Privacy Policy

Fasten Teams Studio
Zürich, Schweiz
Email: hello@fastenteams.studio

The entity named above is the controller for the processing described in this policy unless stated otherwise.

We act as controller when you visit our marketing website, contact us, request a demo, or enter into a contract for the DineSpring platform.

When guests place orders through a restaurant’s DineSpring storefront, the respective restaurant is the controller of that order data. In this case we process the data solely as a processor acting on the restaurant’s instructions under a data processing agreement pursuant to Art. 28 GDPR. Guests should direct data protection requests regarding an order to the relevant restaurant.

When you access our website, our web server automatically collects technical access data, including your IP address, date and time of access, requested URL, referrer URL, browser type and version, operating system, amount of data transferred, and HTTP status code.

We use this data to provide the website securely and reliably, to defend against attacks, and to analyse errors. The legal basis is our legitimate interest in the security and functionality of our services (Art. 6(1)(f) GDPR; Art. 31 FADP). Log files are generally deleted after 30 days unless they are needed longer to investigate a security incident.

Fonts and images on the marketing website are served from our own server. No content from Google Fonts, Unsplash, or similar third parties is embedded directly.

We use technically necessary cookies and local storage to operate the website securely and to store your consent decision. Optional storage for preferences, analytics, or marketing is only set if you have given your consent through the cookie banner.

You can withdraw or change your consent at any time via “Cookie settings” in the footer. Further details on the storage we use are available in our Cookie Policy.

If you contact us by email, telephone, or a contact form, we process the information you provide (e.g. name, email address, company, telephone number, and your request) to respond to you.

The legal basis is the performance of pre-contractual measures or the contract (Art. 6(1)(b) GDPR) and our legitimate interest in handling support requests (Art. 6(1)(f) GDPR). We delete the data once the request has been resolved and no statutory retention obligations apply.

If you create a restaurant account or subscribe to a plan, we process master data (name, company, address, email, telephone), contract and invoice data, login data, usage data, and payment information. This is necessary to perform the contract (Art. 6(1)(b) GDPR) and to comply with our legal obligations (Art. 6(1)(c) GDPR).

We retain contract and accounting records for as long as required by the Swiss Code of Obligations and tax law (generally ten years, and eight years for VAT records).

Restaurants can use DineSpring to process orders, table orders via QR codes, and deliveries. This involves order data, contact and delivery details, the selected payment method, order history, and any notes regarding allergies or preferences.

The respective restaurant is the controller of this processing. We process the data as a processor solely on the restaurant’s documented instructions under the data processing agreement. We do not use order data for our own marketing purposes.

Payments may be processed through payment service providers connected by the restaurant or by us (e.g. TWINT, credit card or payment providers). These providers process payment and transaction data under their own responsibility. We generally only receive confirmations of payment status and amount and do not store full card details.

The legal basis for payment processing is the performance of the contract (Art. 6(1)(b) GDPR) and compliance with statutory accounting and retention obligations (Art. 6(1)(c) GDPR).

We disclose personal data only to service providers that process it on our behalf or where we are legally required to do so. These include hosting providers, payment service providers, email and communication services, IT support and maintenance providers, and tax and fiduciary advisors.

All processors are contractually obliged to comply with data protection and confidentiality requirements. We do not disclose data to third parties for their own advertising purposes.

Our service providers may process personal data in Switzerland, the European Economic Area, or other countries. Where data is transferred to countries without an adequate level of data protection, we rely on appropriate safeguards, in particular EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Switzerland recognises the EU level of data protection as adequate, and the EU recognises Switzerland as providing adequate protection.

We retain personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations. Server log files are generally deleted after 30 days. Consent records are kept for the duration of the consent and six months thereafter. Order data is deleted according to the instructions of the respective restaurant.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, and alteration. These include encrypted connections (TLS), access restrictions, logging, and regular updates. No transmission over the internet is absolutely secure, so complete protection cannot be guaranteed.

Depending on applicable law, you have the following rights in particular:

• access to the personal data concerning you;
• rectification of inaccurate or incomplete data;
• erasure of data, unless a retention obligation or another legal ground prevents erasure;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interests;
• withdrawal of consent with effect for the future.

To exercise your rights, simply send a message to hello@fastenteams.studio. We may request further information to verify your identity. Statutory exceptions, in particular retention obligations, remain reserved.

You may lodge a complaint with a data protection supervisory authority. In Switzerland this is Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB), Feldeggweg 1, 3003 Bern, Schweiz. In the EU or EEA, you may contact the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.

We do not use automated decision-making within the meaning of Art. 22 GDPR and do not carry out profiling with legal effect.

We are established in Switzerland. Where the GDPR applies to our processing activities and no exemption under Art. 27(2) GDPR applies, we will appoint a representative in the European Union. Until then, requests may be directed to the contact address above.

We may update this privacy policy if our processing activities or legal requirements change. The version published on this page applies. Where required, we will actively inform you of material changes.