Privacy Notice

In this document we explain in simple terms how we handle personal data when you use the Catermink website and system, register, receive support, are invoiced and communicate with us.

We use data only to operate and secure Catermink, to fulfil contractual and legal obligations, to support users and for reasonable communication about the service. We do not sell personal data. If a catering company enters data about its clients, staff or suppliers into the system, it is that catering company that decides how the data are used; Catermink merely provides it with the technical infrastructure.

So that you always have an overview of which personal data we process and how, and so that we are transparent towards you in this respect, we set out a few paragraphs on this topic below:

1. The controller of personal data (i.e. the entity that processes personal data and determines the purpose of their processing) is in this case our company fauni.to s.r.o., Company ID (IČ) 23796383, with its registered office at Nové sady 988/2, 602 00 Brno, Czech Republic, which also operates the Catermink platform.

   Contact for questions and exercising your rights: hello@catermink.com

   Data protection officer: We have not appointed a data protection officer because, according to our current assessment, we are not obliged to do so.

2. Personal data are processed in accordance with the General Data Protection Regulation (known as the GDPR) and with Czech Act No. 110/2019 Coll., on the Processing of Personal Data, as amended (which implements certain parts of the GDPR in the Czech Republic).

   Depending on the situation, Catermink has two different roles:

   • we are a controller (see above) when we ourselves determine why and how data are used - typically for registration and management of user accounts, the subscription, invoicing, support, security of the service, visits to our website and our own marketing or user research;
   • we are a processor when a catering company uses Catermink to work with data of its clients, prospects, staff or suppliers. The controller of these data is the respective catering company, and Catermink processes the data according to its instructions and the agreement on the processing of personal data.

   If you have filled in an inquiry form of a specific catering company or that company has entered you into the system, please address your request primarily to that company. If you write to us, we will help forward the request or handle it in cooperation with the relevant catering company.

3. The personal data we process in this way include only selected data (insofar as they constitute personal data in the given situation). The scope of the data differs depending on how you use Catermink. We do not process all of the data listed below about every user.

   Situation	What data	Why	Legal basis
   Registration and user account	Name, work e-mail and phone, company and Company ID, login credentials in secured form, roles and permissions, account settings, login and activity history.	Creating and operating the account and providing the service.	Performance of a contract; for the customer’s staff also our legitimate interest in providing the ordered service and securing access.
   Subscription, payments and accounting	Identification and billing details, selected plan, payment status and history, possibly the last digits of the payment card and the payment identifier from the payment service. We do not store full card details.	Managing the subscription, payments, invoicing, accounting and taxes.	Performance of a contract and of legal obligations, in particular accounting and tax obligations.
   Support and ordinary communication	Contact details, content of messages, attached files and data needed to resolve the request.	Handling inquiries, support, information about operation, maintenance, security and changes to the service.	Performance of a contract and legitimate interest in supporting users and the proper operation of the service.
   Security and technical operation	IP address, date and time of access, device and browser type, technical and security logs, error reports and user identifier; when resolving an error, the e-mail may also be captured.	Securing accounts, preventing misuse, diagnosing errors and stability of the service.	Legitimate interest in secure and reliable operation.
   Commercial communications	Name, e-mail, company, information about the customer relationship and basic data on delivery, opening or clicking.	Information about new features, offers and the development of Catermink and measuring the effectiveness of communication.	Consent, or legitimate interest and Section 7(3) of Czech Act No. 480/2004 Coll. for our own similar services for existing customers. Every commercial communication allows an easy unsubscribe.
   Research and feedback	Answers in questionnaires and interviews, information about the business, a voluntarily provided e-mail and a record of the communication.	Developing and improving the product, sending research results and any follow-up communication.	Legitimate interest in developing the service; consent for follow-up e-mail communication, where required.
   Protection of legal claims	Data relating to the contractual relationship, communication, use of the service, payments and any dispute.	Asserting, proving or defending legal claims.	Legitimate interest in protecting our rights and the rights of third parties.

   When using Catermink, a catering company may store in particular:

   • contact and identification data of its clients and prospects (e.g. name, e-mail, phone, company and billing details);
   • data about the inquiry and the event (date, venue, number of guests, menu, budget, quotes, contractual and invoicing documents, communication and notes);
   • data about its staff and collaborators (name, contact, role, shifts, availability, assigned tasks and history of changes);
   • data about suppliers and other persons involved in the order.

   The purpose, scope and duration of the processing of these data are decided by the respective catering company. It is also responsible for having a legal basis for the processing and for providing the data subjects with the necessary information. We use the data only to operate the service, for security, backups, support and other operations agreed with the catering company.

   Sensitive data: Do not enter data on health, allergies, religion or other sensitive data into free-text fields and notes, unless this is genuinely necessary for the order and you have an appropriate legal basis for it. The catering company must restrict access to such data only to persons who need it.

4. We obtain data in one of the following ways:

   • directly from you during registration, use of the system, payment, communication or when filling in a questionnaire;
   • from a Catermink customer who creates an account for you, assigns you a role or enters your data into the system;
   • automatically when you use the website and the service, in particular through technical logs;
   • from providers of payment, e-mail, hosting and support services;
   • to a limited extent from public sources, in particular ARES, the Commercial Register and company websites, when we approach catering companies or carry out market research.

   If we did not obtain your data directly from you, they are typically your name, work contact details, job position, company and data relating to the use of Catermink. We will provide you with the information no later than at the first contact, or within another period set by Article 14 of the GDPR.

5. We process personal data only for as long as strictly necessary for the purposes mentioned, to the extent set by the applicable laws or in accordance with an internal system of retention periods. Personal data obtained on the basis of consent are processed only for as long as the consent is given.

6. We do not carry out automated decision-making or profiling that would have legal or similarly significant effects on you. Information on any transfer of data outside the European Economic Area is provided below. Should we introduce into our activities any features using your personal data for profiling, we will inform you of such a step in advance and will also take the necessary measures to minimise the handling of personal data and to ensure compliance with the applicable laws.

7. We do not sell personal data or provide them to third parties for their own advertising. To the extent necessary, they may be received by:

   • persons entrusted with the operation and support of Catermink who are bound by confidentiality;
   • Vercel (hosting and web analytics), Turso (database), Resend (e-mail delivery), Sentry (error monitoring) and Stripe (payments for paying customers);
   • external accounting, tax, legal and IT advisers, if their involvement is necessary;
   • public authorities, if the transfer is required by law or necessary to protect rights.

   We will provide the current list of involved providers on request at hello@catermink.com.

8. Under the current setup, the system data and database are stored in the European Union (Dublin, Ireland). However, some of our suppliers or their support teams are located outside the European Economic Area, in particular in the USA. Where a transfer outside the EEA may occur, we use an appropriate legal safeguard - in particular a European Commission adequacy decision for certified recipients or standard contractual clauses under Article 46 of the GDPR, or supplementary security measures. We will provide information on the specific safeguard and the possibility to obtain a copy of it on request.

9. As regards cookies and analytics tools, we use a strictly necessary technical token (JWT) for login. Without it, the account and secure login would not work; no consent is required for such a technical means. Vercel Web Analytics provides us with aggregated traffic statistics, such as the number of views, device type and referring page. Under the current setup, it does not use cookies and does not serve to identify a specific person. Sentry automatically captures technical errors and related context; when resolving an error, it may include the identifier or e-mail of the logged-in user.

10. For selected operational and commercial e-mails, we may measure delivery, opening and clicks using a tracking pixel and redirected links. We use the measurement to evaluate the functionality and effectiveness of communication. You may object to processing based on legitimate interest; unsubscribing from commercial communications also ends their measurement.

11. We protect data transmission with HTTPS encryption. We store passwords only as a cryptographic hash, never as readable text. Access to data is controlled by roles and permissions, and we limit internal access to production data to the necessary number of persons. We take reasonable technical and organisational measures appropriate to the nature of the data and the risks of the processing.

12. Since the protection of your personal data is one of our priorities, we are fully at your disposal when you exercise any rights arising to you from the handling of personal data. Likewise, you may contact us with a request for information on the scope of, or an explanation of, the processing of personal data. For these purposes, please contact us at our e-mail address hello@catermink.com. The rights you can exercise in this way include:

• the right to request information on the scope of the personal data processed;
• the right to request an explanation of the processing of personal data;
• the right to request access to personal data and to have them updated or corrected;
• the right to receive the personal data provided in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller;
• the right to request erasure of personal data (popularly known as the right to be forgotten) or restriction of the processing of personal data, but only within the limits where your request is not outweighed by the performance of obligations on our side or our legitimate interest;
• the right to withdraw consent given; and
• the right to contact us or the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) with an objection to the processing of personal data or a complaint, in case of doubts about compliance with the obligations related to such processing.

13. We may update this information, in particular if the service, the involved suppliers or legal requirements change. The current version will always be available on the catermink.com website. We will inform registered users of material changes reasonably in advance, for example by e-mail or by a notice in the system.