Data processing agreement

Parties and scope

This agreement (GDPR art. 28) is between you, the venue, as controller and Ospitera as processor. It forms part of the terms of service and applies for as long as we process personal data for you. Version 2026-11-05.

What we process

Subject matter and purpose: taking, showing, printing and delivering your diners' orders, sending the text messages you switch on, and the related support.

Data subjects: your diners, and your own staff who use the admin and staff board.

Personal data: diner name, phone number, delivery address, notes and order contents; staff usernames; technical data such as IP addresses (stored only as keyed hashes).

Duration: Delivery address and notes are deleted 24 hours after an order is closed, phone number and surname after 72 hours, and unclosed orders lose them after 7 days. Order contents and amounts stay for the venue's accounting until it or the service ends.

Our obligations

Documented instructions: we process your personal data only for the purposes and on the instructions in this agreement, the settings you choose in your admin and later instructions from your authorised contacts, including on transfers abroad. If a law of the EU or a Member State requires other processing, we tell you first unless that law forbids it. If we think an instruction breaks data protection law, we tell you promptly and suspend that instruction until we agree how to proceed.

Everyone at Ospitera with access is bound to confidentiality.

We keep appropriate security measures, including: encryption in transit, encryption at rest of diner contact data and payment credentials, hashed passwords and PINs, access limited per venue, rate limiting, logging of sensitive actions, automatic deletion as above, and database backups.

Assistance: taking into account the processing and the information we have, we help you with diners' requests to exercise their rights, security, assessing and notifying breaches, impact assessments and consultations with authorities. Your admin includes a tool to export or erase one diner's data; for anything it doesn't cover, write to support. We forward requests about your processing to you promptly and don't answer them ourselves unless the law requires it, and we give you the information we reasonably have in time for your deadlines.

We notify you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data, with the information you need to meet your own obligations.

End of the service: new orders stop on the end date. For 30 days after it you can still log in and export (terms 9.4); on day 30 we delete the personal data we hold for you (orders, diner data, staff and owner accounts, menu, and the contact details in your settings), unless you ask us to delete it sooner. Database backups expire on our database provider's restore schedule and are never used for ordinary operations; if one is ever restored, the deletions are applied again. We keep only what the law requires of us: our invoices to you and the record of your acceptance of the terms.

Compliance and audits: we give you the information reasonably needed to show compliance with this agreement and allow and contribute to audits, including inspections, by you or an independent auditor you appoint, on reasonable notice and under confidentiality. Routine audits may be combined to avoid duplication; further audits are always possible after a material incident, a material change in the processing, reasonable signs of non-compliance or at a supervisory authority's request.

Separate roles: we are your processor for your diners' orders and for the staff accounts you manage. We are a separate controller for our customer relationship with you, billing, the security of our own platform and legal claims, as described in our privacy policy (/legal/privacy). Neither role lets us use diner data for advertising, unrelated profiling or training AI models.

Subprocessors

You authorise the subprocessors listed at /legal/subprocessors. We impose the same data protection obligations on them and remain responsible for them.

We announce new subprocessors in your admin at least 30 days in advance. You may object on reasonable grounds; if we cannot resolve it, you may end the service before the change.

Transfers abroad

The subprocessor list names where each provider processes data. Where data leaves the European Economic Area, the transfer relies on an adequacy decision or, where none applies, the European Commission's standard contractual clauses (module 3, processor to processor) that we have agreed with that provider, with supplementary measures where needed. We assess onward transfers by our providers separately. A transfer without a valid mechanism does not start. On request we give you a copy of the safeguards, redacted only where commercially necessary.

Country annexes

United Kingdom: personal data from the UK may go to the EEA under the UK's adequacy regulations for the EEA. Where a restricted transfer goes beyond the EEA, it uses the UK International Data Transfer Addendum to the clauses we have with that provider.

Switzerland: transfers to the EEA rely on the Federal Council's recognition of adequate protection there; transfers elsewhere use the standard contractual clauses as recognised by the Swiss Federal Data Protection and Information Commissioner for that destination.

Brazil: transfers to Belgium and the rest of the EU rely on the Brazilian data protection authority's (ANPD) adequacy decision for the European Union, as far as it covers them. Other destinations and onward transfers use the mechanism named for them; where that is the ANPD standard contractual clauses (Resolution CD/ANPD 19/2024), their complete text and completed annexes are attached, unchanged.

Turkey: where the Personal Data Protection Board's standard contract is the safeguard, we complete and sign the correct Turkish module with you before any transfer begins, and the signed contract is notified to the Personal Data Protection Authority within five working days of signing by the party it names. We do not start processing for a venue in Turkey before that.

Quebec: before personal information leaves Quebec, we give you the information and written safeguards you need for your own assessment under the Act respecting the protection of personal information in the private sector; the assessment stays yours.

Other countries with their own rules on sending personal data abroad (for example Argentina, Colombia and Peru): we give you the information about our processing that you need, and we put the clauses that law requires in place before the transfer starts.

Order of precedence

The mandatory terms of a transfer instrument named above prevail over this agreement and the terms of service. Subject to them, a country annex prevails over the rest of this agreement for that country, and this agreement prevails over the terms of service on personal data.

Contact

Privacy questions and breach contact: support@ospitera.com.