Privacy policy

1. About this policy

Symbose is a platform for businesses, venues, associations and private persons (each an "account"). The users of an account use it to sign in, pay at the shop, sign up for events and shifts, chat, share files and photos and receive news from the account.

This policy explains what personal data Symbose collects, why, who it is shared with, how long it is kept and what rights you have. It applies to the website, the platform and its apps for Android and iOS.

2. Who is responsible

The data controller is Symbose, CVR 27137962, Mølleparken 2, 6000 Kolding, Denmark. You can reach us at support@symbose.com.

Each account decides what it uses Symbose for and who its users are. For the data an account keeps about its own users and activities, the account is the data controller, and we process the data on its behalf under a data processing agreement. For the operation and security of the service itself, sign-in and billing included, we are the data controller.

You can contact either the account you belong to or us. If your request belongs with that account, we pass it on.

3. The data we collect

• Your profile and contact details, which are your name, alias, email address, mobile number, postal address, language and display preferences, and your roles on each account.
• If you sign in with Google, your Google account ID, verified email address and name.
• Your sign-in credentials. Your PIN, sign-in links and device sign-in tokens are stored only as one-way hashes, and for a passkey we store its public key only. If you unlock with your phone's fingerprint or face unlock, that check happens on your phone, and we receive no biometric data from it.
• Face recognition data, only if you choose to use it. This is a reference photo of your face and a numeric description of it (a face template), used to sign you in and to recognise you at the account's counter. See section 4.
• Cards. The serial number of an NFC card linked to you and, if you turn on phone-as-card, a random identifier your phone sends to the account's reader, which contains no personal data.
• Payments. Your plan, memberships, shop tab, purchases, subscriptions, donations and payment status. Card details are entered on our payment provider Mollie's own page and never reach us.
• What you do on an account, such as event sign-ups and check-ins, shifts, poll votes, raffle tickets, tasks, meetings, payroll agreements and payouts, chat messages, and the files and photos you upload or share.
• The push token of your phone or browser, so we can send you the notifications you have allowed.
• Addresses you type for maps and trips, which are looked up with Google Maps.
• Your sign-in history, which is when and how you signed in.
• Technical data. Your IP address is used briefly to limit abuse and is not stored. Our servers keep short technical logs for up to two weeks.

We do not use analytics, advertising or tracking tools, and we do not collect your location, contacts, microphone recordings or advertising ID.

4. Face recognition

Face recognition is optional. Every account offers other ways to sign in and to be identified, such as an email link, a PIN, a passkey, a card or your phone.

When you enrol, the camera image is sent to our own servers, where the face is found and measured. Only the reference photo and the face template are stored. Other camera frames are processed in memory and discarded straight away. No third party receives your face data.

Face data is biometric data, a special category of personal data, and is processed only with your explicit consent. You can withdraw your consent at any time by turning face recognition off or by asking us or the account you belong to. Both the photo and the template are then deleted.

Account admins with the right permission can see users' reference photos to manage face recognition.

5. Why we use your data, and our legal basis

• To provide the service you or your account signed up for, which includes your user account, sign-in, billing, payments, events, shifts, chat, files and notifications (performance of a contract, GDPR art. 6(1)(b)).
• To keep the service secure, prevent misuse and fix faults (legitimate interests, art. 6(1)(f)).
• To recognise you by face, only with your explicit consent (art. 6(1)(a) and art. 9(2)(a)).
• To keep accounting records as Danish law requires (legal obligation, art. 6(1)(c)).
• To send you emails and notifications about your user account and the accounts you belong to. You can turn notifications off in the platform or in your phone's settings.

We never sell your data and never use it for advertising.

6. Who we share data with

On an account, other users see your data according to their role. For example, staff see your name at the counter, and admins manage the users.

We use these service providers (data processors) to run Symbose. Each receives only what it needs.

• Hetzner Online GmbH (Germany) hosts the platform. All data is stored on our servers in Hetzner's data centres in the EU.
• Mollie B.V. (the Netherlands) takes payments. Mollie receives your name, email address, the amount and what it is for.
• Resend, sending through Amazon Web Services in Ireland, delivers emails such as sign-in links, invitations, shared files, newsletters, receipts and notices.
• Google provides the optional Google sign-in, push notifications to the app (Firebase Cloud Messaging, the notification text included), Google Maps for addresses you type, and app distribution and updates through Google Play.
• The push service of your browser (Google, Mozilla or Apple) delivers encrypted browser notifications.

We share data with authorities only when the law requires it.

Google is based in the United States. Where data leaves the EU/EEA, the transfer is covered by the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

7. How long we keep data

• Your data on an account is kept for as long as you are a user of it. When an admin removes you, or the account is deleted, your data on it is deleted.
• Face data is kept until you turn face recognition off or your user account is deleted.
• Accounting records are kept as long as Danish bookkeeping law requires, which is currently five years.
• Sessions last 30 days, sign-in links 15 minutes and device sign-in tokens 180 days.
• Records of outgoing emails are kept for 7 days and server logs for up to two weeks.

8. Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time.

To use your rights, or to have your user account and data deleted, write to support@symbose.com from the email address on your user account, or ask an admin of the account you belong to. We answer within one month.

You can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or to the supervisory authority where you live.

9. Security

All traffic is encrypted with HTTPS. Credentials are stored only as one-way hashes, the database cannot be reached from the internet, and every request is checked against your role and permissions.

10. Cookies and storage on your device

We use only the cookies and browser storage the platform needs to work. They keep you signed in, remember who has signed in on a shared device, remember your language and settings, and make the platform start faster. We use no tracking or advertising cookies, so we do not ask for consent to cookies.

11. App permissions

• The camera, to scan barcodes and, if you choose it, for face recognition.
• NFC, to read cards and to let your phone act as a card at the account's reader.
• Notifications, to show the notifications you have allowed.
• Biometrics, to unlock sign-in with your phone's fingerprint or face unlock. The check stays on your phone.
• Installing updates, only in the version downloaded from our website, so it can install its own updates. The Google Play version is updated by Google Play.

12. Children

Symbose is for people aged 18 and over. We do not knowingly collect data about children. If you believe a child has a user account, contact us and we will delete it.

13. Changes

When this policy changes, we update the date at the top. If the changes are significant, we tell you in the platform or by email.

14. Contact

Symbose, CVR 27137962

Mølleparken 2, 6000 Kolding, Denmark

Email support@symbose.com