Controller
[Företagsnamn AB], company reg. no. [556XXX-XXXX], Sibeliusgången 28, 164 77 Kista. Email: [info@akallatorget.se], phone: 08-752 70 71.
What data we process
- Orders: dishes, extras, amounts, tip, payment method, table number and times.
- Pick-up: name, mobile number and chosen pick-up time.
- Requests and allergies you write in your order.
- Ratings and comments you choose to leave.
- Lunch card: a random ID stored in your browser – no name or number.
- Location (only if you tap “Estimate when I'll arrive”): used inside your browser to calculate the distance and never sent to us.
- Staff: name, email and role for logging in to the staff view, plus a log of changes.
Why, and on which legal basis
| Purpose | Legal basis |
|---|---|
| Receive, prepare and hand over your order, contact you about pick-up | Contract (Art. 6(1)(b)) |
| Bookkeeping and receipts | Legal obligation (Swedish Bookkeeping Act) |
| Statistics, quality follow-up, security and preventing misuse | Legitimate interest (Art. 6(1)(f)) |
| Showing the Google Maps map | Consent (Art. 6(1)(a)) – can be withdrawn at any time |
| Handling allergy information you provide | Your explicit consent when you enter it (Art. 9(2)(a)) |
How long we keep data
- Name and mobile number for pick-up are anonymised automatically after 30 days.
- Order records needed for bookkeeping are kept for 7 years as required by law – without name and phone.
- Ratings are stored without a link to you as a person.
- Staff accounts are kept while the person works with us.
Who has access
- Supabase (database and login) – servers in Stockholm, EU. Data processor.
- Payment provider (e.g. Stripe/Swish) once online payment is enabled – separate controller for the payment.
- Web host delivering the website.
- Google – only if you accept the map (Google may then process your IP address, also in the US under the EU–US Data Privacy Framework).
We never sell your data and use no advertising or tracking cookies.
Your rights
- Get a copy of the data we hold about you.
- Have incorrect data corrected.
- Have data erased when it is no longer needed or we lack a legal basis.
- Restrict or object to processing based on legitimate interest.
- Receive data you provided in a machine-readable format (portability).
- Withdraw consent at any time – e.g. in the cookie settings.
Contact us at [info@akallatorget.se]. We reply within one month.
Complaints
You can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
Last updated 2026-10-17.