Privacy Policy

This privacy policy applies to the OrderFood Staff app (the "App") for mobile devices, developed by Nordic IT Resources AB ("we"). The App is a workforce tool for restaurants on OrderFood: staff see their schedule and hours, report when they can't work and receive reminders, and managers build the schedule, finalize hours and export them to payroll. Accounts are created by the employer — there is no public sign-up. The App never records clock-ins or clock-outs; that happens at the restaurant's terminal or cash register.

Who is responsible for your data?

Your employer (the restaurant) is the data controller for your employment data in the App — schedule, working hours, absence and the personal details your employer has registered about you. We process that data on the employer's behalf, as a data processor under the agreement between the restaurant and us.

For data needed to run and protect the App itself — device information, security logs and crash reports — Nordic IT Resources AB is the data controller.

Questions about your schedule, your hours or the details your employer registered should go to your employer first. We help the employer respond.

What information is processed?

Information your employer registers

• Name, role and employment type
• Employee number and phone number, if your employer provides them
• Personal identity number — stored encrypted, needed for the statutory staff ledger, and never shown in the App once saved
• Your four-digit staff PIN used at the terminal and cash register (stored hashed)
• For managers: email address and password for signing in, plus a six-digit PIN (password and PIN stored hashed)

Information about your work

• Scheduled shifts, with change history (what changed, by whom and when)
• Clock-ins, clock-outs and breaks recorded at the terminal or cash register (the staff ledger)
• Absence and absence type registered by your employer (for example sick leave, VAB — care of a sick child — vacation, leave of absence or time off)
• Finalized hours, unsocial-hours bands and approved weeks

Information you enter in the App

• When you can't work: weekdays, dates, times and an optional note
• Messages when you mark a shift as "Doesn't match"
• Which reminders you want
• Language and appearance (stored only on your phone)

Device information

The device name, operating system, app version, push token, when the phone was paired and last used, and a device key that keeps the phone signed in (stored hashed on our side and in the phone's secure storage). Our servers log IP addresses for security and troubleshooting.

Crash reports

If the App crashes, an error report is sent with the error message, a technical stack trace, device model, operating system and app version, linked to an internal user ID. Reports do not include your name or email address.

What we don't collect

The App does not use your location, microphone, contacts or photo library. We do not use any data for advertising and do not track you across apps or websites.

How is the information used?

• To show your schedule, your hours and your team's published shifts
• To let your employer build the schedule, handle deviations, approve the week and export hours to payroll
• For push notifications: new or changed schedules, shifts starting soon, forgotten clock-outs and weeks to approve
• To pair and block phones, keep unauthorized users out and lock manager mode with a PIN
• To find and fix bugs in the App

Who sees what?

• Colleagues at the same locationsee the name, role and times of published shifts, and "Day off" on a shift you don't work — never the reason (such as sick leave or caring for a sick child), your personal identity number, phone number, hours, when you can't work or your messages to your manager.
• Managers and your employer's administratorssee the schedule, clock-ins, hours, when you can't work, your messages and your phone number for the locations they are responsible for.
• Payroll: a manager can export hours as a CSV or Excel file, or email the file from the App, with name, employee number, role and times — never personal identity numbers — and hand it to the payroll system or payroll administrator. Your employer is responsible for that file.

We also use the following service providers, which process data on our behalf:

• Supabase (database and authentication)
• Vercel (server hosting)
• Expo, Apple and Google (push notification delivery)
• Sentry (crash reports, stored in the EU)
• Resend (email delivery when a manager emails the hours report)

Where data is transferred outside the EU/EEA, this relies on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. We never sell personal data. We disclose data to authorities when required by law.

Legal basis (GDPR)

Your employer processes the data to perform the employment contract — scheduling and pay (Art. 6(1)(b)) — and to meet legal obligations such as the statutory staff ledger and working-time rules (Art. 6(1)(c)). Absence types such as sick leave and VAB are health data; your employer processes them to meet its obligations as an employer under employment law, such as sick pay (Art. 6(1)(c) and Art. 9(2)(b)). We process device information, security logs and crash reports based on our legitimate interest in keeping the App secure and working (Art. 6(1)(f)). You can turn off push notifications in the App or in your phone's settings.

Data retention

• Clock-ins and scheduled shifts, with change history and flags: the current year plus the two previous calendar years, then deleted automatically. This is the period the staff ledger must be kept.
• Dates when you can't work: same limit. Recurring weekdays remain until you remove them.
• Pairing QR codes are valid for 60 seconds and deleted within a day.
• Blocked phones are deleted 90 days after being blocked, and a manager's phone 90 days after signing out. If you disconnect the phone under Me, it is blocked immediately (and its push token deleted). If the phone is offline at that moment, the device record remains until your manager blocks it at the terminal or cash register.
• PIN attempt logs: 90 days.
• Crash reports: at most 90 days.
• Name, phone number and personal identity number remain while your employer keeps you registered, even if you have been deactivated, or until deletion is requested. Name and personal identity number are, however, kept for as long as the staff ledger must be kept. Approved weekly summaries (total hours and absence per week) are deleted at the same limit as the shifts; only the fact that the week was approved, by whom and when, remains.

Your rights

You have the right to access your data, have errors corrected, have data erased or restricted, object to the processing and receive your data in a machine-readable format. Contact your employer, or email privacy@orderfood.se and we will help. You can also lodge a complaint with your supervisory authority (Sweden: IMY; Denmark: Datatilsynet; Poland: UODO).

Disconnecting and account deletion

Under Me → "Disconnect this phone" you sign out and block the phone: the App's data is removed from the phone, its push token is deleted immediately and the phone stops receiving notifications and data. You can then be connected to a new phone at the terminal or cash register. Managers sign out from the manager menu. This does not delete your account.

Your account is created by your employer and can't be deleted directly in the App. To have your account and data deleted, ask your manager or the restaurant owner to remove you, or email privacy@orderfood.sewith the subject "Delete my account – OrderFood Staff", stating your name, the restaurant and the phone number or email address that is registered. We verify the request with your employer and confirm within 30 days. Data that must be kept by law (the staff ledger) is deleted when the retention period ends. See Delete your account and data for what is deleted and what is kept.

Camera

The camera is used only to scan the QR code when you pair your phone. Images are not saved or sent anywhere.

Security

All traffic is encrypted. Personal identity numbers are stored encrypted, and PINs and device keys are stored hashed. Access checks on every request mean you only see your own data and your team's published shifts. A lost phone can be blocked immediately at the terminal or cash register. No system is completely secure, but we actively work to protect your data.

Young employees

The App is a workforce tool that employers give to their staff, including young employees. We do not use any data for marketing and do not collect data about children for any other purpose.

Changes

We may update this policy. The latest version is always on this page, with the date at the top. We will announce material changes through your employer or in the App.

Contact us

Privacy questions about the App: privacy@orderfood.se.