Data processing agreement (DPA)

1. Definitions

The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given to them in the GDPR. The “Service” means the Menixo platform, as described in the Terms.

2. Subject matter and duration

The Processor processes personal data on behalf of the Controller only to provide the Service, for the duration of the subscription and of the deletion period set out in section 10.

3. Nature and purpose of the processing

Hosting and displaying the menu, passing orders and table requests to the order screen, showing the order status on the guest's phone, managing staff accounts and tablets, keeping the order history and calculating daily totals.

4. Data subjects and categories of data

Restaurant guests: order contents, table, time, notes written on items, service requests (including the chosen payment method, card or cash), a random session identifier and the IP address, used to limit abuse.

Restaurant staff: the name shown on the tablet, the PIN (stored only as a hash), the tablet used and the time of actions taken on orders. Managers: name and email address.

The Service is not designed for special categories of personal data. The Controller does not ask guests to write such data in order notes.

5. Obligations of the Processor

It processes the data only on documented instructions from the Controller; the Terms, this agreement and the settings the Controller makes in the panel constitute those instructions. If an instruction infringes the law, it informs the Controller.

It ensures that the persons authorised to process the data have committed themselves to confidentiality, and it applies the security measures set out in Annex 1.

It assists the Controller, as far as possible, in responding to requests from data subjects, in carrying out data protection impact assessments and in meeting its obligations under Articles 32–36 GDPR.

It makes available to the Controller the information needed to demonstrate compliance with Article 28 GDPR and allows audits, with 30 days' prior notice, at most once a year, at the Controller's expense, without affecting the security of other customers.

6. Obligations of the Controller

The Controller has a legal basis for the processing, informs its guests and staff about the processing (for example, through a note in the menu or on the premises) and does not give instructions that are contrary to the law.

7. Sub-processors

The Controller gives general authorisation for the use of the sub-processors listed in Annex 2. The Processor notifies the Controller by email at least 30 days before adding or replacing a sub-processor; the Controller may object on reasonable grounds and, if no solution is found, may cancel the subscription.

Each sub-processor is bound by contract to data protection obligations at least as strict as these. The Processor remains liable to the Controller for its sub-processors.

8. International transfers

The data of the restaurant's guests is hosted in the European Union. Any transfer outside the EEA takes place only on the basis of an adequacy decision or of the European Commission's standard contractual clauses.

9. Personal data breaches

The Processor notifies the Controller without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting the Controller, and provides the information available: the nature of the breach, the categories and approximate number of data subjects and of personal data records concerned, the likely consequences and the measures taken.

10. Retention and deletion of data

Orders are kept for 12 months; after that, only daily totals remain, with no data about individuals. Technical events from the order screen are deleted after 7 days.

When the subscription ends, the Controller's data is deleted after 90 days, except for data that we are required by law to keep. On request, before deletion, the Controller receives a copy of the data.

11. Liability

The parties' liability is determined in accordance with Article 82 GDPR and the limits set out in the Terms, to the extent permitted by law.

Annex 1. Technical and organisational measures

Encrypted connections (HTTPS/TLS). Passwords and PINs stored only as hashes. Data separated by restaurant, checked on the server with every request. Distinct roles (owner, manager, staff) with the minimum necessary permissions.

PIN lockout after 5 wrong attempts, and request limits per table and per IP address. Daily database backups, kept for 14 days. Administrative access to servers only for authorised persons, with strong authentication.

Annex 2. Sub-processors

OVH SAS: hosting of the servers and the database, in the European Union.

[FURNIZOR_EMAIL]: sending service emails to account users.

Anthropic PBC: automatic translation of menu texts (item names and descriptions). It receives no data about the restaurant's guests or staff.