Data Processing Agreement

1. Roles

For restaurant customer/order data, the restaurant operator is the controller and GastroGrowth is the processor. GastroGrowth will process personal data only on documented instructions from the controller, including these terms, order forms, platform configuration, and support requests.

2. Processing Details

• Subject matter: hosted restaurant ordering, customer app, business/admin app, app factory, support, integrations, analytics, security, and related platform services.
• Duration: the subscription or service term plus any migration, retention, backup, legal hold, dispute, accounting, or deletion period required by law or agreed instructions.
• Nature and purpose: collect, host, store, retrieve, transmit, display, secure, analyze, delete, export, and support personal data needed to provide the services.
• Data subjects: restaurant customers, prospective customers, loyalty members, website/app visitors, restaurant staff, business contacts, support contacts, delivery recipients, and integration users.
• Data categories: identity, contact, account, authentication, order, cart, delivery address, pickup, loyalty, marketing consent, preferences, allergen notes, payment references, device, log, support, and business configuration data.
• Special categories: optional allergy or dietary information may be processed where the restaurant enables or receives it and has a lawful basis or explicit consent where required.

3. GastroGrowth Processor Obligations

• Process personal data only on documented instructions unless law requires otherwise.
• Ensure personnel authorized to process personal data are bound by confidentiality obligations.
• Use appropriate technical and organizational security measures considering the nature, scope, context, and risk of processing.
• Maintain a subprocessors page and use general authorization for subprocessors needed to provide the services, with notice of material changes where required.
• Remain responsible for subprocessors to the extent required by GDPR Article 28.
• Assist the controller with data subject requests, security obligations, DPIAs, prior consultations, breach response, and deletion/export requests, taking into account the nature of processing and available information.
• Notify the controller without undue delay after becoming aware of a personal data breach affecting controller personal data.
• At the controller's choice and subject to legal retention, delete, anonymize, or return personal data after the services end.
• Make information reasonably necessary to demonstrate compliance available and allow reasonable audits under confidentiality, security, and operational limits.

4. Controller Obligations

• Provide lawful, documented instructions and ensure they comply with data protection law.
• Maintain privacy notices, lawful bases, consent records, marketing permissions, retention rules, and customer request workflows.
• Do not instruct GastroGrowth to process unlawful, excessive, inaccurate, or unnecessary personal data.
• Review platform configuration, staff access, exports, integrations, store disclosures, and third-party services enabled by the restaurant.
• Respond to data subject requests and regulator communications unless GastroGrowth is legally required to respond directly.

5. Technical And Organizational Measures

• Tenant-aware access control and role-based administration.
• Authentication controls, password policy enforcement, email verification, captcha where configured, and session controls.
• Encryption in transit using HTTPS/TLS and encryption at rest where provided by the database, storage, device, or hosting provider.
• Least-privilege internal access, logging, monitoring, and separation of production access from routine development where practical.
• Backups, deployment controls, incident response, vulnerability patching, and provider monitoring appropriate to the service tier.
• Subprocessor due diligence proportionate to the risk and service dependency.

6. Subprocessors

The current subprocessor list is maintained at /subprocessors. The restaurant operator gives GastroGrowth general authorization to use subprocessors needed to provide, secure, support, and improve the services. GastroGrowth will impose data protection obligations on subprocessors that are materially equivalent to this DPA.

7. International Transfers

Where personal data is transferred outside the EEA, United Kingdom, or Switzerland, GastroGrowth will use an adequacy decision, Standard Contractual Clauses, or another valid transfer mechanism where required.

8. Order Of Precedence

If this DPA conflicts with the Restaurant Platform Terms, this DPA controls for processing of controller personal data. A signed negotiated DPA controls over this public DPA for the restaurant operator that signed it.