Data processing agreement

The parties and their roles

The venue operator, [Venue controller name and address], is the controller. Arhitektura RN d.o.o., Bolnička cesta 51/9, 10000 Zagreb, Croatia, OIB 98057286129, is the processor, referred to here as menyu. The venue decides the purposes of processing guest data; menyu processes it on the venue’s behalf.

Subject matter, purpose and duration

The subject matter is the venue’s use of menyu to receive and manage table orders, support menu questions and record payment status where payments are enabled. Processing includes collecting, recording, organising, storing, retrieving, transmitting and deleting the necessary data.

Processing lasts for the venue agreement and the agreed return or deletion period: [Deletion or return period to confirm]. Processing is limited to delivering these services under the venue’s documented instructions.

Data and people covered

Data subjects are guests at the venue. Data includes table number, basket contents, orders, optional tip, payment status and Wally questions. Guests do not need an account. The service is not intended to collect health data; allergy questions should be handled directly by venue staff. Handling of any sensitive information inadvertently submitted: [to confirm].

Documented instructions

menyu will process personal data only on the venue’s documented instructions, including instructions about international transfers, unless applicable law requires otherwise. If the law requires other processing, menyu will inform the venue before processing unless the law prohibits that notice. menyu will immediately inform the venue if an instruction appears to infringe applicable data protection law.

Confidentiality

menyu will ensure that people authorised to process guest data are bound by confidentiality obligations or an appropriate statutory duty. Access will be limited to what is needed for their assigned work.

Security measures

menyu will apply technical and organisational measures appropriate to the risk under Article 32 of the GDPR. The measures to be documented before live processing cover access controls and least privilege, secure transmission, protection of stored data, backups and recovery, logging, patching, incident handling and regular checks of effectiveness.

The verified measures, hosting arrangements, recovery procedures and review frequency are [Security measures to confirm]. This summary does not assert that unverified controls are already implemented.

Sub-processors

Proposed providers, to the extent they process guest data on menyu’s behalf: [Hosting provider], [Payment provider], [Certified till partner], [AI provider for Wally] and [Email provider]. Their processing roles, locations and activities are [Sub-processor register to confirm]. A provider acting as an independent controller is not a sub-processor for that activity.

The venue’s authorisation will cover the agreed list. menyu will give prior written notice of intended additions or replacements so the venue can object before the change. Notice period and objection procedure: [to confirm]. menyu will impose equivalent data protection obligations by contract and remain responsible for its sub-processors’ performance of those obligations.

International processing locations and any required transfer safeguards must be agreed before the transfer: [Countries and international transfers to confirm]; [Transfer safeguards to confirm].

Assisting the venue

Taking account of the nature of processing, menyu will help the venue respond to data subject requests using appropriate technical and organisational measures. A request received directly from a guest will be passed to the venue without undue delay and answered only on its instructions unless law requires otherwise.

Taking account of the information available to it, menyu will also assist with the venue’s obligations concerning security, breach notifications, data protection impact assessments and prior consultation with a supervisory authority under Articles 32 to 36 of the GDPR.

Personal data breaches

menyu will notify the venue without undue delay after becoming aware of a personal data breach. It will provide available details of the nature of the breach, affected data and people, likely consequences, contact point and measures taken or proposed. Further information may follow as it becomes available. Incident contact: [Contact email].

Return or deletion

At the venue’s choice, menyu will return or delete personal data after the service ends and delete existing copies unless law requires retention. Return format, deletion deadline and backup expiry: [to confirm]. Data retained solely because of a legal duty will be restricted to that purpose.

Information and audits

menyu will make available the information needed to demonstrate compliance with Article 28 and allow and contribute to audits, including inspections, by the venue or its mandated auditor. Practical arrangements: [to confirm]. Those arrangements must not prevent the venue from exercising its audit rights. Contact [Contact email] to arrange an audit or request information.