Privacy policy

This privacy policy explains which personal data we process when you visit this website or use BiteTwo, for what purposes, and what rights you have.

1. Controller

MSL-Digital KG
Eisensteiner Str. 20
94227 Zwiesel, Germany
Phone: +49 9922 727 9975
Email: hello@bitetwo.de

Represented by the general partner Lóránt Meszlényi.

2. Who is responsible for what?

We, MSL-Digital KG, are responsible for this website and for the accounts of restaurant owners and staff.

When you order as a guest in a restaurant through BiteTwo, the restaurant is the controller of your data. We process this data only on behalf of and as instructed by the restaurant (processing on behalf according to Art. 28 GDPR). Please direct questions about it to the restaurant first; we forward requests that reach us to the restaurant.

3. Hosting and server log files

BiteTwo runs on servers of a hosting provider in Germany. We have a data processing agreement with this provider.

With every request, the server automatically stores information in log files: IP address, date and time, the requested address, HTTP status code, amount of data transferred and the user agent sent by the browser. We need this data to deliver the website, find errors and fend off attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR). The log files are deleted automatically after 5 days.

4. Accounts for restaurant owners and staff

When you register a restaurant or are invited as staff, we process your email address, your name and, if you upload one, a profile picture. For the restaurant we store the details you enter, such as its name, description, logo, phone number, menu and tables. Business details entered by owners (company name, address, VAT ID) are visible to owners only.

We process this data to provide BiteTwo to you (Art. 6 (1) (b) GDPR). It is stored as long as the account exists and deleted afterwards, unless statutory retention obligations apply.

5. Sign-in emails

We send emails to your address for one-time sign-in codes, invitations, confirming your email address and resetting your password. They are sent through our hosting provider in Germany. The legal basis is Art. 6 (1) (b) GDPR. We do not send advertising emails.

6. Ordering as a guest

Guests need no account. The staff opens a session for you; you sign in with a QR code or an 8-character code. On behalf of the restaurant we process:

• the code and the group (e.g. a table or an event) you belong to,
• a name, if you choose to give one,
• your orders with price and time, as well as waiter calls and payment requests.

A session expires after 12 hours at the latest (the restaurant sets the length, 4 hours by default). Completed orders are archived at night and stay stored for the restaurant's order history. How long the restaurant keeps this data depends on its own rules and on statutory retention obligations. You do not have to give an email address, phone number or any other contact details to order.

7. Contact by email

When you email us, we process your details to answer your request (Art. 6 (1) (b) GDPR for requests about a contract, otherwise Art. 6 (1) (f) GDPR). We delete the request once it is settled, unless statutory retention obligations apply.

8. Storage in the browser, no cookies

BiteTwo sets no cookies. To keep you signed in, the app stores your sign-in token in your browser's local storage. It also remembers settings there, such as the chosen language or view options. This storage is strictly necessary for the service you requested (§ 25 (2) no. 2 TDDDG). The token is deleted when you sign out; you can delete the other entries in your browser at any time.

9. Usage statistics without cookies

To see which pages are used and to improve BiteTwo, we count page views with an analytics tool that runs on our own server. It sets no cookies and stores nothing in your browser. For each page view it records the page address, the referring page, the browser, operating system and device type, the screen size, the language and the location (country, region and city), which is derived from the IP address. The IP address itself is not stored. To count visits, a fingerprint is formed from it that changes regularly, so you cannot be recognised over a longer period or across websites. The data is not shared with third parties and not used for advertising.

The legal basis is our legitimate interest in understanding how BiteTwo is used and making it better (Art. 6 (1) (f) GDPR). You can object at any time (see section 14).

10. Browser notifications

Staff can turn on notifications about new orders and waiter calls. The browser asks for your permission first. The notifications are created directly in the open browser; no external push service is used. You can withdraw the permission in your browser settings at any time.

11. Share buttons in the blog

The buttons for sharing blog posts are plain links. Only when you click one does the page of the network (X, LinkedIn or Facebook) open, which then processes data of its own. No data is sent to these networks before that.

12. Recipients and transfers to third countries

The only recipients of your data are our hosting provider and, for guest data, the restaurant. No data is transferred to countries outside the EU or the EEA.

13. Encryption

This website and the app are served over an encrypted connection (TLS) only. You can tell by the “https://” in your browser's address bar.

14. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on our legitimate interest (Art. 21 GDPR), on grounds relating to your particular situation

Just write to hello@bitetwo.de. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

15. Changes

We update this privacy policy when BiteTwo or the law changes. The version published here applies.