Caterflow privacy policy

Caterflow ApS is the controller of the information we collect ourselves, for example when you visit caterflow.dk, contact us, book a demo, or are a contact person at a customer or partner.

Caterflow is a platform that caterers, lunch providers, canteens and large kitchens use for ordering, production, delivery and invoicing. That gives us two different roles:

• Controller: For the website, enquiries, demo bookings and our own customer and partner relationships, we decide why and how the information is processed.
• Processor: For the information our customers put into Caterflow, for example about their employees, customers, orders and deliveries, the customer is the controller. We only process it on the customer's documented instructions in the data processing agreement we have with them.

If you ordered food through a business that uses Caterflow and have questions about your information, please contact that business. If we receive a request about information we process for a customer, we pass it on to the customer without undue delay.

The website only stores what is necessary in your browser, unless you consent to more:

• Necessary: your cookie choice (caterflow_cookie_consent), so the banner is not shown again. Stored in your browser's local storage until you delete it.
• Preferences: whether you chose the dark or light theme (theme). Stored in your browser's local storage until you delete it.
• Statistics and marketing: If you accept, Google Tag Manager may load Google's analytics and advertising services, which set cookies to measure traffic and ad performance. Without your consent we do not set these cookies. The legal basis is your consent (GDPR Art. 6(1)(a)).

You can change or withdraw your consent at any time with the button below or by deleting cookies and site data in your browser.

Which information is processed in Caterflow depends on the features the customer uses. It may include:

• name, address, delivery address, phone number and email
• workplace, user ID and login details
• order history, delivery and invoicing details
• comments, notes and other communication
• IP addresses, technical logs and other security and operations data

We use the following suppliers to run Caterflow. They are bound by data processing agreements that give the same protection as our own.

Error tracking, logs and monitoring run on our own servers, so they involve no external supplier. Enquiries from the website are stored with Supabase, and confirmation emails are sent through Amazon SES in the EU. ⚠ TO BE COMPLETED: region and transfer basis for the Supabase project. We give our customers at least 30 days' notice before a new sub-processor gets access to their information.

We only transfer personal data outside the EU/EEA when there is a valid basis under Chapter V of the GDPR:

• Clerk (login): Clerk, Inc. in the USA is certified under the EU-U.S. Data Privacy Framework. The European Commission's Standard Contractual Clauses (SCCs) apply as a fallback.
• OpenAI (AI features, only when turned on): Data is processed by OpenAI Ireland Ltd. Any onward transfer outside the EEA is based on Standard Contractual Clauses or an adequacy decision.
• AWS: Data is stored in the EU. Any access from outside the EEA is covered by Standard Contractual Clauses in AWS's data processing agreement.
• Google (only on the website and only with your consent): Google is certified under the EU-U.S. Data Privacy Framework.

• The AI features are optional. They are off until the customer turns them on, and until then nothing is sent to AI providers.
• Only the information needed for the specific feature is sent. For dashboards, only the user's question and the database structure are sent, not the contents or the results.
• CPR numbers, allergy and health information are never sent to AI providers.
• Customer data is not used to train or improve AI models, neither by us nor by the AI providers.

• Every customer has its own database, and production databases are encrypted.
• All traffic to Caterflow and caterflow.dk is encrypted with HTTPS/TLS.
• Only key developers with a work-related need can access production data, and two-factor login is required for critical systems.
• Passwords are handled by Clerk. We do not store users' passwords, neither in plain text nor hashed.
• Backups are encrypted and stored in Frankfurt. Restoring from them is tested regularly.
• Everyone with access to personal data is bound by confidentiality.

• Production data in Caterflow: for as long as the customer uses Caterflow, and deleted no later than 30 days after the agreement ends, unless the customer asks to have it returned.
• Login and user details at Clerk: deleted no later than 90 days after the agreement ends.
• Backups: up to 30 days.
• System logs: normally 60 days.

If there is a personal data breach, we contain it, investigate it and document it. If it concerns information we process for a customer, we notify the customer without undue delay and normally within 48 hours, so the customer can meet its obligations. If it concerns information we are responsible for ourselves, we report it to the Danish Data Protection Agency and inform you when the law requires it.

Under the GDPR you have the right to:

• Access: find out which information we hold about you and get a copy.
• Rectification: have incorrect information corrected.
• Erasure: have your information deleted when it is no longer needed.
• Restriction: have us only store the information while an objection or doubt is resolved.
• Data portability: get your information in a common, machine-readable format.
• Objection: object to processing based on our legitimate interest.
• Withdrawing consent: where processing is based on consent, you can withdraw it at any time.

Write to support@caterflow.dk. If it concerns information one of our customers has put into Caterflow, please contact the customer. We help them answer the request.

If you are unhappy with how we process your information, please write to us first. You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk.