3. Data Sharing with Third Parties
We share data only with trusted partners required to provide the core services:
- Payment Processors: Worldline, Bambora, and Swish to safely capture and refund card or mobile transactions.
- Accounting Platforms: Fortnox to automate the synchronization of daily Z-reports, invoices, and daily staff payroll data.
- Cloud Hosting: Microsoft Azure (highly secure EU-based database and API hosting).
- Application Telemetry: Azure Application Insights (OpenTelemetry) for performance monitoring and error logging.
4. Retention and Deletion
We store personal data only as long as necessary to fulfill the purposes outlined or as required by Swedish law.
- Fiscal Records (Receipts & Z-Reports): Under the Swedish Bookkeeping Act (Bokföringslagen), transaction histories, cash register logs, and daily receipts must be retained for 7 years. This legal requirement supersedes any GDPR deletion requests.
- Staff Logs (Personalliggare): Retained in compliance with Skatteverket audit rules.
- Staff Data & Schedules (PersonalNu): Work schedules, time-tracking records, and leave requests are retained for the duration of employment and for statutory labor, payroll, and tax compliance periods, after which data is deleted or anonymized.
- Table Reservations: Automatically deleted or anonymized 24 months after the reservation date, unless the restaurant maintains an active guest profile at the customer's request.
5. Your GDPR Rights
Under the GDPR, you have the following rights:
- Right of Access: To request copies of your personal data.
- Right to Rectification: To request corrections of inaccurate data.
- Right to Erasure: To request deletion of data (subject to Swedish tax and bookkeeping law retention limits).
- Right to Object/Restriction: To object to or restrict processing.
- Right to Data Portability: To transfer data to another service.
To exercise these rights, please email support@bestallnu.com. If you believe our data handling violates GDPR, you have the right to file a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY).
6. Contact Information
BeställNu POS AB
Email: support@bestallnu.com
Corporate Identity Number: 5595710442