Privacy Policy for Waiterwave

1. Introduction

The data controller, meaning the entity responsible for determining how your personal data will be used, is Michał Wojciechowski, conducting business under the name: Michał Wojciechowski Waiterwave, located at Poland at woj. MAZOWIECKIE, pow. Warszawa, gm. Warszawa, miejsc. Warszawa, ul. Kwitnąca, nr 11, lok. 29, 01-926, with tax ID 1182302031, (hereinafter referred to as "Waiterwave"). For any questions regarding this Privacy Policy, please contact us at: support@waiterwave.pl.

Welcome to Waiterwave, a platform designed to connect restaurants with waiters seeking job opportunities. Our service consists of two applications: a mobile app for Android and iOS used by waiters, and a web application used by restaurants. Although both applications operate on the same system, they collect different types of user data in different places to serve their respective purposes.

At Waiterwave, we are committed to protecting your privacy and ensuring that your personal data is handled securely and responsibly. This Privacy Policy explains what information we collect, why we collect it, how it is used, and the measures we take to safeguard your data. By using our services, you agree to the terms outlined in this Privacy Policy.

2. Information We Collect

We collect different types of information depending on whether you are a restaurant owner or a waiter. Below is a detailed breakdown of the data we collect:

For Restaurants:

• Business name
• Login email
• Contact email (optional)
• Contact phone number
• City, street name, premise number, and postal code
• Tax ID
• Website address (optional)
• Payment details (collected via Stripe's embedded form, including card number, expiry date, and CVV)
• Uploaded restaurant images (such as profile pictures and gallery photos, both optional)

For Waiters:

• Login email
• Contact email
• Name and surname
• Contact phone number (optional)
• Uploaded images
• Work history records (optional) including previous workplace names, employment dates, and descriptions

Additionally, standard technical data, such as IP addresses and device details, are received when users interact with our applications, though we do not explicitly process or store this information for analytical purposes.

3. Why We Collect This Information

The data we collect serves different purposes depending on the type of user:

For Restaurants: We require business-related details such as name, address, and tax ID to ensure that the platform remains a trusted environment for waiters. This information is displayed to waiters so they can verify they are communicating with a legitimate business before accepting work opportunities. The restaurant's uploaded images, such as profile pictures and gallery photos, provide visual confirmation of the workplace environment, further enhancing transparency.

For Waiters: We collect names, contact details, and optional work history records to allow restaurants to review past experience and communicate with potential hires. Uploaded images, such as profile pictures, help provide credibility and a more complete profile.

For Payments: Payment information is collected to manage the restaurant's subscription to our services. This data is processed securely through Stripe and is not stored by Waiterwave.

For Communication: Contact information is used to send important notifications, including account verification emails and service updates.

For Security & Compliance: To protect users and maintain the platform's integrity, we reserve the right to verify business legitimacy and, if necessary, disable accounts that appear fraudulent.

In addition to the above purposes, Waiterwave will process data for the following purposes:

• execution of the contract and enabling the use of the application
• fulfilling legal obligations by Waiterwave
• potential determination, pursuit of claims, and defense against claims

Waiterwave processes data because it is necessary to perform the above actions and purposes arising from the legitimate interests pursued by Waiterwave. The legitimate interests include:

• Prevent fraudulent accounts
• Ensuring a safe and reliable connection between restaurants and waiters.

Providing data is necessary to execute the contract and use the application. Without providing data, it is impossible to use Waiterwave.

4. How We Collect Information

We collect data in the following ways:

• Information provided directly by users during registration and profile setup, as well as during profile updates.
• Automatic data collection when interacting with our applications, including standard HTTP request logs
• Payment details entered directly into Stripe's secure embedded form.

5. Legal Basis for Data Processing (GDPR Article 6)

Under the General Data Protection Regulation (GDPR), we process personal data based on the following legal grounds:

• Contractual Necessity (Article 6(1)(b)) We process the following data because it is necessary to provide our services:
• For restaurants: Business name, login email, contact details, tax ID, and address information.
• For waiters: Login email, name, and contact details (if provided).
• Payment processing information (handled by Stripe).
• Legitimate Interest (Article 6(1)(f))Some data is processed to maintain the platform’s security and trustworthiness:
• Tax ID and address verification for restaurants to prevent fraudulent accounts.
• Ensuring a safe and reliable connection between restaurants and waiters.
• Consent (Article 6(1)(a)) Certain data is collected and processed only with user consent:
• Uploaded images (profile pictures, restaurant gallery photos, etc.).
• Work history records provided by waiters.
• Optional fields such as a restaurant’s website URL or additional contact email.
• Users can modify or delete this data at any time.

6. Automated Decision-Making & Profiling

Waiterwave does not use AI-driven automated decision-making, risk scoring, or behavioral profiling. However, the platform includes filtering functionality for both restaurants and waiters. Users can search for waiters based on availability, rating, and profile completeness, while waiters can find restaurants based on location and work opportunities. These filters operate based on user-provided data but do not make automated decisions on behalf of the users.

7. Cookies and Tracking Technologies

Waiterwave primarily uses cookies and tracking technologies for authentication and session management. Specifically:

• Firebase Authentication Cookies - These cookies are used to maintain user sessions, allowing users to stay logged in without needing to enter their credentials repeatedly.
• Firestore Database Session Tracking - We store session-related data in Firestore to help synchronize user authentication status across devices
• Stripe Cookies - Stripe may use cookies during the payment process to enhance security and prevent fraud.

The above cookies are required for the functioning of the website and are not used for marketing purposes or user profiling. We do not use tracking technologies for advertising or behavioral analytics. Users can manage cookie settings via their browser preferences, though disabling authentication-related cookies may prevent access to certain features.

8. Data Retention

User data is stored only as long as necessary to provide our services. If a user requests account deletion, the following actions take place:

For Waiters:Personal data is permanently deleted, and associated records in the system are anonymized.

For Restaurants:Most of the data provided during registration is public (such as address and tax ID). If a restaurant account is deleted, its data is removed from the system, but note that deleting an account results in immediate loss of access, even if a subscription is still active.

9. Data Breach Notification Policy

In the event of a data breach, Waiterwave will notify affected users via email as soon as the breach is confirmed. If legally required, significant breaches will be reported to the appropriate authorities in Poland. Breach detection is currently based on monitoring logs from our database.

10. Data Sharing and Third-Party Services

Waiterwave collaborates with third-party services to provide secure and efficient functionality. We share user data only when necessary:

• Stripe – Processes payments for restaurant subscriptions
• Firebase Authentication – Manages user identities, including login emails and passwords.
• Firebase Firestore – Stores chat messages between restaurants and waiters.
• MongoDB Atlas – Stores general platform data, including user profiles
• Mailchimp – Sends transactional emails, such as account activation and notifications.
• Google Places API – Provides location autocomplete functionality (no user data is shared)
• Vercel – Hosts the web application and processes user interactions.

Your personal data will not be shared with other entities, except for those authorized to receive the data based on legal regulations. The Restaurant's data will be shared with the Waiters, while the Waiters' data will be shared with the Restaurants.

11. Data Storage & Security

We implement industry-standard security measures to protect user data, including:

• Encryption for passwords - Passwords are securely stored using Firebase Authentication's built-in encryption.
• Secure payments - All payment transactions are handled by Stripe.
• Cloud eecurity - Data is stored in Firebase Firestore and MongoDB Atlas, which have robust security protocols in place.

12. User Rights and Account Deletion

We guarantee the fulfillment of all your rights under the General Data Protection Regulation, including the right of access, rectification, and deletion of your data, the restriction of their processing, the right to data portability, the right to object to the processing of your personal data and request account deletion at any time. To exercise these rights, please contact us by sending a request to the email address: support@waiterwave.com . If your data is processed based on consent, you may withdraw it at any time. However, withdrawing consent does not affect the lawfulness of processing that was carried out based on consent before it was withdrawn. The data subject has the right to request the administrator to immediately correct any inaccurate personal data concerning them. Taking into account the purposes of processing, the data subject has the right to request the completion of incomplete personal data, including by providing an additional statement. You have the right to lodge a complaint regarding the processing of your personal data with the supervisory authority, which is the President of the Personal Data Protection Office (address: President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw).

13. Policy Updates & Contact Information

For any questions, contact us at: support@waiterwave.com