Who we are and our two roles
Safi Alsafi, trading as Serein (Trekroner Forskerpark 1, 2 104, 4000 Roskilde) runs Serein, a reservation and table-management service for restaurants. We act in two different roles. For our own website, contact form, restaurant accounts and billing we are the data controller, and this notice applies. For the guests who book a table at a restaurant, the restaurant is the data controller and we process the data on its behalf as a data processor under a data processing agreement; guests should read the guest privacy information instead. Questions about this notice: info@mail.getserein.dk.
What we collect and why
Visitors: technical data that your browser sends (IP address, browser type, requested page, time) is processed by our hosting and security providers to deliver the site and protect it from abuse (legitimate interest, GDPR art. 6(1)(f)). Contact form: the name, email, restaurant name and message you send us, to answer you (art. 6(1)(f), or art. 6(1)(b) where you ask about a contract). Restaurant users: name, email address, role and sign-in data, to give you access and keep the service secure (art. 6(1)(b)). Billing: the details needed to invoice a subscription, held by Stripe and by us for accounting (art. 6(1)(b) and (c)). Security and operations: error reference numbers and audit entries that record who changed what, without guest content (art. 6(1)(f)).
Who receives your data
The providers used to run the service are listed below, each under its own data processing terms: Supabase (database and sign-in, region Ireland), Vercel (hosting, region Dublin), Resend (email, EU region), Stripe (payments and subscriptions) and Cloudflare (Turnstile bot protection). They are listed with their locations on the Subprocessors page. We do not sell personal data and we do not use it for advertising.
Do you have to give us your data?
You never have to use the contact form. A restaurant user needs an email address to have an account, because we cannot provide the service without one. Our legitimate interests (GDPR art. 6(1)(f)) are running and securing the service and answering the people who write to us. We send only service messages (bookings, account and billing); we send no newsletters or marketing emails. We have not appointed a data protection officer, as the law does not require one for our activities; write to info@mail.getserein.dk with any privacy question.
Transfers outside the EU/EEA
The primary application database is hosted in Ireland. This does not mean all providers process data exclusively in the EU. Some providers are part of groups established in the United States and may access data for support or operation. Where that happens the transfer relies on the EU–US Data Privacy Framework for certified providers or on the European Commission’s Standard Contractual Clauses, together with additional safeguards.
How long we keep it
Contact messages are deleted automatically 24 months after receipt. Restaurant data is removed on confirmed restaurant deletion. User logins are retained separately so users can still access other restaurants; eligible accounts can be deleted separately by the operator. Invoices and accounting records: kept for five years after the end of the financial year, as the Danish Bookkeeping Act requires. Operational logs are short-lived. Booking verification codes expire after minutes.
Your rights
You can ask us for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to info@mail.getserein.dk; we answer within one month. If you think we handle your data wrongly you can complain to the Danish Data Protection Agency (Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk) or to the authority in your own country. If you are a guest of a restaurant, contact the restaurant first.
Security
Data is encrypted in transit (HTTPS) and at rest by our providers. Each restaurant’s data is separated by database row-level security and role-based access, passwords are handled by the sign-in provider, and guest links are signed and expire. See Security & trust for details.
Automated decisions and changes
The booking engine checks availability, timing and table capacity. It makes no decisions about people and builds no advertising profile. If we change this notice in a material way we will tell restaurant customers by email and update the date above.
Public guidance from the authorities: Datatilsynet (data protection) and Erhvervsstyrelsen (cookies and e-commerce).