CRM Creative Restaurant Management AB's privacy policy
1. Background
CRM Creative Restaurant Management AB, hereinafter referred to as Kasai, processes personal data in its daily operations. This privacy policy applies generally to the processing of personal data within Kasai and exists to explain what kind of data Kasai processes, why, and how. Personal data is processed in Kasai's administration and booking systems. Personal data is also processed in Kasai's applications, social media platforms, and on the website kasai.se ("Digital channels"). The privacy policy applies to employees, suppliers, and guests.
2. Personal data and data processing
Personal data is any information that can directly, or indirectly together with other information, be linked to a living physical person. Names, phone numbers, pictures, and IP addresses can be personal data. Bookings, behaviors, and orders can also be personal data if they can be linked to a person together with other information. Actions taken with personal data constitute personal data processing, such as storage, collection, alteration, deletion, and dissemination.
2.1. Special categories of personal data
Kasai sometimes processes special categories of personal data. Among other things, information about health, union membership, and religious beliefs is considered to belong to special categories and is extra sensitive. Handling a booking where someone has an allergy requires processing health-related information. Such processing only takes place with consent. Union affiliation may also be processed in employment relationships if necessary under labor law.
3. Data controller
The data controller is the entity responsible for the processing of personal data and decides why and how personal data is processed. In this case, Kasai Aktiebolag is the data controller. In some cases, another party decides which personal data is processed and why. Kasai then acts as a data processor and processes personal data on their behalf. It is also possible that Kasai, together with a third party, is responsible for the processing.
4. Data processors
To deliver its services, Kasai uses data processors. This means that Kasai is the data controller and decides which personal data is processed and why, but we outsource parts of the processing. This involves, for example, IT solutions such as storage and booking systems. Kasai decides on the processing and is responsible for it, but enlists other suppliers to be able to deliver its services. Kasai always enters into data processor agreements with data processors to ensure a high level of protection for all data.
5. Kasai's processing of personal data
Kasai and our data processors always have a legal basis for processing personal data. Most often, this is necessary to fulfill agreements, but it can also happen with consent, if required to establish legal claims, or due to legal requirements. Kasai may also process personal data if there is a legitimate interest. This legitimate interest then outweighs the registered person's interest in Kasai not processing their personal data. For example, marketing to guests we have previously been in contact with is done after a balancing of interests. However, as a registered person, it is always easy to object to such personal data processing.
Below is an overview of Kasai's personal data processing. Kasai strives to process as little personal data as possible. Therefore, not all categories of personal data are processed on every occasion. For example, addresses and email addresses are not always processed during bookings, but it does happen.
5.1. Communication and administration
Kasai processes personal data for administration and communication with guests, employees, and suppliers. The purpose is to manage bookings, employment, and administer the business.
- Personal data
Name, email address, address, phone number, bookings, food preferences, allergies. - Legal basis
The processing is necessary to fulfill agreements and provide our services. - Origin of the data
The data comes from the registered person themselves, provided to us during bookings and when entering into agreements.
5.2. Employment relationships
To manage administration, salary payouts, and contact with employees, Kasai must process employee personal data.
- Personal data
1. Name, email address, address, phone number, any next of kin, account number, employment certificate, pay slips, absence.
2. Tax control details, income information.
- Legal basis
1. The processing is necessary to fulfill employment contracts and to administer and pay out salaries.
2. As an employer, Kasai has a legal obligation to provide the Swedish Tax Agency with employee tax control details. - Origin of the data
1. The data comes from the registered person themselves and is provided to us upon entering into an agreement or during the employment relationship. Pay slips are generated in Kasai's payroll system, and employment certificates are created by the HR department.
2. The data comes from the payroll system and is based on what is registered regarding the employee's salary and employment level.
5.3. Marketing
Kasai uses personal data to market its services in digital channels and through newsletters and offers.
- Personal data
Name, email addresses, and in some cases, photos. - Legal basis
The processing is based on consent or a balancing of interests. - Source of the data
Provided directly by the registered individuals when signing up for the newsletter. Photos are sometimes taken by Kasai's photographers.
5.4. Payments
Kasai processes personal data to handle payments.
- Personal data
Card number, invoice number, name, email address, phone number, amount, point of sale, time of transaction, order details. - Legal basis
To handle purchases of goods and services and fulfill agreements by receiving payment or securing payment, Kasai needs to process personal data related to payments. - Source of the data
The data comes directly from the registered individuals when making a payment or booking.
5.5. Guest surveys
To improve its services, Kasai sends out invitations to participate in guest surveys.
- Personal data
Name, email address, survey responses. - Legal basis
The processing is based on a balancing of interests. - Source of the data
The data used for sending out surveys comes from the registered individuals themselves who provided it to a company within the group. The survey responses come directly from the registered individual.
5.6. Handling claims
To handle potential legal claims such as complaints, returns, or legal proceedings, Kasai may need to process personal data.
- Personal data
Name, personal identity number, address, email address, phone number, account number, sequence of events, location information. - Legal basis
The processing is necessary to pursue Kasai's legitimate interest in establishing, exercising, or defending legal claims. - Source of the data
The data may come from the registered individuals themselves, but also from authorities or other parties such as insurance companies.
5.7. Cookies, etc.
To improve the user experience in digital channels, Kasai may collect technical data.
- Personal data
IP addresses, cookies, browser information, device IDs. - Legal basis
Depending on the type of technical data collected, processing is based on either a balance of interests or consent. - Data origin
Data subjects themselves when using the Digital Channels.
6. recipients with whom Kasai can share information.
6.1. Service Providers
To be able to provide its services, Kasai uses various suppliers for things like IT solutions such as networks, storage services, and email services. These suppliers are only allowed to process personal data according to Kasai's explicit instructions and cannot use the data for their own purposes. Everyone is also bound by law and agreement to protect personal data.
6.2. Payment Recipients and Payment Service Providers
When making payments, personal data may be shared with the payment service provider, the payment recipient, and both parties' banks.
6.3. Other Recipients
In certain cases, Kasai may also share information with other recipients, primarily authorities due to legal requirements or in connection with legal proceedings. Personal data may also be shared with potential buyers and sellers of all or parts of the business.
7. Technical and Organizational Measures
Kasai cares about the privacy of guests and employees and takes appropriate technical and organizational security measures to protect personal data from unauthorized access, alteration, dissemination, or destruction. This includes routines and access restrictions that prevent unauthorized access.
8. Where does Kasai process personal data?
Kasai's goal is for all personal data to be processed within the EU/EEA area. However, some suppliers may process personal data outside the EU/EEA area. In such cases, we always ensure that the data is protected and that safeguards are in place through agreements that require the same standards as the EU's data protection regulations.
9. How long is personal data saved?
Kasai processes personal data as long as there is a relationship with the registered person and for a period thereafter, as long as there is a legal basis. If there is no longer a reason to process personal data, it is deleted.
10. Rights
Kasai wants to remind you of the rights that the GDPR gives to individuals whose personal data is processed.
10.1. Access to Personal Data
As a registered person, you have the right to request confirmation of whether or not we are processing personal data about you. If we are, you have the right to see what data we process about you through a registry extract.
10.2. Rectification
If any information is incorrect or incomplete, you have the right to request that it be corrected.
10.3. Withdraw Consent
If we process your personal data with consent as the legal basis for the processing, you have the right to withdraw your consent at any time with future effect.
10.4. Object to Processing for Direct Marketing
Registered individuals have the right to object to the processing of personal data for direct marketing. This is most easily done by unsubscribing from mailings by clicking the unsubscribe link in the message or by contacting us.
10.5. Right to Lodge a Complaint with a Supervisory Authority
The registered person also has the right to contact the supervisory authority directly to complain. The supervisory authority will then investigate the matter.
10.6. Object to Processing Based on Kasai's Legitimate Interest
As a registered individual, you have the right to object to processing based on legitimate interests if there are circumstances relating to your specific situation that weigh against the processing. If you object and there are compelling legitimate grounds that override your interests, we may nonetheless continue the processing.
10.7. Erasure
Registered individuals have the right to request and, under certain circumstances, have their personal data erased. One exception is if we are legally obligated to retain the data.
10.8. Restriction of Processing
Registered individuals have the right to request that the processing of their personal data be restricted.
10.9. Data Portability
Registered individuals also have the right to receive copies of their personal data in a structured, commonly used, and machine-readable format. This right only applies to personal data provided by the registered individual themselves, where the legal basis is either consent or the performance of a contract.