Data processing agreement

1. Parties

• Controller (the “Controller”): the Business that accepts the Terms of use, with the details it has declared in its account.
• Processor (the “Processor”): [Company name], Greek tax ID (ΑΦΜ) [ΑΦΜ], [Address], email [email].

2. Subject matter

The Processor processes personal data on behalf of the Controller only to provide the Ombrelo Service: digital menu, QR ordering and payments, bookings, notifications, ratings, shifts, artificial intelligence features and transmission to myDATA, as described in the Terms of use.

3. Duration

This Agreement applies for as long as the Controller uses the Service, and until the return or deletion of the data has been completed in accordance with section 15.

4. Nature and purpose of the processing

Collection, recording, organisation, storage, translation, display to the Controller’s staff, transmission to the sub-processors in section 10, aggregate analysis for the Controller’s statistics and forecasts, and deletion. The sole purpose is serving the guests and operating the Controller’s venue.

5. Types of data

• Anonymous device identifier (a random code on the guest’s device).
• Orders: products, options, notes, spot, time, status, amounts.
• The guest’s language.
• Anonymous menu usage events, together with the allergen filters the guest selects.
• Phone number or browser notification subscription, only if the guest asks to be notified.
• Payments through Stripe: amounts, tips, transaction IDs. The card number does not pass through the Processor.
• Bookings: name, phone number or email, date, spot, prepayment.
• Ratings and comments.
• Texts processed by AI: messages to the AI waiter, order notes.
• Shift details of the Controller’s staff (names, hours), if used.
• Technical data: IP address, browser type.

The Service is not intended for special categories of data (Article 9 GDPR). Allergen filters are linked only to the anonymous identifier. The Controller does not ask guests for health information through free-text fields.

6. Categories of data subjects

• Guests and visitors of the Controller’s venue.
• Guests who make a booking.
• The Controller’s staff, as regards the shift details that the Controller enters.

The data of dashboard user accounts (owner, staff) is processed by the Processor as a controller, in accordance with the Privacy policy, and is not covered by this Agreement.

7. The Controller’s instructions

• The Processor processes the data only on documented instructions from the Controller. The instructions are this Agreement, the Terms of use, and the settings and choices the Controller makes in the Service (e.g. enabling payments, notifications, bookings or myDATA).
• If the Processor considers that an instruction infringes the GDPR or another provision, it informs the Controller immediately.
• The Processor does not use the data for its own purposes, except for aggregate, anonymous statistics for operating and improving the Service, and does not sell the data or use it for advertising.
• If the law requires the Processor to process data (e.g. a request from a public authority), it informs the Controller first, unless this is prohibited.

8. Confidentiality

The Processor ensures that everyone with access to the data is bound by a duty of confidentiality. The Processor’s staff access the Controller’s account only for support, security, fraud prevention and quality control; this access is recorded in an internal log, is read-only by default and expires automatically, as set out in the Terms of use.

9. Technical and organisational measures

The Processor applies the measures of Article 32 GDPR, including:

• encryption in transit (HTTPS/TLS),
• storing passwords only as a cryptographic hash (bcrypt),
• logical separation of each business’s data and permission checks on every request,
• user roles with the minimum necessary permissions,
• logging of support staff access, which is read-only by default,
• rate limiting on the public endpoints of the Service,
• processing of card details exclusively by Stripe (PCI DSS certified),
• data minimisation: guests do not give a name or email in order to order,
• regular backups [frequency and location of backups].

10. Sub-processors

The Controller gives the Processor general authorisation to use the sub-processors below. The Processor binds them to the same data protection obligations and remains responsible for them. For every new or replacement sub-processor, the Processor informs the Controller at least 30 days in advance, and the Controller may object on reasonable grounds; if no solution is found, the Controller may terminate the agreement without penalty.

11. Transfers outside the EEA

Where a sub-processor processes data outside the EEA, the transfer relies on the adequacy decision for the EU–US Data Privacy Framework (where the provider is certified) or on the European Commission’s standard contractual clauses, with supplementary measures where needed.

12. Assistance to the Controller

• The Processor helps the Controller respond to requests from data subjects (access, rectification, erasure, portability, objection). If it receives such a request directly, it forwards it to the Controller without delay.
• It assists the Controller with the obligations of Articles 32 to 36 GDPR (security, notification of breaches, impact assessment, prior consultation), taking into account the nature of the processing and the information available to it.

13. Data breaches

If the Processor becomes aware of a personal data breach affecting the Controller’s data, it informs the Controller without undue delay and in any case within 48 hours. The notice includes, as far as available: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact person. The Processor cooperates with the Controller so that the Controller can notify the Hellenic Data Protection Authority (ΑΠΔΠΧ) within 72 hours, where required.

14. Information and audits

The Processor makes available to the Controller the information needed to demonstrate compliance with Article 28. The Controller may request an audit, carried out by itself or by an independent auditor bound by confidentiality, with at least 30 days’ written notice, during business hours and without disrupting the operation of the Service. As a rule, an audit is first carried out through a written questionnaire and documentation. [Cost and frequency of audits, e.g. up to once a year]

15. Return or deletion

When use of the Service ends, the Controller may, within 30 days, request a copy of its data in a common electronic format. After that, the Processor deletes the data, including backups, within [90 days], except for whatever it must keep by law. The data on guests’ devices (anonymous identifier, cart) is erased when the guests clear their browser data.

16. Other terms

• In case of conflict between this Agreement and the Terms of use, this Agreement prevails as regards data protection.
• The parties’ liability is governed by Article 82 GDPR and the limitations in the Terms of use, to the extent permitted by law.
• Greek law applies.