Privacy Policy – Service-Ding App
Controller / operator: two-run it-solutions GmbH, Mergenthalerallee 73-75, 65760 Eschborn, Germany · Managing directors: Recep Ogras and Müyesser Sabuncuo · Register court: Amtsgericht Frankfurt am Main, HRB 134444 · VAT ID: DE369962041 · office@service-ding.de
Last updated: 23 October 2026
1. What is Service-Ding?
Service-Ding is an app for hospitality businesses (restaurants, cafés, hotels). Guests call for service, the bill or coal via a table button or QR code; staff receive these requests on tablets, phones and smartwatches. The app is provided to staff by their employer (the "company").
Roles: For staff data, the company is the controller; two-run it-solutions GmbH operates the platform as a processor (Art. 28 GDPR) under a data processing agreement concluded with each company.
2. Data we process
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Account | username, first/last name, e-mail, mobile number, role (Waiter, Branch Admin, Tenant Admin), branch assignment, language | sign-in, access rights, branch assignment | Art. 6(1)(b) GDPR / (f) |
| Sign-in | password (hashed only), SMS one-time codes, sign-in timestamps, failed attempts | secure two-factor sign-in, abuse detection | Art. 6(1)(c)/(f) GDPR |
| Device (phone/tablet) | app-generated device id, manufacturer and model, push token, last-activity time | delivering call notifications, letting administrators manage signed-in devices | Art. 6(1)(b) GDPR |
| Smartwatch | installation id (random per install), platform (watchOS/Wear OS), device model, branch, the person currently wearing it, session start, last activity, the person who wore it last, push token of the watch | binding a shared watch to the person wearing it, delivering calls to the watch, the administrators' watch overview | Art. 6(1)(b)/(f) GDPR |
| Personal call filter | excluded floors and table types, time of the last change | the same filter on all your devices (phone, watch, notifications) | Art. 6(1)(b) GDPR |
| Audit trail | pseudonymous id of the acting person, action (e.g. pairing, disconnecting or signing out a watch, accepting a call, role and settings changes), affected object, time – no names, e-mail addresses, phone numbers or IP addresses | accountability, security, investigating misuse | Art. 6(1)(f) GDPR |
| Profile photo | optional uploaded image (resized to 256×256 px) | display in the app | Art. 6(1)(a) GDPR (voluntary, removable anytime) |
| Operational data | table/floor requests, accept and completion times, which staff member accepted a request | the company's operations | Art. 6(1)(b)/(f) GDPR |
| Call outcomes | for each accepted or cancelled call: table, start of the call, outcome (accepted/cancelled), id and role of the person who accepted it | a request can be accepted only once; showing "accepted by" on devices and watches | Art. 6(1)(b)/(f) GDPR |
| Performance statistics | per staff member, branch and day: number of accepted calls and average response time, stored with the pseudonymous id (no name) | your own performance overview in the app; reporting for your company's administrators | Art. 6(1)(f) GDPR |
| Logs | technical server logs (truncated IP address, timestamps, errors), security events such as failed sign-ins | operation, troubleshooting, security | Art. 6(1)(f) GDPR |
Restaurant guests are not identified: table requests contain no personal data of guests.
Performance statistics – who sees them: only you see your own overview (accepted calls, trend). Your company's administrators (Tenant Admin, and Branch Admin for their branches) see the number of accepted calls and the average response time per staff member.
Smartwatch
Companies can provide smartwatches (Apple Watch, Wear OS) that several staff members use one after another.
- Pairing: you pair a watch with your account from your phone; from then on the watch is assigned to you. The assignment ends when you unpair the watch on your phone, sign out on the watch or put it on its charger, when another person pairs it, when an administrator disconnects it, when the watch's sign-in expires, or when your account is deleted. After that no one is assigned to the watch; only who wore it last is kept – until the next person uses it or an administrator removes the device.
- Watch sign-in: the watch has its own sign-in session with the sign-in service. It is stored there so the watch stays signed in until the end of the shift even if you sign out on your phone. The session ends 12 hours after the last use, at the latest 16 hours after pairing, and immediately when the watch is unpaired.
- Notifications on the watch: calls reach the watch as push notifications via Google or Apple (section 4). The watch's push token is deleted as soon as the assignment ends, when you switch notifications off on the watch, or when the push service reports the token as invalid.
- Visible to administrators: your company's administrators see, for their branch's watches, who is wearing a watch and who wore it last, the device model, last activity and app version. They can rename, disconnect or remove a watch.
- Notifications mirrored by the operating system: if a personal watch is connected to your phone (e.g. through the Apple Watch or Wear OS app), the operating system may mirror the phone's Service-Ding notifications to that watch. This mirroring is controlled by the operating system, not by Service-Ding; it shows the same content as on the phone (table, floor, request type). You can switch it off in the watch app on your phone.
3. App permissions
- Camera: only to scan the branch QR code and optionally for the profile photo. No images are stored except the profile photo you choose.
- Notifications: delivery of calls to phone, tablet and smartwatch; can be switched off in the app settings, on the watch in its settings.
- Photos: only when you choose a profile photo. No location tracking, no advertising tracking, no sharing with ad networks.
4. Recipients and processors
- Hosting: Hetzner Online GmbH, Gunzenhausen, Germany (data centres in Germany).
- SMS (one-time codes): seven communications GmbH & Co. KG, Kiel, Germany – receives your mobile number and the code.
- Push notifications: Google Firebase Cloud Messaging (Google Ireland Ltd.) and Apple Push Notification Service (Apple Distribution International Ltd.) – receive the push token of the phone, tablet or smartwatch and the notification content (table, floor, request type; on an Apple Watch, for an accepted call, also the name of the person who accepted it). EU standard contractual clauses / EU-US Data Privacy Framework apply.
- E-mail: Mailjet SAS, 4 rue Jules Lefebvre, 75009 Paris, France (EU hosting) – system mails (verification codes, account information, security notices). Your employer (the company) can see the account and operational data of its staff listed in section 2, including signed-in devices and paired smartwatches.
5. Retention
- Account data: until the account is deleted (by you or your company), then removed from backups within 30 days.
- One-time codes: SMS sign-in code 2 minutes; codes for changing your e-mail address or phone number and for confirming a registration 10 minutes. Change requests (new e-mail address or phone number, code stored only as a hash): deleted 7 days after the code expires.
- Sessions: until sign-out. Device registrations of phones and tablets (push token, device model): until the device signs out, at the latest after 60 days without activity; immediately when the push service reports the token as invalid.
- Registration requests (name, e-mail address, phone number): 30 days after receipt; approved requests 30 days after approval (the account then falls under "account data").
- Operational data (requests): 90 days.
- Guest feedback: free text 90 days; the rating is then kept without text for statistics.
- Server logs: 90 days. Security-notice send records: 30 days.
- Audit trail: 12 months (pseudonymous; kept for this period after an account is deleted).
- Smartwatch: assignment and push token of the watch until the assignment ends (see "Smartwatch"); the watch's sign-in session 12 hours after the last use, at most 16 hours; records of ended watch sessions 30 days.
- Personal call filter: as long as the account exists.
- Call outcomes (accepted/cancelled calls): 30 days.
- Daily performance statistics per staff member: 13 months; immediately when the account is deleted.
6. Your rights
Access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority (for us: the Hessian Commissioner for Data Protection and Freedom of Information). Contact office@service-ding.de or your company.
Delete your account: in the app under Settings → Delete account (see also Delete your account). The last administrator of a company must appoint another administrator first. Deleting the account immediately removes your smartwatch assignment with its push token, the push tokens of your devices, your call filter and your daily performance statistics. Call outcomes are deleted after 30 days at the latest; the audit trail holds only a pseudonymous id and is deleted after 12 months.
7. Security
TLS transport encryption, SMS two-factor sign-in, hashed passwords, role-based access, per-company data separation, daily encrypted backups.
8. Changes
We update this policy when the app changes. The current version is available at https://service-ding.de/privacy.