FRContact us

Data Processing Addendum

Last updated: October 13, 2026

This Data Processing Addendum ("DPA") forms part of the agreement betweenService (SAS) ("Service", "Processor") and the restaurant subscribing to the Service platform ("Client", "Controller").

This DPA reflects the parties' obligations under the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Roles

The Client is the Controller and Service is the Processorwithin the meaning of Article 28 GDPR. Service processes Personal Data solely on behalf of the Client and under the Client's documented instructions.

2. Scope of processing

  • Subject matter: provision of the Service reservation management platform and, where applicable, hosting and serving of the Client's Website (Article 9 bis of the GTS)
  • Duration: term of the agreement + retention periods (see §9)
  • Nature and purpose: storage, organization, retrieval, and transmission of reservation and guest management data; for the Website, forwarding to the Client of messages sent through its contact form and recording of sign-ups to its newsletter
  • Categories of data subjects: restaurant guests (diners), restaurant staff members, visitors to the Client's Website who use its forms

3. Processor's obligations

  • Process Personal Data only on documented instructions from the Controller
  • Ensure confidentiality of persons authorized to process the data
  • Implement the technical and organizational measures described below
  • Comply with sub-processor requirements
  • Assist the Controller in responding to data subject requests
  • Assist the Controller with obligations under Articles 32-36 GDPR
  • Return and then delete Personal Data at the end of the service (see §9)

4. Data breach notification

The Processor shall notify the Controller without undue delay, and in any event within48 hours, after becoming aware of a Data Breach.

5. Sub-processors

The Controller grants the Processor a general written authorization to engage Sub-processors. The current list is available at /en/legal/sub-processors. The Processor notifies the Controller by email at least 15 days before any change.

6. Data subject rights

The Processor assists the Controller in responding to data subject requests (access, rectification, erasure, restriction, portability, objection). If a data subject contacts the Processor directly, the Processor forwards the request to the Controller.

7. International transfers

Personal Data is stored and processed within the European Union (Google Cloud Platform, europe-west9 region, Paris). Transfers outside the EEA are covered by Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework.

8. Audits

The Controller may audit compliance with this DPA once per calendar year, with 20 business days' notice. Audits may be conducted remotely or on-site, during normal business hours.

9. Retention and deletion

At the end of the agreement, whatever the cause, the Processor keeps the Personal Data for 12 months, so that the Controller can resume the service and find it intact; the Controller may request its export during that period. When it expires, or earlier at the Controller's request, the Processor deletes the Personal Data, subject to legal retention obligations.

Annex 1 — Categories of personal data

Guest data

  • Identity: first name, last name
  • Contact: email, phone
  • Health: allergies, dietary preferences (Article 9 GDPR)
  • Behavioral: visit history, no-shows, cancellations
  • Preferences: VIP, blacklist, language
  • Marketing consent: email and SMS with timestamps

Website visitor data

  • Contact form: name, email, phone, message — forwarded to the Client by email
  • Newsletter sign-up: email, first name, timestamped marketing consent — recorded among the Client's guests

Staff data

  • First name, last name, email, role, permissions, authentication tokens

Annex 2 — Technical and organizational measures

Infrastructure security

  • Hosting on GCP europe-west9 (Paris)
  • Encryption at rest AES-256, in transit TLS 1.2+
  • Network isolation: private VPC for database and cache
  • Secret management: Google Secret Manager + External Secrets Operator

Application security

  • JWT authentication with token rotation and theft detection
  • Passwords: bcrypt
  • Mobile credentials: iOS Keychain (hardware-backed encryption)
  • Authorization: 5-tier role hierarchy
  • Immutable audit log for every reservation status change

Operational security

  • IAM-based access control, Workload Identity Federation
  • GitOps deployment (Flux v2)
  • Automated backups, point-in-time recovery
  • Continuous monitoring, Slack alerts