Data Processing Agreement

This Data Processing Agreement (DPA) pursuant to Art. 28 GDPR is concluded between the Customer (controller) and Mykhailo Torcheniuk, Demianiplatz 41, 02826 Görlitz, Germany (processor) upon acceptance of the Terms and Conditions.

1. Subject matter and duration

Processing of guest feedback data as described in Schedule A, for the term of the service agreement.

2. Processing on documented instructions

The processor processes personal data only on the controller’s documented instructions; the service configuration and the Terms and Conditions constitute the initial instructions; further instructions in text form; the processor informs the controller if an instruction appears to infringe the GDPR.

3. Obligations of the processor

• (a) confidentiality of all persons authorised to process data;
• (b) implementation of the technical and organisational measures in Schedule B;
• (c) assistance with data subject requests;
• (d) assistance with security, breach notification, impact assessments and prior consultation (Art. 32–36);
• (e) notification of a personal data breach without undue delay, at the latest within 48 hours of becoming aware;
• (f) deletion or return of all personal data at the end of the service, unless retention is required by law;
• (g) provision of all information necessary to demonstrate compliance and allowing audits, including inspections, conducted by the controller or an auditor mandated by the controller, subject to reasonable notice and once per year unless a breach has occurred.

4. Sub-processors

The controller grants general written authorisation to engage sub-processors; the current list is maintained at reviewchef.eu/subprocessors; the processor notifies the controller by email of intended additions or replacements at least 30 days in advance; the controller may object on reasonable data protection grounds within that period; if no solution is found, the controller may terminate the service agreement; the processor imposes the same data protection obligations on each sub-processor and remains fully liable for their performance.

5. Processor’s own use

The processor may use only anonymised and aggregated data, from which no guest can be identified, for statistics, benchmarking and product improvement. Such data is published or disclosed to third parties only in a form from which neither a guest nor an individual venue can be identified. Any other processing for the processor’s own purposes is excluded.

6. International transfers

Processing takes place within the EU/EEA; transfers to third countries only with appropriate safeguards under Chapter V GDPR and listed on the sub-processor page.

7. Liability

Governed by the liability provisions of the Terms.

8. Final provisions

This DPA prevails over the Terms in data protection matters; amendments require text form; governing law as per the Terms.

Schedule A — Details of processing

• Subject matter — collection, storage and analysis of guest feedback on behalf of the venue;
• Nature of processing — collection via QR-code forms, storage, AI-assisted summarisation, display to the venue, notifications;
• Purpose — enabling the venue to receive and respond to guest feedback and identify service issues;
• Categories of data — ratings, free-text comments, chosen feedback channel, table and time reference, timestamp;
• Categories of data subjects — guests of the Customer;
• Duration — term of the service agreement.

Schedule B — Technical and organisational measures

• hosting exclusively in EU data centres (Germany);
• encryption in transit (TLS 1.2+);
• role-based access control for administrative access;
• deletion of a venue’s guest data when its account is deleted;
• separation of customer data by tenant;
• confidentiality obligations for all persons with access.

Schedule C — Sub-processors

The current list of sub-processors, including purpose, location and transfer safeguards, is published at reviewchef.eu/subprocessors and forms part of this DPA.