Data processing agreement

Article 1. Parties and definitions

This data processing agreement accompanies Chefstr's terms of service and uses the same definitions. The parties are:

The Customer: the business that created the Account and, as an employer, enters its employees' personal data in Chefstr. The Customer is the controller.
Chefstr: ASD Solutions, trading as Chefstr, Wilhelminastraat 32, 1054 WJ Amsterdam, Chamber of Commerce (KvK) number 82907730. Chefstr is the processor.

Terms such as personal data, processing, data subject, controller, processor and personal data breach have the meaning given to them in the General Data Protection Regulation (GDPR).

This agreement does not cover the Customer's own data: the name, email address, phone number and billing details of the Administrator and the business. For that data, Chefstr is the controller and the privacy policy applies.

Article 2. Subject matter and duration

Chefstr processes personal data on behalf of the Customer to the extent necessary to provide the Service. This agreement takes effect when the Customer accepts it at registration and remains in force for as long as the Customer's Account exists. After it ends, article 12 applies.

Article 3. Nature and purpose of the processing

Chefstr is staff management software for the hospitality industry. The processing consists of storing, displaying, calculating, sending and deleting data in order to, on the Customer's instructions:

create and publish schedules, including open shifts and shift swaps;
record hours worked through the app and the kiosk, and approve them;
calculate wage costs, allowances, tips and payouts;
keep track of availability, leave and sick leave;
send employees messages and push notifications about their schedule and hours;
create reports and email them to recipients the Customer specifies.

Chefstr uses the data for nothing else. No profiling, no selling, no advertising. To improve the Service, Chefstr uses only aggregated, anonymised data.

Article 4. Data subjects and categories of personal data

The data subjects are:

the Customer's employees, including Managers and Administrators who work shifts themselves;
trial workers: candidates the Customer schedules on a trial basis;
persons to whom the Customer has reports sent (for example a bookkeeper), of whom only the name and email address are kept.

Chefstr processes the following categories of their data, as entered by the Customer:

Identity and account: first name, last name, email address, an encrypted (hashed) password, the role in Chefstr, and whether the account is active.
Employment: date of birth, start date, contract type, contract hours and days per week, position and team, whether someone works shifts in the schedule, whether someone is a trial worker, and the archive status.
Wages and payouts: hourly wage with its effective date, allowances per shift, and calculated and allocated tips and payouts.
Schedule and hours: scheduled shifts, open shifts and shift swaps, clock-in and clock-out times, hours worked and approved, and the descriptions attached to them.
Availability and leave: availability per day or weekday with times and an optional note; leave requests with dates, hours, status and an optional note.
Sick leave: only the absence itself: the date the employee reported sick, the date they recovered, and an optional note from the Customer. Chefstr does not ask for diagnoses or other medical data, and the Customer does not enter them.
Kiosk PIN code: the four-digit code an employee uses to clock in and out on the kiosk, stored in encrypted form.
Messages: the title and text of messages and push notifications sent to an employee, and whether they have been read.
Device and usage data: the push token and platform (iOS or Android) of an employee's phone, the name and pairing status of a kiosk tablet, and IP addresses, browser and app versions and login times in the security logs.

Chefstr does not process citizen service numbers (BSN), copies of identity documents or employees' bank account numbers. The Customer does not enter data the Service does not ask for, and does not enter special categories of personal data in free-text fields (notes, descriptions).

Article 5. Chefstr's obligations

Chefstr:

processes the personal data only on the Customer's instructions. The Customer's instructions consist of the Service itself, as the Customer uses it, and this agreement. If the law requires Chefstr to process the data differently, Chefstr informs the Customer in advance, unless the law prohibits this;
has the data processed only by persons who are bound by confidentiality and who need it for their work;
takes the security measures set out in article 6;
engages sub-processors only in accordance with article 7;
assists the Customer with requests from data subjects (article 9) and with personal data breaches (article 10);
assists the Customer, to the extent reasonable and necessary, with a data protection impact assessment and with consulting the Dutch Data Protection Authority;
deletes or returns the data after the agreement ends, in accordance with article 12;
makes available to the Customer all information necessary to demonstrate compliance with this agreement (article 11), and informs the Customer if, in Chefstr's view, an instruction conflicts with the GDPR.

Article 6. Security

Chefstr takes appropriate technical and organisational measures to protect the personal data against loss and unlawful processing. These currently include:

encrypted connections (TLS) between the browser, the app, the kiosk and the servers;
passwords are stored only as hashes; kiosk PIN codes and the Customer's IBAN for the direct debit are stored in encrypted form;
role-based access: an employee sees the schedule of their own teams and of the teams the Customer makes available to employees, and only their own hours and wages; a Manager and an Administrator see only the Customer's Workspace; the rights per role are defined in the software and checked on every request;
secure login with sessions of limited validity, limits on login attempts, and a log of security events;
strict separation between the data of different customers in the database (each Workspace has its own schema);
daily backups, kept for 14 days, so that data can be restored after an outage;
access to the production environment only for Chefstr staff who need it for their work.

Chefstr may adapt these measures to the state of the art, as long as the level of protection does not decrease. The Customer is responsible for using the Service securely: strong passwords, revoking the access of departed employees, and managing the kiosk tablets.

Article 7. Sub-processors

The Customer gives Chefstr general authorisation to engage sub-processors. Chefstr concludes an agreement with every sub-processor that imposes at least the same obligations as this one, and Chefstr remains responsible towards the Customer for what its sub-processors do. Chefstr currently engages the following sub-processors:

Hetzner Online GmbH: hosting of Chefstr's servers and databases, and storage of the backups, in data centres within the European Union.
Amazon Web Services EMEA SARL (Amazon SES): sending email (such as invitations, password-related emails and reports) from the Frankfurt region (eu-central-1). Data processed: email addresses, names and the content of the email.
Google Ireland Limited (Firebase Cloud Messaging): delivering push notifications to the phones of employees who use the app. Data processed: the device's push token and the title and short text of the notification.
Mollie B.V.: SEPA direct debits for paid plans. Data processed: the account holder's name, the IBAN and the Customer's Direct debit mandate. This concerns the Customer's own data, not its employees' data.
Cloudflare, Inc.: securing and delivering traffic to Chefstr's website and platform, and the bot check (Turnstile) when an Account is created. Data processed: IP addresses and technical characteristics of the browser.

If Chefstr wants to add or replace a sub-processor, Chefstr announces this at least 30 days in advance by email to the Administrators, together with a new version of this page. The Customer may object within that period, stating its reasons. If the parties cannot reach a solution, the Customer may end the agreement before the change takes effect.

Article 8. Transfers outside the EEA

Chefstr stores the personal data within the European Union. Where a sub-processor listed in article 7 processes data outside the European Economic Area (which may be the case when delivering push notifications and for traffic through Cloudflare), this only happens with an appropriate safeguard under Chapter V of the GDPR, such as an adequacy decision of the European Commission or the standard contractual clauses.

Article 9. Rights of data subjects

Requests from employees for access, rectification, erasure, restriction, objection or portability are handled by the Customer; the Customer can carry out most requests itself in Chefstr. If Chefstr receives such a request directly, Chefstr refers the data subject to the Customer and informs the Customer. Where the Customer cannot handle a request itself, Chefstr assists within 10 business days of the Customer's request, for example by providing an export.

Article 10. Personal data breaches

If Chefstr discovers a personal data breach that affects the Customer's data, Chefstr informs the Administrators by email without undue delay after discovering it. The notification describes, as far as known at that time, the nature of the breach, the data and data subjects concerned, the likely consequences, and the measures Chefstr has taken or proposes. Chefstr updates the notification as soon as more is known. The Customer decides whether the breach must be reported to the Dutch Data Protection Authority or to the data subjects; Chefstr assists with this.

Article 11. Audits

The Customer may verify once a year whether Chefstr complies with this agreement. This starts with written questions, which Chefstr answers within 30 days. If that does not give the Customer sufficient assurance, an audit by an independent expert may follow, announced with 30 days' notice, during office hours and without disrupting the service to other customers. The costs are borne by the Customer, unless the audit reveals serious shortcomings. The expert is bound by confidentiality.

Article 12. End of processing and deletion

The Customer can export its data itself at any time through the reports in Chefstr. When the Account ends, Chefstr deletes all personal data in the Workspace within 30 days of termination, unless the Customer has requested an export before then; in that case, Chefstr deletes the data once the export has been delivered. Within a further 14 days, it has also been removed from the backups.

Chefstr is not an archive. The Customer remains responsible for keeping the records the law requires of it as an employer, such as time records and payroll records, including after Chefstr has deleted the Workspace. The Customer's own data (the registration details, the billing details and the Direct debit mandate) is not covered by this agreement; how long Chefstr keeps it is stated in the privacy policy.

Chefstr deletes a free-plan Account that nobody has used for a year in accordance with article 10 of the terms of service: Chefstr sends a notice by email and a reminder 7 days before the deletion, and deletes the Account 30 days after the notice, unless somebody logs in during that period. Chefstr deletes an Account that has been blocked for six months in the same way, unless the block is lifted during that period; the Workspace is then removed, even if the Account has billing details. An Account with billing details is not deleted for inactivity.

Chefstr keeps data it is legally required to keep (such as invoices, for the 7-year retention period for tax purposes) until that period has expired, in restricted storage, separate from everyday use.

Article 13. Liability

Liability under this agreement is governed by article 11 of the terms of service. Each party is liable towards data subjects and supervisory authorities for the damage caused by its own failure to comply with the GDPR, as provided in article 82 GDPR. Fines imposed by a supervisory authority on a party for a violation attributable to that party are borne by that party.

Article 14. Record of acceptance and changes

The Customer accepts this agreement at registration by ticking the relevant box. Chefstr records which version of this text was accepted, the time, the IP address and the browser of the person who created the Account. Chefstr keeps that record with the Account. After the Account ends, Chefstr deletes it together with the Workspace, or keeps it together with the invoices until the statutory retention period has expired, as described in article 12 of the terms of service.

Chefstr may change this agreement if the law, a supervisory authority or the Service requires it. Chefstr announces a change at least 30 days in advance by email to the Administrators. Every version is dated at the top. Dutch law applies to this agreement.

Questions about this agreement or about personal data:

Company: ASD Solutions, trading as Chefstr
Address: Wilhelminastraat 32, 1054 WJ Amsterdam, the Netherlands
Chamber of Commerce (KvK): 82907730
Email: privacy@chefstr.com