Privacy Notice (Services)

This Privacy Notice describes how MiseCentral LLC ("MiseCentral," "we," "us," or "our") processes Personal Data when you access or use the Services as an Authorized User of a Customer organization or when Customer otherwise uses the Services under an Agreement. This notice applies to the Services and is distinct from MiseCentral's Website Privacy Policy, which governs the public Website.

If you use the Website only, the Website Privacy Policy applies. If you use the Services under a Customer account, this notice applies together with Customer's internal policies and the Agreement between Customer and MiseCentral.

1. Roles

1.1. Customer as Controller. For Personal Data submitted to the Services in connection with Customer's hospitality operations, Customer is the Controller (or Business, under U.S. state privacy laws). Customer determines what Personal Data is collected, why it is processed, and how long it is retained in Customer's workflows.

1.2. MiseCentral as Processor. MiseCentral processes Personal Data on Customer's behalf as a Processor (or Service Provider) to provide the Services described in the Agreement and Data Processing Agreement ("DPA").

1.3. MiseCentral as Controller. MiseCentral acts as Controller for limited processing necessary to operate accounts, billing, product communications, security, and compliance unrelated to Customer's operational content, as described in Section 3.2.

2. Personal Data We Process on Customer's Behalf

2.1. Account and Profile Data. Name, work email address, phone number, job title, facility assignments, role permissions, language preferences, and authentication metadata for Authorized Users.

2.2. Operational and Workforce Data. Scheduling records, task assignments, work execution logs, attendance or completion attestations, and Operational Evidence attributable to individuals when Customer includes such information in hospitality workflows.

2.3. Quality, Food-Safety, and Traceability Data. Inspection records, corrective actions, temperature or compliance readings, lot and supplier traceability entries, photos, and notes that identify or relate to individuals when Customer submits such data.

2.4. Communications and Notifications. In-product messages, alert preferences, mobile push tokens, and notification delivery metadata.

2.5. Integrations and Connected Services. Personal Data imported from Connected Services under Customer's configuration and credentials.

2.6. Support and Support Mode. Support ticket content, attachments, session metadata, and records of temporary Support Mode or Partner Support Mode access authorized by Customer.

2.7. Technical and Audit Data. IP addresses, device identifiers, browser type, API activity, configuration changes, and security logs associated with identifiable users.

3. Personal Data MiseCentral Processes as Controller

3.1. MiseCentral may process the following categories as Controller for its own purposes:

(a) Account administration: Customer organization name, billing contacts, subscription details, and administrator contact information; (b) Billing and payments: payment method metadata processed through MiseCentral's payment Subprocessors; (c) Product communications: service announcements, security alerts, and administrative emails; (d) Security and fraud prevention: authentication anomalies, abuse detection, and platform integrity monitoring; and (e) Legal compliance: records required to comply with law, respond to lawful requests, and enforce the Agreement.

3.2. MiseCentral does not sell Personal Data or use Customer operational content for unrelated advertising.

4. Purposes of Processing

4.1. On Customer's behalf, MiseCentral processes Personal Data to:

(a) provide hosted hospitality operations capabilities, including Adaptive Operational Intelligence, Company Brain, Work Intelligence, Operational Intelligence, Adaptive Scheduling, Adaptive Work Execution, and Operational State; (b) generate advisory Operational Recommendations and alerts; (c) maintain Operational Evidence and audit history; (d) deliver notifications and mobile operations features; (e) enable Connected Services, Connected Devices, API Clients, and Service Accounts configured by Customer; (f) provide support, including Support Mode when authorized; and (g) maintain security, backups, and disaster recovery.

4.2. As Controller, MiseCentral processes Personal Data to administer subscriptions, communicate about the Services, protect the platform, and comply with legal obligations.

5. Legal Bases (EEA, UK, and Switzerland)

5.1. Where MiseCentral acts as Processor, Customer is responsible for establishing and documenting lawful bases for processing.

5.2. Where MiseCentral acts as Controller, processing is based on: (a) performance of a contract with Customer; (b) legitimate interests in operating, securing, and improving the Services, balanced against individual rights; (c) compliance with legal obligations; or (d) consent where required and obtained.

6. Operational Recommendations and Automated Processing

6.1. The Services analyze operational data to produce advisory Operational Recommendations. Outputs are probabilistic and informational. Customer remains responsible for operational, food-safety, regulatory, and business decisions.

6.2. MiseCentral does not make binding decisions producing legal or similarly significant effects concerning individuals on Customer's behalf unless Customer configures Customer-controlled rules that implement Customer's own decision logic.

6.3. MiseCentral does not use Customer Data to train foundation models for unrelated customers unless Customer provides documented authorization.

7. Sharing and Subprocessors

7.1. MiseCentral shares Personal Data with Subprocessors that assist in providing the Services, subject to contractual protections described in the Subprocessor Policy and DPA.

7.2. MiseCentral may disclose Personal Data if required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset sale with appropriate safeguards.

7.3. Customer may enable Connected Services that share data with third parties selected by Customer. Those transfers are governed by Customer's relationship with the third party.

8. International Transfers

8.1. Personal Data may be processed in the United States and other countries. Transfer safeguards are described in the International Transfer Statement and DPA, including Standard Contractual Clauses where applicable.

9. Retention

9.1. Retention practices are described in the Data Retention Policy and Data Deletion Policy. Customer may configure certain retention settings within the Services where available.

10. Security

10.1. MiseCentral implements technical and organizational measures described in the Security and Privacy Controls Overview and DPA.

11. Your Rights

11.1. Under Customer's control. If you are an Authorized User, many rights requests must be directed to your employer or Customer organization, which controls your operational data in the Services.

11.2. Requests to MiseCentral. Subject to applicable law, you may contact MiseCentral regarding:

(a) access, correction, or deletion of Personal Data MiseCentral processes as Controller; (b) objection or restriction where applicable; (c) data portability where technically feasible for Controller-held data; and (d) withdrawal of consent where processing is consent-based.

11.3. MiseCentral will respond within timeframes required by applicable law and may verify identity before responding. Processor-held data requests will be forwarded to Customer unless prohibited by law.

11.4. You may lodge a complaint with a supervisory authority in your jurisdiction. MiseCentral encourages you to contact Customer or MiseCentral first so concerns can be addressed promptly.

12. U.S. State Privacy Rights

12.1. Residents of states with comprehensive privacy laws may have additional rights, including rights to know, delete, correct, and opt out of certain processing. MiseCentral does not sell or share Personal Data for cross-context behavioral advertising.

12.2. Authorized User operational data is generally processed on Customer's behalf; submit requests regarding that data to Customer. Submit requests regarding MiseCentral Controller data to privacy@misecentral.com.

13. Children

13.1. The Services are business-to-business products not directed to children. Customer must not submit Personal Data of individuals under sixteen (16) years of age except as permitted by law for workforce administration.

14. Changes

14.1. MiseCentral may update this notice by posting a revised version with an updated "Last Updated" date. Material changes will be communicated to Customer administrators where practicable.

15. Contact

Privacy inquiries (Services): MiseCentral LLC Attn: Privacy 8 The Green, Suite A Dover, DE 19901 United States privacy@misecentral.com

Data Protection Agreement inquiries: See the DPA and Customer's MiseCentral account representative.

For Website privacy practices, see the Website Privacy Policy.