The following explanations provide information on the handling of personal data in the mobile application for the digital ordering process in SAP Data Space.

Responsibility for the collection of data
In principle, the operator of SAP Data Space is the data controller and SAP SE is the data processor within the scope of the application. SAP SE acts as the data controller for the optional survey at the end of an order process. This data is collected automatically as soon as a visitor group is registered for the digital ordering process.

How is data recorded?
Metadata of a visitor group:
When a group of SAP Data Space guests decides to use the digital ordering process, pseudonymous data is collected for the duration of the visit:

Start and end time of a visit
table number(s)
Mobile devices provided by the restaurant and a temporary PIN to lock the device
Items ordered
Status of the order
This data is recorded automatically as soon as a visitor group is entered for the digital ordering process.

Optional use of mobile payment and sending an invoice by email
If the operator has configured the use of mobile payment providers, guests of the SAP Data Space can use the mobile payment function. It is up to the operator of the SAP Data Space to decide which payment providers and methods are used. Forwarding to configured providers takes place via the Mobile Payment function of the SAP Customer Checkout Solution used. Guests can use digital payment service providers if mobile payment is activated. To do this, they are redirected via a QR code to a website that coordinates payment processing and lists a range of different payment service providers. After successful payment, guests are redirected back to the home page. Here, they can optionally enter an email address to receive a digital version of the invoice. As part of the mobile payment function, no payment information, such as account numbers, is processed or stored outside of the actual payment service providers. The mobile payment function can only be used on guests’ personal mobile devices.

Optional survey
SAP SE also offers an optional and anonymous survey on satisfaction with the stay in the SAP Data Space. Guests will find separate information on data protection prior to the survey.

Basis for data collection
Metadata of a visitor group:
The data is collected to ensure the provision of the digital ordering process during the visit to SAP Data Space.

Optional use of mobile payment and sending an invoice by email
The processing and storage of data for the implementation of mobile payment and the downloading of the invoice are optional. Users of mobile payment are referred to the applicable privacy policy before data is collected. Users can continue at this point and accept the privacy policy or cancel the process.

Which tracking technologies are used?
Digital ordering process
The digital ordering process does not use cookies to track devices or users across different sessions. The application uses cryptographic certificates that enable authentication and authorization of the mobile devices provided by SAP Data Space. This is a necessary basis of the digital ordering process, as it ensures that only authorized devices of the restaurant can participate in an order. A certificate identifies a restaurant device that is used for an order and is not linked to an individual. A visitor group can only be determined with additional identifying information about a visit defined by date and time, as long as this meta information about a visit is stored. This data is deleted regularly and automatically as soon as there is no need to store it, at the latest at the end of a working day.

Optional use of mobile payment and sending an invoice by email
The mobile payment functionality on guests’ private mobile devices and the downloading of invoices is supported by necessary cookies.

What are cookies and similar technologies?
Cookies are small files that are stored on your device (computer, tablet or smartphone). When you access a website, a cookie is placed on your device and this sends information to the operator who placed the cookie.

What are first-party cookies?
Websites contain first-party cookies and allow third-party providers to place cookies on your device. The difference between a first-party cookie and a third-party cookie is who places the cookie on your device. First-party cookies are cookies created specifically for the website on which they are used. These cookies enable an efficient service and the tracking of user behavior on websites. The Mobile Payment function website only uses first-party cookies.

What is a session and what is a persistent cookie?
Websites can place session cookies and persistent cookies on your device. The difference between a first-party cookie and a third-party cookie is which site places the cookie on your device. The difference between a session cookie and a persistent cookie is the lifetime of the cookie. Session cookies are cookies that are usually valid for as long as you use your browser or browser session. When you end your browser session, the cookie expires. Persistent cookies are permanent and continue to exist even after the browser is closed. This enables faster and often more convenient access to our website. The website of the Mobile Payment function uses both session cookies and persistent cookies.

Which cookies are used for the mobile payment function?
A distinction is made between essential cookies, which are absolutely necessary for the technical functions of a website, functional cookies, which allow website usage to be analyzed, and marketing cookies, which are required by advertising companies to display interest-based advertising. Required cookies are needed for the central functions of a website. These cookies enable a website operator to provide you with a secure login, store your login details, set up and manage your shopping cart and ensure a consistent appearance of the website. Functional cookies allow website usage to be analyzed to measure and improve performance. Marketing cookies are used by advertising companies to display interest-based advertising. These cookies allow you to share content with social networks and post comments. They are also used to show you interest-based advertising. The website for the mobile payment function only uses necessary cookies.