Privacy notice

Responsibility and contact

ProCafe is operated by Serdar Kahraman, a sole trader. Postal address: Cleekim Drive, EH15 3QP Edinburgh, United Kingdom. Contact: support@procafe.app or the contact form at procafe.app/contact.

The cafe determines the purposes for its staff and operational records; ProCafe processes those records on its documented instructions. ProCafe is responsible for its own account, billing, support, consent, security and audit information. The person responsible for privacy requests is Serdar Kahraman, reachable at support@procafe.app; mark the request ‘Privacy’.

Applicable Canadian requirements include PIPEDA and provincial private-sector privacy laws according to the activity and jurisdiction. Our existing UK data protection obligations also apply where relevant. A UK legal basis does not replace consent or another requirement under applicable Canadian law.

Information and purposes

We use the account name, email and password hash to create and secure access. We hold staff names, shifts, time-off requests, readings, documents and other operational information on behalf of the cafe. Payments and invoices are handled with Stripe; full card numbers are not received or stored by ProCafe. Support correspondence and limited security logs help us resolve problems and protect the service.

A sickness absence classification can reveal health information. Private employee files supplied by the business or employee may also contain health or other sensitive personal information. We process these records on the business's documented instructions. The business must decide what is necessary, meet applicable requirements for processing sensitive information, inform the people concerned and set appropriate retention instructions. We do not require diagnoses or detailed medical histories to record a sickness absence. Do not include unnecessary medical or other sensitive details in notes, messages or uploaded files.

Attendance, private employee records and messages

For the business, we store attendance times, actual breaks, corrections and approval history. Owner-managed pay information includes base and overtime rates, captured rate snapshots, reviewed payable minutes and payroll-preparation totals. These tools do not pay wages or determine employment entitlements.

Venue-location checks and clock-in photos are off by default. In Pro and Operations, an owner can enable them for a site. When a person chooses to clock in under that policy, a supported app or browser requests device permission and sends coordinates and accuracy, or a photo, linked to the staff member, site and attendance event. This evidence is stored, with no background location tracking, facial recognition or automated identity matching. Native location checks require a compatible app version; ordinary clock-in remains available when these requirements are off. Device permission does not establish the employer's lawful basis or replace its applicable notice and consent duties.

Private employee records can include contact and emergency-contact details, manually reviewed right-to-work documents and outcomes, payslips, contract versions, typed signatures and signing or authentication receipts supplied by the employer or employee. Owners manage private personnel records and pay rates; linked employees can read their own permitted payslips and contracts. Only owners review clock-in photos. Files can contain information or metadata supplied with them. The business chooses necessary records, purposes, applicable authority, notices to affected people and retention instructions.

Team messaging stores text, sender, conversation membership, timestamps and read state. Site channels follow current site permissions; private direct messages are available to their participants, not automatically to every owner. Pending mobile sends are encrypted on the device; delivered messages are stored by the service and are not end-to-end encrypted. Staff and operational content is not sent to advertising measurement. Business users receive information only through the relevant role, site, document or conversation controls.

Mobile app support information

Signed-in mobile apps report their installed version, build number, iOS/Android platform and a random installation identifier, linked to the user and cafe, with the report time. Our support team uses this information to diagnose version differences. It contains no advertising or hardware identifier, operational records or screen-by-screen activity, and does not depend on notification permission. We keep the latest report per installation, user and cafe until the account is erased.

Optional analytics and marketing

Necessary session and optional trusted-device cookies support sign-in. On public pages only, Google Analytics runs after Analytics consent. A separate Marketing choice controls Meta Pixel and consent-bound Conversions API measurement when configured. Neither is loaded in signed-in operational pages or internal administration. We do not sell personal information.

Consented Meta events can include browser or click identifiers, hashed account identifiers, IP address, browser user agent, time and source page. They do not include passwords or operational records. Analytics and Marketing can be withdrawn separately in Cookie preferences. This browser advertising choice does not sign you up for promotional email.

Hosting and international processing

The application and database are hosted in Germany in the European Union. Encrypted backups are held with a separate EU-region provider. The recipient list identifies providers for payments, email, monitoring and consented public-page measurement; some processing takes place in the United States. Canada support does not mean Canadian data residency.

Personal information processed abroad can be subject to lawful access by courts, law enforcement or national-security authorities there. Contractual safeguards cannot override those laws. Review the data processing agreement and recipient list. A business remains accountable for outsourcing; Québec businesses must assess applicable privacy-impact and written-agreement requirements before sending information outside Québec.

Retention, access and correction

The retention schedule sets the service's periods and deletion process. You may request access, correction and information about use and disclosure, and raise a privacy concern at support@procafe.app. Withdrawal of optional consent applies prospectively; necessary service or legal retention may continue. Requests about employer-controlled records usually go to the employer, with ProCafe assisting on its instructions.

We respond within the applicable statutory period. PIPEDA access requests normally require a response within 30 calendar days; an extension needs a permitted reason and the required notice. You may complain to the Office of the Privacy Commissioner of Canada or the competent provincial commissioner, including Québec's Commission d’accès à l’information, or to the UK ICO where its law applies.

Security incidents

We use appropriate access and security controls and notify affected customer organisations of personal-data breaches without undue delay. We assess and perform reporting, individual notification and incident-record duties required by applicable law; Canadian thresholds and timelines are assessed separately from the UK GDPR's 72-hour reporting rule. Report a concern to support@procafe.app without including unnecessary sensitive information.