Skip to main content

Privacy Policy

Effective May 21, 2026

1. Data Controller

The data controller is fauni.to s.r.o., Company No.: 23796383, with registered office at Nové sady 988/2, 602 00 Brno, Czech Republic. Contact: hello@catermink.com.

This Policy applies to all services operated by fauni.to s.r.o. under the catermink.com domain  - in particular the information portal, the system administration interface, and marketing research (crm.catermink.com).

2. Our Dual Role

In relation to personal data, we act in two distinct roles:

  • Controller - for personal data of system users (owners and employees of catering companies registered on catermink.com) and of marketing research respondents. We ourselves determine how and why this data is processed.
  • Processor - for personal data of the catering companies' customers, who submit enquiry forms or are otherwise entered into the system. In this case we process data on behalf of the catering company (Controller) and in accordance with its instructions. The terms of this processing form part of the Terms of Service (section: Data Processing Agreement).

3. User and Research Respondent Data - What We Process and Why

Providing the service

Legal basis: performance of a contract (Art. 6(1)(b) GDPR)

Company name, name, e-mail, telephone, hashed password and account settings. Without this data it is not possible to create an account or operate the system.

Communication, notifications and billing

Legal basis: performance of a contract, legitimate interest, and commercial communications under § 7(2) of Act No. 480/2004 Coll.

E-mail and name for sending transactional messages (welcome e-mail, password reset, system notifications, billing) and operational and commercial communications about the system (new features, maintenance, price changes, news). Operational and commercial communications can be unsubscribed from at any time via a one-click link in the footer of each message; transactional messages are necessary for account operation.

System security and stability

Legal basis: legitimate interest (Art. 6(1)(f) GDPR)

IP addresses (for abuse prevention), login timestamps and counts, technical error logs.

Marketing research respondents (crm.catermink.com)

Legal basis: legitimate interest for survey responses (Art. 6(1)(f)); consent for e-mail and follow-up communications (Art. 6(1)(a))

Survey responses (general questions about the respondent's business) and a voluntarily provided e-mail address for sending research results and further information about the catermink.com system. We obtain contact details for outreach from publicly available sources (Czech company register ARES, company websites); the entity contacted is always a legal person (a catering company).

4. Employees in the System

Users with the role of administrator or employee are added to the system by the catering company (Controller). We process their name, e-mail address and role. These users may contact us directly at hello@catermink.com at any time to exercise their rights under section 8 below.

5. Cookies and Technical Tools

The system does not use any marketing or tracking cookies. The only cookie stored is a login token (JWT), without which it would not be possible to log in to the system - this is an essential operational element for which consent is not required.

Vercel Web Analytics

Aggregated traffic statistics (page views, device type, referring page). It does not use cookies, does not identify specific individuals, and data does not leave Vercel's infrastructure. Legal basis: legitimate interest in improving the service.

Sentry

Automatic capture of errors and technical exceptions to ensure system stability. Collects technical context (stack trace, error type, browser version); may include the logged-in user's e-mail to facilitate issue tracing. Legal basis: legitimate interest in system security and stability.

Measuring the effectiveness of e-mail communications

For operational and commercial communications we track delivery, opens and clicks (via tracking pixel and redirected links) to evaluate communication effectiveness. We do not track transactional messages in this way. Legal basis: legitimate interest; unsubscribing from communications will automatically end tracking.

6. Sub-processors and Data Recipients

We do not sell or share personal data for advertising purposes. The system and database are hosted in the EU (Dublin, Ireland). We use the following sub-processors to operate the system:

  • Vercel Inc. - system hosting (data: Dublin, EU; provider headquartered in USA, transfers covered by Standard Contractual Clauses, SCC)
  • Turso - cloud database (data: Dublin, EU)
  • Resend Inc. - transactional e-mail delivery (USA; SCC)
  • Sentry Inc. - error monitoring (USA; SCC)
  • Stripe Inc. - payment processing (USA; SCC) - paying customers only

Transfers of personal data to the USA are carried out on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The current list of sub-processors is available on request at hello@catermink.com.

7. Retention Periods

  • System user data - for the duration of the contractual relationship; billing and accounting records further for the period required by law (generally 5 years under the Accounting Act, 10 years for VAT purposes)
  • Contact and login data after termination of the agreement - 3 years (limitation period for potential claims)
  • Catering companies' customer data - for the duration of the agreement with the given catering company; deleted within 30 days of termination (or returned - at the Controller's discretion)
  • Technical logs and IP addresses - maximum 12 months
  • E-mail logs - 12 months (metadata only: type, recipient, timestamp, delivery status)
  • Marketing research survey responses - with an identifier (e-mail) until unsubscription or maximum 3 years; after deletion the responses remain in aggregate form with no link to any individual
  • E-mail addresses collected in the course of research - until unsubscription; maximum 3 years without activity

8. Your Rights

In accordance with the GDPR you have the right:

  • of access to your personal data and a copy of the data being processed
  • of rectification of inaccurate or incomplete data
  • of erasure ("right to be forgotten") - where the purpose of processing has ceased or you withdraw your consent
  • of data portability in machine-readable format
  • to object to processing based on legitimate interest
  • to restriction of processing in cases provided for by law
  • to lodge a complaint with the Office for Personal Data Protection (uoou.gov.cz)

Please send requests to hello@catermink.com. We will respond within 30 days of receipt.

9. Security and Automated Decision-making

Data transmission is encrypted using HTTPS. Passwords are stored exclusively as a bcrypt hash  - never in readable form. Access to data is governed by a role-based system (owner, admin, staff) and protected by JWT authentication. Internal access to production data is restricted to the minimum number of persons necessary.

We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR that produces legal or similarly significant effects for data subjects.

10. Changes to this Policy

Users will be notified of any material changes to this Policy by e-mail with reasonable advance notice. The current version is always available on this page.