Privacy policy

1. Who we are and our role

Chefstr is a product of ASD Solutions, Wilhelminastraat 32, 1054 WJ Amsterdam, Chamber of Commerce (KvK) number 82907730 ("we"). We provide staff management software for the hospitality industry: schedules, time tracking, wage calculations and tips.

We have two roles:

• Controller for the data of the business that creates an account: the registration, the administrators, the billing details, the SEPA direct debit mandate for a paid plan, and visits to chefstr.com. That is what this policy covers.
• Processor for everything an employer enters about their employees in Chefstr: names, contracts, schedules, hours, wages, tips, availability, leave and sick leave. The employer is responsible for that data, and the data processing agreement applies to it. If you are an employee and want to know what your employer has recorded about you, ask your employer.

2. What data we process and why

The law requires us to state, for each purpose, the legal basis on which we may use the data. Each item below states that basis: the data is necessary to perform our agreement with you, we are legally required to process it, or we have a legitimate interest that outweighs yours.

• Registration and account: first name, last name, business name, phone number, email address, a hashed password and the country your business is in. We use these to create your account, let you log in and contact you about your account. Legal basis: necessary to perform our agreement with you.
• Your acceptance of the terms: we record which version of the terms of service and the data processing agreement you accepted at registration, along with the time, the IP address and the browser used. This is so that we can show later what was agreed. Legal basis: our legitimate interest.
• Billing details and payments (paid plans only): the name and address of your business, an email address for invoices, your VAT number together with the result and consultation number of our check against VIES, your invoices, the payment status and, if a direct debit fails or is reversed, the reason your bank gives for it. We use these to invoice and collect payment, and to comply with invoicing and VAT rules. Legal basis: necessary to perform our agreement with you, and our legal obligations, including under tax law.
• SEPA direct debit mandate (paid plans only): the mandate under which we collect your subscription fee from your bank account: the account holder's name and the IBAN (stored in encrypted form; in Chefstr you only see the last 4 digits). Legal basis: necessary to perform our agreement with you. As proof of the mandate, we also record who signed it (name and email address), the time, the IP address and the browser, and which version and language of the mandate text was shown; for a paper mandate, we keep the signed form. Up to 13 months after a collection, an account holder can dispute it on the grounds that no mandate existed, and the bank will then ask us for proof. Legal basis for keeping that proof: our legitimate interest. Only Chefstr staff can view it. A paid plan is only possible with a direct debit mandate; if you prefer not to provide one, the free plan remains available.
• Security: IP addresses, browser and app versions, login attempts and other security events in our logs. We use these to detect abuse, resolve outages and protect your account. Legal basis: our legitimate interest.
• Bot check when you create an account: Cloudflare Turnstile uses the IP address and technical characteristics of the browser to assess whether a sign-up is made by a human. Legal basis: our legitimate interest.
• Email and support: we only send emails about your account, such as the confirmation of your registration, password-related emails, invoices and notices about your plan. No advertising. If you email us, we use your message to help you.

We need your registration data to create your account, and your billing details and direct debit mandate to provide a paid plan; without them, we cannot perform that part of the agreement. We do not use your data for profiling or automated decision-making, and we do not sell it. To improve the service, we only look at aggregated, anonymised figures.

3. Who we share data with

We only share data with parties we need in order to provide the service, or with whom the law requires us to share it. We have a data processing agreement with every party that works on our instructions:

• Hetzner Online GmbH: hosting of our servers, databases and backups, in data centres within the European Union.
• Amazon Web Services EMEA SARL (Amazon SES): sending our emails from the Frankfurt region.
• Google Ireland Limited (Firebase Cloud Messaging): delivering push notifications to the phones of employees who use the app.
• Mollie B.V.: SEPA direct debits for paid plans. Mollie executes the direct debit on our behalf and therefore appears on your bank statement as the party collecting the payment. Mollie receives the account holder's name, the IBAN, the reference and date of the mandate, and for each collection the amount and the invoice number. As a payment institution, Mollie also processes that data under its own privacy statement.
• Cloudflare, Inc.: securing and delivering traffic to Chefstr's website and platform, and the bot check when you create an account.
• Banks: your bank and ours, for collections, reversals and payments by bank transfer.
• Our accountant: receives a copy of every invoice email, for our bookkeeping and VAT returns.
• VIES and the Dutch Tax Administration: your VAT number is sent to VIES, the European Commission's verification system, and, for invoices with reverse-charged VAT, to the Dutch Tax Administration (Belastingdienst), as the law requires.

We store your data within the European Union. Where Google or Cloudflare process data outside the European Economic Area, this only happens with an appropriate safeguard under the GDPR, such as an adequacy decision of the European Commission or the standard contractual clauses; on request, we will tell you which safeguard applies to which party. Beyond that, we only share data when the law requires us to.

4. How long we keep data

• Your account: for as long as it exists. After termination, we delete your workspace (your business's environment in Chefstr, with all of your employees' data) within 30 days. If you never entered billing details, we also delete your registration data and the record of your acceptance of the terms. Within a further 14 days, it has also been removed from the backups. If you did enter billing details, we keep them together with your invoices, your direct debit mandate and the record of your acceptance of the terms for the periods stated below, and nobody can log in to the account any more.
• Invoices and payments: 7 years, the statutory retention period for tax purposes, in restricted storage, separate from everyday use, even if your account has already been deleted.
• Direct debit mandate and supporting proof: for as long as the mandate is active and for 7 years after that, because they are the evidence behind the invoices and collections. We erase the full IBAN sooner: 14 months after the last collection under an ended mandate. After that, we keep only the last 4 digits.
• Security logs: for as long as we need them to detect abuse and investigate outages, after which we delete them.
• Support: we keep your messages for as long as needed to handle your question.
• Disputes and abuse: if a dispute, a reversal or an investigation into fraud or abuse is ongoing, we keep the data needed for it for as long as the case runs, in restricted storage, separate from everyday use.

We delete free-plan accounts that nobody has used for a year (not a single login, including through the app or a paired kiosk). The administrators first receive a notice by email, followed by a reminder 7 days before the deletion; 30 days after the notice, we delete the account with all its data, including the registration data. If somebody logs in during that period, the deletion is cancelled. We delete an account that has been blocked for six months in the same way, unless the block is lifted during that period. If that account had billing details, we delete the workspace and keep the billing details, invoices, direct debit mandate and acceptance record as stated above. An account with billing details is not deleted for inactivity. The precise rule is in article 10 of the terms of service.

5. Security

Connections between the browser, the app, the kiosk and our servers are encrypted (TLS). Passwords are stored only as hashes; IBANs and kiosk PIN codes are encrypted. Access is role-based: an employee only sees their own hours and wages, and a manager or administrator only sees their own workspace. The data of different customers is kept separate in the database. We make a daily backup and keep it for 14 days. Only Chefstr staff who need it for their work have access to the production environment.

If a data breach affects your data, we will inform you without undue delay and, where the law requires it, report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

6. Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to object to it, and to data portability. Email privacy@chefstr.com; we respond within a month. If your request concerns data your employer entered in Chefstr, we will refer you to your employer and let them know that you contacted us. You can also lodge a complaint with the Dutch Data Protection Authority.

Right to object. We process some data on the basis of our legitimate interest: the security logs, the bot check, the record of your acceptance of the terms and the proof of a direct debit mandate. You can object to this at any time by emailing privacy@chefstr.com. After receiving your objection, we assess whether our legitimate interests, such as the security of the service, outweigh your interests, rights and freedoms. You will receive our response within a month of your objection.

7. Cookies

Chefstr uses only functional cookies: for your session and your preferences. No tracking cookies, and no third-party advertising cookies.

8. Changes

The date at the top of this page is the date from which this version applies. If we make a major change, we will notify the administrators by email.

9. Contact

• Company: ASD Solutions, trading as Chefstr
• Address: Wilhelminastraat 32, 1054 WJ Amsterdam, the Netherlands
• Chamber of Commerce (KvK): 82907730
• Email: privacy@chefstr.com