This Data Processing Agreement ("DPA") forms part of the terms and conditions between you ("Controller") and ZAHA Global GmbH ("Processor") for the RestroManage service. It incorporates the mandatory requirements of Art. 28 GDPR.
1. Parties
Controller: the customer that uses RestroManage and determines the purposes and means of processing personal data within the service.
Processor: ZAHA Global GmbH, Adolfstraße 32, 52134 Herzogenrath, Germany. Register court: Amtsgericht Aachen, HRB 27903. Contact: support@restromanage.com.
2. Subject matter and duration
The Processor processes personal data on behalf of the Controller solely to provide, operate, support and secure the RestroManage software as a service, as described in the main contract and our privacy policy.
Processing lasts for the term of the main contract and for any retention period required by law after termination, after which data is deleted or returned as set out in section 11.
3. Nature and purpose of processing
Processing includes collection, storage, organisation, retrieval, transmission, restriction and erasure of personal data as needed to run restaurant operations features (orders, menus, tables, payments, reporting, staff accounts and related support).
The Processor processes data only on documented instructions from the Controller, including this DPA and the configuration the Controller sets in the product, unless required to do otherwise by Union or Member State law.
4. Types of data and data subjects
Categories of data subjects may include the Controller's staff, contractors, and end customers of the Controller's venues.
Types of personal data may include names, contact details, order and reservation data, payment-related metadata (not full card numbers where a PCI-compliant provider handles them), device and usage logs necessary for security and support, and any other data the Controller chooses to enter into the service.
5. Obligations of the Processor
- Process personal data only on documented instructions from the Controller
- Ensure persons authorised to process the data are bound by confidentiality
- Implement appropriate technical and organisational measures under Art. 32 GDPR
- Engage sub-processors only under section 7
- Assist the Controller with data-subject requests, DPIAs and supervisory authority enquiries, taking into account the nature of processing
- Delete or return personal data after the end of processing services, as set out in section 11
- Make available information necessary to demonstrate compliance with Art. 28 GDPR and allow audits under section 12
6. Obligations of the Controller
The Controller warrants that it has a lawful basis for the processing it instructs, that notices to data subjects are accurate, and that instructions given to the Processor are lawful. The Controller remains responsible for the accuracy of data entered into the service.
7. Sub-processors
The Controller generally authorises the Processor to engage sub-processors that provide infrastructure, communications or support services necessary to operate RestroManage. Current categories include hosting (Contabo GmbH in Germany), payment processing, transactional email and push notifications — listed in the privacy policy.
The Processor will impose data-protection obligations on each sub-processor equivalent to those in this DPA. The Processor remains liable to the Controller for the sub-processor's performance.
The Processor will inform the Controller of intended changes to sub-processors in a manner that allows the Controller to object on reasonable data-protection grounds before the change takes effect.
8. Security measures
The Processor maintains technical and organisational measures appropriate to the risk, including encryption in transit, access controls, least-privilege administration, logging, backups, and staff confidentiality obligations. Measures are reviewed as threats and the service evolve.
9. Personal data breaches
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and will provide information reasonably required for the Controller to meet its Art. 33 / 34 GDPR duties.
10. Assistance with data-subject rights
Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests for exercising the data subject's rights under Chapter III GDPR.
11. Return and deletion
At the choice of the Controller, the Processor will delete or return all personal data after the end of the provision of processing services, and delete existing copies, unless Union or Member State law requires storage.
12. Audits and information
The Processor will make available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR and will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice, confidentiality and operational safeguards.
13. International transfers
Product and customer data for the RestroManage service is stored on servers in Germany. Where a transfer outside the EEA is necessary (for example a sub-processor), the Processor ensures an adequate level of protection via an adequacy decision, standard contractual clauses, or another valid Art. 46 GDPR mechanism.
14. Liability
Liability under this DPA follows the limitation-of-liability provisions of the terms and conditions, without limiting liability that cannot be limited by law.
15. Final provisions
In case of conflict between this DPA and the main contract on data-protection matters, this DPA prevails. German law applies. The place of jurisdiction is Aachen, Germany, to the extent permitted by law.
Questions about this DPA: support@restromanage.com.