Terms of Use and Privacy Information

TBS Tasks · Version of 16 October 2026

These terms apply to everyone who signs in to TBS Tasks (tasks.thebunsociety.com): employees, managers and administrators of The Bun Society. They explain how the app is used at work and what happens with your data.

By signing in you accept these Terms of Use and confirm that you have read the Privacy Information in part B. The legal basis for processing your data is your employment and our legal duties, not your consent (see section B3).

A. Terms of Use

1. Who runs the app

TBS Tasks is run by [legal name and legal form of the company], [street and number], [postcode and city], Germany ("we", "the employer"). Contact: [email address].

2. What the app is for

TBS Tasks is a work tool. It is used to:

show the checklists and tasks of each shift (front of house and kitchen),
record food-safety checks required by law (for example temperatures, cleaning, deliveries, corrective actions under the HACCP system of Regulation (EC) No 852/2004),
record stock counts, prep lists and shopping needs,
organise who does what during a shift.

Using the app for these purposes is part of your work and is an instruction of the employer under section 106 of the German Trade Regulation Act (GewO). It does not change your employment contract. If anything in these terms conflicts with your contract, a collective agreement or the law, those take priority.

3. Your account

You sign in with your personal shift plan login. Your account is for you only.
Keep your password secret. Do not share it, do not let anyone else tick tasks under your name, and do not use someone else's account.
If you think someone knows your password, tell a manager straight away so it can be reset.
When your employment ends, your account is switched off. An administrator can also deactivate an account immediately at any time, for example if a password may be known to someone else; it then cannot be used until it is allowed again.

4. Correct records

Only record what you actually did, when you did it. Tick a task only after it is done.
Enter readings (temperatures, counts) exactly as measured. If a reading is out of range, record it anyway and, where you can, note what you did and whom you told.
Food-safety records may be inspected by the food control authority. Deliberately false, back-dated or invented entries can endanger guests and are a serious breach of your duties under your employment contract.
If you made a mistake, use the undo function or tell a manager. Do not cover it up with a second false entry.

5. Photos

Take photos only of equipment, food, storage and work areas, as the task asks.
Do not photograph people: not colleagues, not guests, not yourself. If a person is in the picture by accident, retake it.
Do not photograph documents with personal data, payment terminals, screens or anything unrelated to the task.

6. Confidential information

Recipes, prep lists, supplier details, stock levels and other business information in the app are confidential business information of the employer and may be protected as trade secrets (German Trade Secrets Act, GeschGehG). You may use them only for your work. Do not copy, photograph, screenshot, forward or publish them, and do not take them with you when you leave. This duty continues after your employment ends.

7. Devices and working time

The app runs in a web browser. Nothing needs to be installed.
A device for the app is available at the restaurant. Using your own phone is voluntary. If you choose to use it, you can stop at any time and use the restaurant device instead. Using your own phone gives us no access to anything on it apart from what you enter in the app.
Time spent using the app for work counts as working time. You are not expected to use the app outside your working hours.
Sign out on shared devices when you are done.

8. Availability

The app may sometimes be unavailable (for example during updates or network problems). If it is, carry on with your work and record food-safety checks on the paper backup sheet kept at the restaurant, then tell a manager. We give no guarantee that the app is always available or free of errors; this does not limit any rights you have under your employment or by law.

9. Changes to these terms

We may update these terms, for example when the app gets new functions. The current version is always available at tasks.thebunsociety.com/terms with its date. We will tell you about important changes before they take effect.

B. Privacy Information

This section gives you the information required by Articles 13 and 14 of the General Data Protection Regulation (GDPR).

1. Controller

[legal name and legal form of the company], [street and number], [postcode and city], Germany. Email: [email address].

[If a data protection officer has been appointed: Data protection officer: name, email. Otherwise delete this paragraph.]

2. What data we process

Account data: your name, your shift plan employee number, your role (staff, manager, administrator), your work area (front of house or kitchen), your last sign-in time. These come from the shift plan system.
Shift data: which shifts you are scheduled for (from the shift plan).
Work records: which tasks you ticked, skipped or undid and when; counts, temperatures and other readings; notes, corrective actions and whom you told; deliveries you received; stock counts and shopping requests; prep lists; who assigned which task to whom.
Photos you take for tasks.
Change log: which manager or administrator changed which setting or record, and when.
Technical data: a session cookie that keeps you signed in, and the IP address of sign-in attempts, used to block password guessing. The hosting provider also keeps short-lived technical server logs.

We do not track your location, we do not read anything else on your device, and we do not use advertising or analytics cookies. The session cookie is strictly necessary for the app to work (section 25(2) TDDDG).

3. Why we process it, and the legal basis

Purpose	Legal basis
Organising shifts and tasks, performing your employment	Art. 6(1)(b) GDPR together with section 26 BDSG
Food-safety records (HACCP) and showing them to inspectors	Art. 6(1)(c) GDPR together with Art. 5 Regulation (EC) No 852/2004
Keeping the app secure (sign-in protection, change log)	Art. 6(1)(f) GDPR; our legitimate interest is the security and reliability of our records
Defending or enforcing legal claims, if ever needed	Art. 6(1)(f) GDPR

4. Reports and monitoring

Managers can see who completed which task and when, and a weekly overview per person. This is used to organise the work, to make sure food-safety checks are done and to plan training. It is not used for secret or permanent performance surveillance, and no decision about you is made automatically by the app. Before any measure under employment law is based on app records, you will be heard.

5. Who receives your data

Inside the company: managers and administrators, as far as they need it for their work. Colleagues on the same shift see who did which task.
Service providers (processors) who host the app for us under data processing agreements (Art. 28 GDPR): Vercel Inc. (application hosting and photo storage) and Neon Inc. (database). The data is stored in their data centres in Frankfurt, Germany. Both are US companies; if data is accessed from the USA, this is covered by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses.
Authorities: the food control authority when it inspects our food-safety records, and other authorities where the law requires it.
Messaging: stock summaries may be sent to the management via Telegram or WhatsApp. These summaries are about stock, not about you.

We do not sell your data or use it for advertising.

6. How long we keep it

Photos: deleted automatically after 90 days.
IP addresses of sign-in attempts: deleted automatically after 30 days.
Food-safety and work records (tasks, readings, deliveries, shifts, prep lists, shopping lists, stock counts, schedule copies): deleted automatically 2 years after the day they belong to. For each stock item, only the latest count is kept as its current level.
Change log: deleted automatically after 2 years.
Account data: your account is switched off when your employment ends. 2 years later it is anonymised automatically: your name is replaced by "Former staff" in your account and in all remaining records, and your notes, photos and change-log entries are deleted. Food-safety records that still have to be kept stay, without your name. An administrator can also do this earlier on request.
Backups: our database provider keeps backup copies for a short period for disaster recovery, so deleted data can remain in those backups for a short time before it is overwritten.

7. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on legitimate interests (Art. 21). To use these rights, contact us at [email address].

You can also complain to a data protection supervisory authority, for example the one responsible for our business: [name of the state data protection authority, for example "Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit"].

8. Do you have to provide the data?

The data in section B2 is needed to organise the work and to meet our food-safety duties. Recording your work in the app is part of your job. Using your own phone is not required (see section A7).

Last updated: 16 October 2026.