Simpli Dashboard — privacy policy

Simpli Innovations j.d.o.o., Croatian tax ID (OIB) 66769162719, Vinogradi 76, 10000 Zagreb, Croatia, is responsible for account data processing needed for access to the Simpli service, support and service security. Contact: info@simpli.bar.

The venue determines which staff can access its orders and which business permissions they have. The venue is responsible for guest data in orders, preparation, invoicing and payment. Simpli provides technical processing within the service and its agreement with the venue. A venue's use of employee data for its own purposes is covered by its privacy notices.

Include Simpli Dashboard and the venue name in your enquiry. If your request concerns data managed by the venue, we will help direct it to the responsible party.

Data comes from you when signing in or contacting support, the person managing venue access, the ordering system, and the app's technical operation.

• Account and access: username or email, information needed to verify sign-in, account identifier, session, assigned venues and permissions. The session key on the device is kept in protected system storage.
• Business actions: selected venue, order identifiers and statuses, preparation estimates, product availability and ordering status. These actions are associated with an account and its permissions in the system.
• Order data shown to authorised staff: items, amounts, times, notes and, when included in the order, the guest's name and contact details and delivery address. This comes from the order, rather than access to your phone's contacts.
• Notifications: installation push identifier, device platform, and association with the account and selected venue.
• Technical data: app and system version, device model, errors, navigation events and performance measurements. During network communication, servers and technical providers also process an IP address. Diagnostics may be associated with numeric account and venue identifiers.

We use data for sign-in, permission checks, displaying and handling orders, menu and ordering changes, and support. The basis is performance of a contract where you are a party, or Simpli's and the venue's legitimate interest in authorised business access and order handling where you use access as staff.

Account security, abuse prevention, fault detection and service reliability rely on legitimate interests, taking your rights into account. Legal obligations cover records and responses that applicable law requires us to retain or provide.

You enable push notifications through your action and system permission. Notification permission is not consent to marketing or a substitute for the legal basis of other processing. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

After you enable notifications, a push identifier is associated with your account and selected venue for operational new-order alerts. Delivery uses Expo Push Service and Apple APNs or Google Firebase Cloud Messaging. The notification contains an order reference and type; the app does not need a guest's name, phone or address to display it.

Change permission in iOS or Android settings. On sign-out the app attempts to remove the server registration. Without a network connection, server removal cannot be confirmed immediately. Disable notifications in device settings if you need to stop their display immediately. Uninstalling the app is not an account deletion request.

We use Sentry for fault detection and sampled app performance measurements. Reports may contain technical data, screen paths, request status and numeric account and venue identifiers. This data can be linked to an account; it is not anonymous merely because it does not contain a name.

Screenshot capture, view hierarchy capture and Session Replay are disabled in the client. Filtering is enabled for data such as passwords, session keys, names, phones, addresses and notes. Guest data is needed for order handling, rather than diagnostics.

Dashboard has no features for tracking staff location, reading phone contacts, or recording through a camera or microphone. It contains no advertising SDK and does not use data to track people across other companies' apps for targeted advertising.

Authorised Simpli and venue personnel access data as needed for their tasks. Technical services include system hosting and storage, Sentry for diagnostics, and Expo, Apple and Google for notifications. We do not sell data. We provide data to competent authorities when legally required.

Providers may process data outside the European Economic Area, including in the US. Transfers subject to the GDPR must have appropriate safeguards, such as an applicable adequacy decision or standard contractual clauses with necessary supplementary measures. An EU server address alone does not mean all related services are in the EU. Request information about recipients and applied safeguards at info@simpli.bar.

Duration is determined by a record's purpose. Account and permission data is needed during active access, and a session while it remains valid. When access ends or deletion is requested, we check which data can be removed and which is still needed for another active role, security, a legal obligation or an open legal claim.

Push registration serves an installation registered for notifications; the app requests its removal on sign-out. Criteria for security and diagnostic records include time needed to investigate and resolve a fault or incident, evidence of actions taken, and the retention setting applied in each technical service. Signing out does not erase earlier diagnostic reports.

Orders and business records have a separate purpose and are not automatically deleted when an employee signs out. Retention depends on the venue's obligations, open orders, accounting and legal claims. Backups have separate cycles. For your request, you can obtain an explanation of categories retained, reasons, and the applicable period or criteria.

You can request access, correction, deletion and restriction of processing. Where legal conditions are met, you have rights to portability, to object to processing based on legitimate interests, and to withdraw consent for processing based on it.

Dashboard does not offer self-service account creation or an account deletion button. Contact the venue's responsible person to revoke venue access. For account or personal data deletion, contact info@simpli.bar directly, even without app access. Include your username or email, Simpli Dashboard and the venue; do not send your password. If the same account serves other roles, say whether the request includes them. Revoking one permission is different from deleting the entire account.

We request only identity verification needed to protect data. We respond without undue delay, normally within one month; we will explain any legally permitted extension. You can complain to Croatia's data protection authority, AZOP, or another competent supervisory authority.

• Request account deletion
• Croatian Personal Data Protection Agency

App data is transferred over HTTPS, and access is checked against accounts and permissions. Keep credentials secure, lock your device and sign out on shared devices. Report suspected unauthorised access to the venue and support.

Dashboard is a business tool for authorised users and is not intended for children. We do not carry out automated employment decisions or track staff location through the app.

We publish the updated version here with its revision date. We will give appropriate notice of material changes. Where a new purpose requires consent, we will request it separately.

For privacy, access and removal requests: info@simpli.bar, or by post to Simpli Innovations j.d.o.o., Vinogradi 76, 10000 Zagreb, Croatia.