Privacy Policy

Version: 2 October 2026

1. Who is the controller?

FFM&M RE GmbH, Sybelstraße 31, 10629 Berlin, Germany, represented by its Managing Director Maximilian Prinz zu Sayn-Wittgenstein-Berleburg. Email: kontakt@helpya.com. HelpYa is a service of FFM&M RE GmbH.

2. In brief

• HelpYa needs no name, no telephone number and no account of the waiting customers.
• There are no advertising trackers, no analytics tools and no access logs.
• The servers are located in Germany (Hetzner, Nuremberg).
• Collection numbers are anonymised 24 hours after collection.

3. Two roles: the business and HelpYa

HelpYa is used by businesses – such as bakeries, restaurants, salons, practices or garages. If you, as a customer of such a business, take a number, the business is the controller for the processing of your data; FFM&M processes them on its behalf (Art. 28 DSGVO (GDPR)). For this website, the enquiry form and the businesses’ accounts, FFM&M is itself the controller.

4. Visiting this website

When you access the website, our server processes your IP address and the requested address to the extent technically necessary to deliver the page. We do not store any access logs for this purpose. Error messages arise only in the event of technical errors and are overwritten automatically (after a few days at most). Legal basis: Art. 6(1)(f) DSGVO (GDPR) (secure and stable operation).

The connection is encrypted via TLS. We do not embed any third-party content (no external fonts, no maps, no videos).

5. When you take a number as a customer

When you hold your phone to a HelpYa contact point or scan the QR code, we process:

• a random identifier for your number, the number itself and times (created, ready, collected),
• a device cookie (hy_geraet), so that tapping again takes you to your existing number rather than a new one,
• a language cookie (lang), if you change the language yourself. Without such a change, we display the page in the language your device is set to (German, English, Spanish, Italian, French, Dutch or Thai); your browser sends this information anyway, and we do not store it.

The purpose is to notify you when your order, your table, your appointment or your job is ready. Legal basis for the business: Art. 6(1)(b) DSGVO (GDPR) (provision of the service you are using). The cookies are strictly necessary for this service (§ 25(2) no. 2 TDDDG).

Storage period: 24 hours after collection, the number is anonymised – the link becomes invalid, and only timestamps without any personal reference remain for the analysis of waiting times. For jobs lasting several days (trades, garage), at the latest 30 days after creation.

Ordering and paying at your seat

If a business offers “Order & Pay”, we additionally process your order (food and drinks, selected options, prices), your seat (e.g. “Table 7”), your special requests or note (free text, if you enter one), the payment method (online or on site) and any tip. Here too, the business is the controller. We delete special requests and notes after 24 hours. Items and amounts without reference to your person are retained for the business’s statutory records.

Online payment: If you pay online, you enter your payment details directly on a Stripe page (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). The seller is the business; it has its own Stripe account for this purpose, and Stripe processes your payment data under its own responsibility and in accordance with its own privacy policy (stripe.com/de/privacy). HelpYa does not receive any card or account details, only whether and in what amount payment or a refund was made, and a payment identifier. Legal basis: Art. 6(1)(b) DSGVO (GDPR) (processing of your order).

6. Notifications (push notifications)

If you tap “Activate alert” and allow notifications, we store the push address generated by your browser. The notification is delivered in encrypted form via the push service of your device manufacturer (Apple, Google or Mozilla); some of these companies are based in the USA and are certified under the EU-US Data Privacy Framework. They see only encrypted data, not the content. The push address is deleted together with the number. You can switch off notifications at any time in your device settings.

Your device automatically confirms receipt of a notification so that the business can see whether the message has arrived and can otherwise call you.

7. Wallet pass (Google Wallet, Apple Wallet)

If you tap “Add to Google Wallet” or “Add to Apple Wallet”, a pass containing your number and its status is transmitted to and stored by Google or Apple respectively. The privacy terms of Google or Apple additionally apply. You can delete the pass from your wallet at any time.

8. Vehicle pass at garages

When accepting a vehicle, garages can enter your registration number and, optionally, the month of the next statutory roadworthiness test (Hauptuntersuchung, HU) and of the next service/inspection (with a short note, e.g. mileage). Without your consent, this information is deleted together with the job.

If you tick the box on your phone for reminders about the HU/TÜV test, service/inspection and tyre changes, we store the registration number, the HU and service month, the time and wording of your consent and the push address of your device in order to send you such reminders on behalf of the garage. Legal basis: your consent (Art. 6(1)(a) DSGVO (GDPR), § 7(2) UWG). You can withdraw it at any time on your vehicle pass and delete your data there with a single tap. Otherwise we delete them at the latest 3 years after the last contact.

Cost estimates: If a garage or a trade business sends you a cost estimate via HelpYa, we store the document, the amount, the time of sending and opening, and your decision (approval, rejection or request for a call back) with its time and your optional message. This allows the business to prove which cost estimate you approved (legal basis: performance of the contract, Art. 6(1)(b) DSGVO (GDPR), and legitimate interest in being able to provide proof, point (f)). We delete this information 12 months after your decision, and drafts that have not been sent after 7 days. The document is not passed on to third parties and is not analysed automatically.

Pet pass at veterinary practices: Practices can enter, together with your waiting number, the name of your animal and, optionally, the months of the next vaccination or routine check-up (with a short note) – no name of the owner, no diagnosis. Without your consent, this information is deleted together with the waiting number. If you consent to reminders, we additionally store the time and wording of the consent and the push address of your device (Art. 6(1)(a) DSGVO (GDPR), § 7(2) UWG); withdrawal and deletion are possible at any time on the pet pass, otherwise deletion takes place at the latest 3 years after the last contact.

Getting help (emergency): If a business offers “Help” and you use it to report that you feel threatened, we store the time, the business and the information you voluntarily provide about your location and identifying features, and send it to the business’s staff (screens and logged-in phones of the team; no SMS). Legal basis: your request and vital interests (Art. 6(1)(b) and (d) DSGVO (GDPR)). We delete the location and free text after 30 days; thereafter only the time and type of report remain. We use your IP address only briefly in working memory to limit misuse. To counter false alarms, the help page sets a technically necessary cookie with a random identifier (30 days); of this we store only an encrypted fingerprint with the report. If the staff mark the report as a false alarm, this device cannot send a report to the same business for 24 hours. Legal basis: legitimate interest in functioning emergency reports (Art. 6(1)(f) DSGVO (GDPR), § 25(2) no. 2 TDDDG); we delete the fingerprint after 30 days.

9. Enquiry form

If, as a business, you express interest in HelpYa via the form, we process your details (business, name, email, optionally telephone, location, till system, message and sector) in order to respond to your enquiry. We are notified of new enquiries by email; for this purpose your details are transmitted to our mailbox via the email delivery service Resend (see no. 12). Legal basis: Art. 6(1)(b) DSGVO (GDPR) (steps prior to entering into a contract). We delete the details when they are no longer needed, at the latest 12 months after the last contact – unless a contract is concluded.

If you apply as a sales partner via helpya.com/partner, we process your details (name, email, optionally telephone, region, experience, trade registration status, sector contacts, message) in order to decide on a collaboration; the notification to our mailbox is likewise sent via Resend (see no. 12). Legal basis: Art. 6(1)(b) DSGVO (GDPR). If no collaboration materialises, we delete the application at the latest 6 months after our decision.

10. Accounts of businesses and sales partners

For businesses using HelpYa, we store the company name, sector and the access data of the authorised persons (email address, encrypted password, role) as well as a login cookie for the logged-in devices. If a business subscribes to a paid plan, we additionally process the billing address, where applicable the VAT ID, and the invoices; payment is handled by Stripe (Stripe Payments Europe, Ltd., Dublin), which processes the payment data itself – we do not receive any card or account details. We retain invoices in accordance with the retention periods under tax law (up to 10 years, § 147 AO). Legal basis: Art. 6(1)(b) and (c) DSGVO (GDPR).

For sales partners, we store name, email, where applicable telephone, address, tax details and bank details, the assigned businesses, commissions and credit notes, as well as proof of conclusion of the contract. You sign the sales partner agreement electronically via our signature service sign.omsw.co, which runs on the same servers in Germany. We retain credit notes in accordance with the retention periods under tax law. Legal basis: Art. 6(1)(b) and (c) DSGVO (GDPR).

Importing and translating menus: If a business uploads its menu as a file or names a website, we have the menu read by an AI service (Anthropic, see no. 12) and automatically translated into other languages. Only the menu or the named website and the texts of the menu are transmitted – no guest data. Legal basis: Art. 6(1)(b) DSGVO (GDPR).

Support access: If a business asks for help, it can grant us insight in the customer area by means of a code for a maximum of 60 minutes – “view only” or “view and edit”, which can be ended at any time. During the support access, our staff see the customer area and the business’s screens as the business sees them; orders and special requests of guests may also be visible. During this time, the business’s devices on which a HelpYa page is open transmit their technical status (e.g. device type, browser, screen size, whether notifications are permitted, connection, technical error messages of the page) – without name, location or IP address. We log which pages support accesses and what it changes. We delete the log and the device data after 30 days. Legal basis: Art. 6(1)(b) DSGVO (GDPR) (support within the scope of the contract); insofar as guest data become visible, we act on behalf of the business.

11. Email

Emails to addresses at helpya.com are forwarded via the forwarding service of Cloudflare (Cloudflare, Inc., USA; certified under the EU-US Data Privacy Framework) to our mailbox at Microsoft 365.

12. Hosting and service providers

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – servers in Nuremberg (processing on our behalf).
• Cloudflare, Inc. – only name resolution (DNS) and email forwarding; website traffic does not pass through Cloudflare.
• Resend, Inc., USA (sending from the EU) – emails to businesses and sales partners (e.g. invoices, access links) and internal notifications to our mailbox (no. 9); transfer on the basis of EU standard contractual clauses (Art. 46 DSGVO (GDPR)).
• Stripe Payments Europe, Ltd., Dublin, Ireland – payment processing for subscribed plans and, on behalf of the businesses, for online orders (nos. 5 and 10).
• seven communications GmbH & Co. KG, Kiel, Germany (seven.io) – SMS for the staff’s silent alarm to the numbers stored by the business (owner, security company); servers in Germany.
• Anthropic, PBC, USA – reading and translating menus (no. 10); no guest data; transfer on the basis of EU standard contractual clauses (Art. 46 DSGVO (GDPR)); the content is not used for training.

13. Your rights

You have the right of access (Art. 15 DSGVO (GDPR)), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. To do so, please contact kontakt@helpya.com – for numbers you have taken at a business, you are also welcome to contact the business directly.

You can also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us, the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

14. No automated decision-making

We do not make any automated decisions and do not carry out profiling.

Terms and Conditions · Privacy Policy · Data Processing Agreement · Legal Notice