Privacy Policy – Service-Ding App
Controller / operator: two-run it-solutions GmbH, Mergenthalerallee 73-75, 65760 Eschborn, Germany · Managing directors: Recep Ogras and Müyesser Sabuncuo · Register court: Amtsgericht Frankfurt am Main, HRB 134444 · VAT ID: DE369962041 · privacy@service-ding.de
Last updated: 10 September 2026
1. What is Service-Ding?
Service-Ding is an app for hospitality businesses (restaurants, cafés, hotels). Guests call for service, the bill or coal via a table button or QR code; staff receive these requests on tablets and phones. The app is provided to staff by their employer (the "company").
Roles: For staff data, the company is the controller; two-run it-solutions GmbH operates the platform as a processor (Art. 28 GDPR) under a data processing agreement concluded with each company.
2. Data we process
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Account | username, first/last name, e-mail, mobile number, role (Waiter, Branch Admin, Tenant Admin), branch assignment, language | sign-in, access rights, branch assignment | Art. 6(1)(b) GDPR / (f) |
| Sign-in | password (hashed only), SMS one-time codes, sign-in timestamps, failed attempts | secure two-factor sign-in, abuse detection | Art. 6(1)(c)/(f) GDPR |
| Device | app-generated device id, manufacturer and model, push token, last-activity time | delivering call notifications, letting administrators manage signed-in devices | Art. 6(1)(b) GDPR |
| Profile photo | optional uploaded image (resized to 256×256 px) | display in the app | Art. 6(1)(a) GDPR (voluntary, removable anytime) |
| Operational data | table/floor requests, accept and completion times, which staff member accepted a request | the company's operations | Art. 6(1)(b)/(f) GDPR |
| Logs | technical server logs (truncated IP address, timestamps, errors), security events such as failed sign-ins | operation, troubleshooting, security | Art. 6(1)(f) GDPR |
Restaurant guests are not identified: table requests contain no personal data of guests.
3. App permissions
- Camera: only to scan the branch QR code and optionally for the profile photo. No images are stored except the profile photo you choose.
- Notifications: delivery of calls; can be switched off in the app settings.
- Photos: only when you choose a profile photo. No location tracking, no advertising tracking, no sharing with ad networks.
4. Recipients and processors
- Hosting: Hetzner Online GmbH, Gunzenhausen, Germany (data centres in Germany).
- SMS (one-time codes): seven communications GmbH & Co. KG, Kiel, Germany – receives your mobile number and the code.
- Push notifications: Google Firebase Cloud Messaging (Google Ireland Ltd.) and Apple Push Notification Service (Apple Distribution International Ltd.) – receive a device token and the notification content (table number, request type). EU standard contractual clauses / EU-US Data Privacy Framework apply.
- E-mail: Mailjet SAS, 4 rue Jules Lefebvre, 75009 Paris, France (EU hosting) – system mails (verification codes, account information, security notices). Your employer (the company) can see the account and operational data of its staff listed in section 2, including signed-in devices.
5. Retention
- Account data: until the account is deleted (by you or your company), then removed from backups within 30 days.
- One-time codes: 2 minutes. Sessions: until sign-out, at most 30 days of inactivity.
- Operational data (requests): 90 days.
- Server logs: 30 days. Security-notice send records: 12 months.
6. Your rights
Access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority (for us: the Hessian Commissioner for Data Protection and Freedom of Information). Contact privacy@service-ding.de or your company.
Delete your account: in the app under Settings → Delete account (see also Delete your account). The last administrator of a company must appoint another administrator first.
7. Security
TLS transport encryption, SMS two-factor sign-in, hashed passwords, role-based access, per-company data separation, daily encrypted backups.
8. Changes
We update this policy when the app changes. The current version is available at https://service-ding.de/privacy.