Privacy Policy

1. Background

We process personal data in our daily operations. This Privacy Policy generally applies to the processing of personal data and is intended to explain what type of data we handle. Personal data is processed in our various systems, applications, social media channels, and websites:

• www.massrestauranger.se

• www.stadshusrestauranger.se

• www.stadshuskallarensthlm.se

• www.teaterbarenstockholm.se

• www.engsholm.se

Our Privacy Policy applies to our employees, suppliers, and guests.

2. What is Personal Data?

Personal data is “any information that can directly or indirectly be linked to a living individual,” such as names, phone numbers, images, and IP addresses. Actions that can be combined to identify a person are also considered personal data.

We sometimes process special categories of personal data. For example, handling a booking where someone has an allergy requires processing health-related data, which occurs only with consent. Membership in trade unions may also be processed in employment contexts if necessary under labour law.

3. Data Controllers

A data controller is responsible for personal data processing and determines why and how personal data is processed. In our case, each legal entity/company acts as the data controller. In certain situations, another party may determine which personal data is processed and why. The corporate group or legal entity then acts as a data processor, processing data on their behalf. It is also possible for the corporate group to share responsibility with a third party.

Data controllers within our corporate group are:

• Mässrestauranger AB (556367-0347)

• Mässrestauranger i Malmö AB (556844-5968)

• Stadshusrestauranger Stockholm AB (556782-8222)

• Fair Clean AB (556605-3756)

• Glada Ankan Restaurang & Catering AB (556489-9580)

• Engsholm Slott AB (556593-3735)

Hereafter referred to as “the Corporate Group.”

3.1 Data Processors

To deliver our services, we use data processors. This means that while the company/legal entity is the data controller and determines what personal data is processed and why, we collaborate with partners for certain parts of processing, such as IT solutions for data handling, storage, and bookings.

The Corporate Group always signs data processing agreements with processors to ensure a high level of data protection. In some cases, personal data may be shared within the Corporate Group, subcontractors, and partners to provide services. To comply with legal obligations, personal data may also be shared with auditors and authorities.

4. Personal Data Processing within the Corporate Group

The Corporate Group always has a legal basis for processing personal data necessary to fulfil contracts, but processing can also occur with consent. Personal data may also be processed based on legitimate interests, such as marketing to existing customers/guests.

We aim to process as little personal data as possible. Below is an overview of the main areas where personal data is processed.

4.1 Administration and Communication

The Corporate Group processes personal data for administration and communication with employees, guests, and suppliers. The purpose is to manage employment, bookings, and general administration.

• Personal data: Name, email, address, phone number, bookings, dietary preferences, allergies.

• Legal basis: Processing is necessary to fulfil contracts and provide our services.

• Source: Data is provided directly by the individual during booking or contract formation.

4.2 Marketing

The Corporate Group uses personal data to market its services via digital channels and mailings with offers and information. Customer surveys may also be used to improve services.

• Personal data: Name, email addresses, sometimes images, survey responses.

• Legal basis: Processing occurs with consent or legitimate interest.

• Source: Provided by individuals through newsletters or directly submitted.

4.3 Employment

To manage payroll and employee communication, the Corporate Group processes employee personal data.

• Personal data: Name, personal ID, email, address, phone number, next of kin, account details, payslips, absences, tax information, income details, employment certificates.

• Legal basis: Processing is necessary to fulfil employment contracts and legal obligations.

• Source: Provided by employees at contract initiation or during employment. Payroll data is generated in the Corporate Group’s system and HR issues employment certificates.

4.4 Payments and Claims

Personal data is required to manage payments and any claims.

• Personal data: Name, personal ID, email, phone, card number, invoice number, amount, point of sale, transaction time, order details.

• Legal basis: Necessary to execute contracts and fulfil the Corporate Group’s legitimate interests.

• Source: Provided by individuals during payment/booking and by other parties.

4.5 Cookies

The Corporate Group processes the personal data you have provided to us in order to fulfill our commitments to you.

• Legal basis: Depending on the type of technical data collected, processing takes place either based on legitimate interest or consent.

• Source of data: From the data subjects themselves when using digital channels.

This website does not use cookies and does not store personal information in your browser. We use Plausible Analytics to understand how the website is used. Plausible is a privacy-friendly analytics solution that does not use cookies and does not collect personally identifiable information. The statistical data collected is fully anonymized and is used solely to improve the website’s content and functionality.

The website is built with Kirby CMS, which does not place any cookies in the user’s browser.

5. Sharing Information

5.1 The Corporate Group

Mässrestauranger AB, as part of the corporate group, handles administration and overarching tasks for other companies, so data from all group companies may be shared with Mässrestauranger AB. Group companies may collaborate for marketing purposes.

5.2 Service Providers

To provide services, the Corporate Group uses providers for IT solutions, storage, and email services. Providers may only process data according to the Corporate Group’s instructions and are bound by law and contract to protect the data.

5.3 Payment Providers

During payments, personal data may be shared with the payment provider, recipient, and banks.

5.4 Other Recipients

Data may also be shared with other recipients, mainly authorities, due to legal obligations or legal proceedings.

6. Where Personal Data is Processed

We aim to process all personal data within the EU/EEA. Some providers may process data outside this area. In such cases, we ensure adequate protection through agreements aligned with EU regulations.

7. Your Rights

7.1 Storage

Personal data is stored as long as necessary for the purposes collected or as required by law (e.g., 7 years for accounting). We regularly review data management practices.

7.2 Access and Correction

You have the right to request access to your personal data. We allow one request per individual per year, which must be submitted in writing with signature. We may request additional information to verify identity. You also have the right to request corrections.

7.3 Deletion and Portability

We will delete data as required by law and do our best to accommodate deletion requests. You may also object to processing or request data transfer to another controller. Personal data may not be used for direct marketing or profiling if you object. Consent can be withdrawn at any time, e.g., for newsletters.

7.4 Complaints and Supervisory Authority

If you believe we have mishandled your data after dialogue, you may file a complaint with the Swedish Authority for Privacy Protection, the supervisory authority for personal data.

7.5 Contact

For questions or to exercise your rights, contact the relevant company/data controller:

• Mässrestauranger AB (556367-0347) – info@massrestauranger.se

• Mässrestauranger i Malmö AB (556844-5968) – info@malmomr.se

• Stadshusrestauranger Stockholm AB (556782-8222) – info@stadshusrestauranger.se

• Fair Clean AB (556605-3756) – info@massrestauranger.se

• Glada Ankan Restaurang & Catering AB (556489-9580) – info@gladaankan.se

• Engsholm Slott AB (556593-3735) – info@engsholm.se