Worker Privacy Policy
Last updated: November 1, 2026
1. Controller and scope
The controller for your personal worker account and the tipping platform records described here is Yaroslav Baran trading as RESTOBOT, Śląska 6, m. 14, 02-472 Warsaw, Poland; NIP 1133092409; REGON 524951267; [email protected]. Venues can be separate controllers for employment, tip allocation and workplace management. This notice supplements the general Privacy Policy and explains the worker-specific purposes.
2. Data, purposes and legal bases
Account and authentication: email, phone, password hash where email login is used, verification/reset and session records, Telegram or Google identifiers and available profile data if you use those sign-in methods, and acceptance/consent records. We use these to provide and secure your account and communicate about the service. The basis is contract performance (GDPR Article 6(1)(b)) for necessary service data, and legitimate interests (Article 6(1)(f)) for proportionate security and evidence of compliance.
Profile: display name, photo, biography, position, page styling, custom button/link, social links and personal goal text, image and amount. Completed public profile content is displayed to provide the function you request (Article 6(1)(b)). Optional date of birth/citizenship data supports eligibility and proportionate fraud prevention (Article 6(1)(f)); an age derived from birth date, gender and student status are displayed publicly only after the relevant visibility choice. Optional profile personalisation/visibility relies on your voluntary consent where Article 6(1)(a) applies; you can withdraw it by removing data or disabling visibility. Avoid unnecessary health or other special-category data.
Employment profile: declared work experience, positions, dates, descriptions, verification status and job-seeking/market visibility preferences. These support requested employment-profile functions (Article 6(1)(b)); optional market display requires the applicable voluntary visibility choice (Article 6(1)(a)). Venue records can also come from authorised venue staff. Before requesting optional display, review which fields the available visibility settings cover.
Payments and feedback: tip amounts, currency, dates, venue, recipient/pool allocation, payment, refund and dispute status, provider references and distribution records, ratings and comments. These support the contract (Article 6(1)(b)), applicable legal accounting duties (Article 6(1)(c)) and proportionate claims/fraud handling (Article 6(1)(f)). A paid tip with no selected stars currently generates an inferred five-star entry; this is not an explicit guest review. A worker can question an inaccurate record.
Technical and mobile data: IP address, browser/device and session/log information for operation and security (Article 6(1)(f)); push token and notification payload for enabled notifications; uploaded images for features you request. Camera, image-selection and notification permissions depend on your device choices and do not authorise unrelated processing. Full card numbers, security codes and Stripe identity documents are submitted through Stripe; RESTOBOT processes connected-account identifiers, onboarding/payout status and provider responses needed for the integration.
3. Visibility and recipients
Public tipping pages display the completed public fields described above. Age, gender and student visibility are disabled by default. Contact details are not automatically published merely because you create an account; social links you add can themselves reveal contact details. Optional job-market visibility is separate from the public tipping profile. Disabling visibility cannot remove copies already obtained by others.
Authorised venue staff can access the employment, rating, tip-allocation and distribution information relevant to your venue relationship, independently of job-market display. Stripe receives payment/onboarding data. Hosting and IT providers, Cloudinary for uploaded images, email, Telegram and push-delivery providers including Expo and the device platform process data needed for enabled functions. Authorities receive information where lawfully required. We do not sell worker data.
Stripe is an independent controller for its compliance and other independent purposes and can also be a processor for instructed payment functions. Its role depends on the purpose and service. See https://stripe.com/privacy and https://stripe.com/legal/dpa. Provider status does not remove RESTOBOT obligations for its own processing.
4. Retention and international transfers
Account data is needed during the relationship. Following closure, profile data should be deleted or anonymised when no longer needed, subject to lawful exceptions. Transaction and distribution records remain while payment/dispute obligations are unresolved, for relevant claims periods and any applicable statutory accounting/tax period. This is not invariably five years from a transaction. Security logs are limited to the necessary operational/security purpose and justified investigations. Closure does not instantly erase every backup or provider record. Contact support about retention of a specific record.
Providers can process data outside the EEA. Transfers require an applicable adequacy decision or another GDPR Chapter V mechanism, such as Standard Contractual Clauses and necessary supplementary measures. EU-U.S. Data Privacy Framework certification applies only to covered certified recipients and processing. Contact support for recipients, destinations and safeguard details or a copy of applicable safeguards. Independent providers explain their own transfers.
5. Rights, required data and changes
Subject to GDPR conditions, you can request access, correction, erasure, restriction and portability; object to legitimate-interest processing; and withdraw consent without affecting earlier lawful processing. Complain to the Polish President of UODO at https://uodo.gov.pl or another competent authority, including in your habitual residence or place of work. Email [email protected] to exercise rights. We normally respond within one month; a permitted extension of up to two further months is explained within the first month.
Required account data is necessary to provide the service; optional profile fields and market visibility are not conditions of receiving individual tips. Necessary session/security storage is distinct from optional analytics or advertising, which requires permission where applicable and is described in the general Privacy Policy. This notice does not seek blanket consent. Changes require additional notice or separate consent where the law requires it and do not retrospectively authorise processing.