Privacy policy

Yusuf Gökce, sole proprietorship trading as “SMK Group”
Koomansstraße 45, 57078 Siegen, Germany
Email: hello@symiko.de

We have not currently appointed a data protection officer. Please send questions about data protection to the email address above.

We ourselves are the controller for this website, demo requests, our contractual relationship with customers, our administration of customer systems as operator, notices of illegal content and reports of security vulnerabilities.

Within the Symiko application we process data on behalf of our customers as a processor under Art. 28 GDPR, on the basis of a data processing agreement and only on their instructions:

• For system-wide content – manual, news, academy, tasks, reports – the franchise head office that runs its franchise system in Symiko is the controller.
• For personnel data of a location’s employees – personnel file, working hours, absences, payroll documents, applications for the location’s jobs – the franchise partner as employer is the controller. Head office has no access to individual records.
• For reports in the whistleblowing system, the company operating the reporting channel is the controller.

The sections on the application describe how Symiko works technically. Your employer tells you which modules it uses and for what purpose.

When you visit, technically necessary data is processed: IP address, date and time, page visited, browser and operating system. It is used to deliver the page and to defend against attacks, and is kept only briefly in the hosting provider’s server logs, for at most 30 days.

Legal basis: Art. 6(1)(f) GDPR (operation and security of the website).

There are no analytics, tracking or advertising services and no embedded third-party content. Fonts are loaded from our own server.

If you request a demo via the form, you send us your email address and, voluntarily, your name, franchise system, number of locations, role and a message. We store this information together with the wording and time of your consent and also receive it by email so that we can suggest dates.

Purpose: arranging and holding a demo and subsequent contract negotiations.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request) and the consent given in the form (Art. 6(1)(a) GDPR).
Retention: the information is deleted automatically twelve months after the request; if a contract is concluded, the retention periods of the contractual relationship apply.
Withdrawal: at any time by email to hello@symiko.de. To protect against automated submissions we limit the number of requests; for this we store a non-reversible check value of the IP address for at most one hour.

Access is only created through an invitation from the head office or the employer. Depending on role and enabled modules, the following is processed: login data (email address, password only as a hash, two-factor key), profile and master data (optionally a profile picture, visible only to people who may see the profile anyway), assignment to location and role, rotas, working, break and absence times, personnel file and personnel questionnaire (including tax and social security data, bank details, religious denomination for wage tax purposes, health insurer), sick notes and health certificates, payroll exports, pay and expenses, equipment, appraisal meetings and qualifications, acknowledgements of manual chapters and mandatory information, training results and certificates, surveys and polls, chat and voice messages, comments, tasks, checklists and photos, food hygiene records (HACCP), orders, tickets and business reports.

Legal bases of the controllers: Art. 6(1)(b) GDPR (employment contract, franchise agreement), Art. 6(1)(c) GDPR (legal obligations such as recording working time, wage tax, social security, food hygiene, whistleblower protection), Art. 6(1)(f) GDPR (system-wide communication and organisation), each in conjunction with Art. 88 GDPR and the national rules on employee data protection. For health data and religious denomination, Art. 9(2)(b) GDPR also applies; only what is needed for wage tax and continued pay during illness is collected.

Who sees what: the database checks the role on every access. In rotas and reports, head office sees only totals and warnings – no working hours, absence reasons or personnel files of its partners’ individual employees; the sickness rate only from five people per location, results of appraisal meetings only from five people. Hygiene records show initials instead of names. By name, head office sees who has acknowledged mandatory chapters and information and who took part in a poll – for named polls also the answer, for anonymous surveys only results from a minimum group size.

Login security: two-factor authentication with an authenticator app is optional; it can be made mandatory for head office and franchise partners per system. When a password is set, we check whether it appears in known data breaches (“Pwned Passwords” service). Only the first five characters of its SHA-1 hash are sent, never the password; in the browser our server asks, in the app the device itself – the service then receives the device’s IP address. Legal basis: Art. 6(1)(f) in conjunction with Art. 32 GDPR.

Retention: for the duration of use or employment. Three months after leaving, an account is anonymised automatically; if the person has access to their payroll documents after leaving, after 15 months. Login, name, contact, bank, tax and social security data, religious denomination, health insurer and health documents are deleted. Working time records are kept without names for two years (Section 17 MiLoG, Section 16 ArbZG), absences, payroll and other personnel records until the end of the sixth calendar year (Section 41 EStG, Section 147 AO); after that they are deleted automatically. Approved expenses are deleted after eight years, rejected ones after three. Hygiene records are stored unalterably for as long as the customer system exists and are not deleted before then. A statutory retention duty or legal proceedings can suspend the deletion of individual data (hold); it is logged and ends after ten years at the latest. When a contract with a customer ends, its data is deleted completely once the retrieval period (at least 30 days) has expired.

Deleting your account: everyone can delete their own account in the web app and the mobile app. During ongoing employment only the login is deleted; the employer keeps the personnel file (Art. 17(3)(b) GDPR).

Start, end and breaks are stored, along with the source (app, time clock, transmitted later while offline) and the device used. Symiko does not use location data (GPS), photos or biometric characteristics for time recording.

If the employer decides that clocking in via the app is only allowed in the store, Symiko compares the IP address of the request with the IP address of a time clock at that location. Only the fact that the check succeeded is stored (for one day), not the person’s IP address; for the time clock, the most recently used IP address is stored.

At the time clock in the store you sign in with a personal PIN, which is stored only as a hash. The time clock shows everyone present the first name, the initial of the surname and the clock-in status. Without a network connection it stores entries encrypted on the device and transmits them later.

The app only asks for permissions when you use a feature: camera (photos for checklists, sick notes, documents), microphone (voice messages), Face ID or fingerprint (only locally on the device to confirm the daily hygiene sign-off – Symiko receives no biometric data) and notifications. There is no location permission. Before uploading photos, images and videos (MP4/MOV), Symiko removes embedded metadata such as the recording location and device.

Head offices can show content on screens in their stores. Paired devices report model, firmware version and browser identifier; from the connection we derive the device’s country and region in order to manage screens and report faults. The screens only show personal data if head office adds it as content itself.

Head offices can publish public forms with Symiko, for example for enquiries from advertisements (addresses of the form /f/…). The head office publishing the form is the controller for the data entered; its name appears below the form, as do its privacy policy and legal notice if it has added them. We process the data on its behalf (Art. 28 GDPR).

The form fields and the campaign source from the address (utm parameters) are processed; no cookies are set. Only the head office sees the data. If the form is linked to a newsletter, an email address is only added after confirmation via a link (double opt-in); unconfirmed sign-ups are deleted after 30 days, and every newsletter email contains an unsubscribe link. To protect against automated submissions we store a non-reversible check value of the IP address for at most one hour.

Systems can publish jobs on careers pages with Symiko (addresses of the form /jobs/…). The business advertising the job is the controller for an application – for a location’s jobs the respective franchise partner as future employer, for head office jobs the head office; its name appears above the form. We process the data on its behalf (Art. 28 GDPR). The legal basis is the initiation of an employment relationship (Art. 6(1)(b) GDPR in conjunction with the national rules on employee data protection).

Name, email address and/or phone number, stated availability, earliest start date, German language skills, an optional message, an optionally uploaded CV and the campaign source from the address are processed. Only the people responsible for HR at the advertising business see the application. They can record ratings against set criteria with comments; these are visible only to them and are deleted together with the application. The data is deleted automatically six months after the procedure ends at the latest, unprocessed applications after twelve months; if you voluntarily agreed to the talent pool, after 24 months. Consent can be withdrawn from the business at any time. If the business contacts you via the WhatsApp button, WhatsApp opens on its device with your number; that is the business’s decision. To protect against automated submissions we store only a non-reversible check value for at most one hour.

Via reporting channels in Symiko (addresses of the form /hinweis/…) employees and third parties can report breaches, also anonymously. The company operating the reporting channel is the controller; we are its processor. The legal basis is Section 10 of the German Whistleblower Protection Act (HinSchG) or the respective national law implementing Directive (EU) 2019/1937.

We store neither the IP address nor an account of the reporting person. Follow-up questions use a mailbox with a random code of which we only know a hash. Only the designated case handlers of the reporting channel may read reports; every access in the application is logged. Notifications contain no content. Attachments are cleaned of metadata before storage. Closed cases are deleted three years after closing, longer only where necessary and proportionate. You can also contact an external reporting channel, in Germany for example the one at the Federal Office of Justice.

• Orders to suppliers: when a location orders via Symiko, the supplier receives the order by email, with the location and the name of the person ordering.
• Manual import: if head office enters the address of a website to import, our server retrieves that page; the external server sees our server address, not yours.
• Inspection reports and tax advisers: for a food inspection, head office can share a time-limited link to an inspection report, and the employer can give its tax adviser an expiring link to exactly one export file. Neither receives an account; retrievals are counted and links can be revoked.
• Access after leaving: former employees can retrieve their payroll documents via a separate access until the account is anonymised.

Some features use an AI language model from the provider Anthropic (see recipients). The AI only works when someone explicitly starts the feature. Its result is always a suggestion that a person checks and then accepts or discards.

• Set-up assistant for food safety: The AI receives the conversation about the business, equipment and opening days as well as the system’s templates. We do not pass on names or personnel data from Symiko. Whatever someone types into the conversation goes to the AI; please do not enter details about people there.
• Importing a staff list: The AI matches the columns of the file. It only sees column names, the number of filled cells and masked examples (such as “Aaaa” instead of a name), no real values.
• Importing a rota (“Read with AI”): Before the table goes to the AI, the browser replaces names and other text with placeholders (T1, T2 …). The AI only sees the layout of the table, times, weekdays and dates. Which placeholder stands for which name stays on the device.

The provider processes the requests as our sub-processor. Under its contract terms it does not use them to train its models and deletes inputs and outputs after 30 days at the latest; only requests that violate its usage policy may be kept longer. Processing takes place on behalf of our customers (Art. 28 GDPR); the legal basis is the same as for the respective feature of the application (see Using the application).

If you report content via our notice form, you send us its location, an explanation and – except for notices concerning child sexual abuse material – your name and email address. We use this to review the notice, to inform you of our decision and to involve affected customers (Arts. 16 and 17 Digital Services Act; Art. 6(1)(c) GDPR). The affected person only learns your identity where strictly necessary for the statement of reasons (Art. 17(3)(b) DSA). We do not store an IP address. We delete notices two years after the decision. We process reports of security vulnerabilities (see Security) to fix them and to meet statutory reporting obligations (Art. 6(1)(c) and (f) GDPR).

We use the following service providers as (sub-)processors, all under contracts pursuant to Art. 28 GDPR. Transfers to third countries are based on the EU standard contractual clauses (Art. 46(2)(c) GDPR) and, where the provider is certified under the EU-US Data Privacy Framework, additionally on the European Commission’s adequacy decision (Art. 45 GDPR). The complete, current list with registered office, place of processing and purpose is available under Subprocessors.

• Supabase Pte. Ltd. (Singapore) – database, authentication, files; data centre in Frankfurt am Main (Amazon Web Services). Staff of the Supabase group may access from third countries such as the USA for operations and support, based on the EU standard contractual clauses.
• Vercel Inc. (USA) – delivery of website and application; server functions in Frankfurt am Main, the global delivery network may also answer requests in other countries.
• Plus Five Five, Inc. (Resend) (USA) – sending of all emails, including login and password links, invitations, newsletters, emails to applicants and suppliers, and notifications. Resend receives the recipient and content of the email.
• 650 Industries Inc. (Expo) (USA) – delivery of push notifications to the app, forwarded to Apple (APNs) and Google (Firebase Cloud Messaging). A device token, the title and text of the notification (e.g. a person’s name or, for chat messages, the sender and the first 140 characters) and internal identifiers for the target are transmitted.
• Cloudflare Inc. (USA) – storage for backups in the EU. Backups are encrypted before upload; only we hold the key. A further encrypted backup copy is kept in Apple iCloud.
• Anthropic Ireland, Limited (Ireland, group headquartered in the USA) – AI features (see AI features). Processing may also take place in the USA; the basis is the EU standard contractual clauses.
• IONOS SE (Germany) – mailbox hello@symiko.de.

In the browser, the push service of the respective browser vendor delivers web push notifications; their content is encrypted. For the password check we use “Pwned Passwords” (see above).

Without signing in, the website sets no cookies. After you sign in, the application stores only technically necessary information; no consent is required for this (Section 25(2) no. 2 TDDDG):

• Session (cookie “sb-…-auth-token”): keeps you signed in, up to 30 days.
• Security check (cookie “fos_sr”, 10 minutes) and sign-out after inactivity (cookie “fos_ak”, up to 9 hours).
• Offline use: the application stores manual chapters, pending hygiene entries and chat drafts on the device, mostly encrypted. In the app, the session is kept in the operating system’s protected storage.
• Time clock and screens: paired devices store their pairing, the team or the content schedule and entries recorded offline locally.

When you sign out, the session cookies are deleted.

Push notifications are only sent after you have expressly agreed in the settings of your device or browser. You can withdraw this at any time there; the device token is then deleted. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

Symiko makes no automated decisions within the meaning of Art. 22 GDPR. The AI features only make suggestions that a person checks. The early warning system points out deadlines to those responsible, such as expiring certificates; people decide what follows. Results of training tests are calculated according to fixed rules and are visible to the person and their employer.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw any consent at any time with effect for the future.

For data in the application, contact your head office or, for personnel data, your employer; we support both. You can download a copy of your data yourself after signing in under “My data” – as a structured file with your documents; in the app via the link to the web version. For the website and demo requests, write to hello@symiko.de.

You can lodge a complaint with any data protection supervisory authority, in particular in the Member State of your habitual residence or place of work. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

We update this policy when features or service providers change. The version published here with the stated date applies.