Data Processing Agreement

1. Parties

• Controller: the Customer under the Terms and Conditions (the business).
• Processor: upIT s. r. o., registered office Pribinova 17954/10, 811 09 Bratislava, Slovakia, company ID (IČO) 35 947 713, tax ID (DIČ) 2022045432, VAT ID SK2022045432, registered in the Commercial Register of the Bratislava III Municipal Court, section Sro, file no. 36984/B.

2. Subject, purpose and duration of processing

• Purpose: analyses of point-of-sale and cost data, QR menu statistics, QR campaigns with private feedback and digital loyalty cards — solely to provide the ordered service to the controller.
• Duration: for the term of the service contract and until the data are deleted or returned after it ends.

3. Categories of data subjects and data

• The controller’s staff: name or staff label in the point-of-sale export, sales, voids and discounts by staff member, shifts; wages if the controller provides them.
• Guests — loyalty cards: name, email, optionally phone and day and month of birth, consents, visit history.
• Guests — QR campaigns: feedback text, rating and a voluntarily entered contact.
• Guests — QR menu: a daily pseudonymous identifier (derived from the IP address and browser details, which are not stored), language, source and table number from the QR code, time rounded to the minute; only until they are merged overnight into daily totals without an identifier.
• We do not process special categories of data (for example health data); the controller will not provide them.

4. Processor’s obligations

• We process data only on the controller’s documented instructions; these are the Terms and Conditions, the order and the settings in the app. If we consider an instruction unlawful, we say so.
• Persons with access to the data are bound by confidentiality.
• We take appropriate technical and organisational measures: encrypted connections, passwords stored as hashes, role-based access, access records, hosting in the EU, daily backups; we do not send guests’ names to AI services and the AI provider may not use the data to train models.
• At the controller’s request we replace staff names in Outputs with codes.
• We help the controller handle data subjects’ requests and meet its obligations under Art. 32 to 36 GDPR.
• We notify the controller of a personal data breach without undue delay after becoming aware of it, so that the controller can report it to the authority within the statutory 72 hours.
• We provide the controller with the information needed to demonstrate compliance with this agreement and allow an audit after prior notice, at most once a year.

5. Sub-processors

The controller gives general authorisation for these sub-processors: Railway (hosting and database, EU), Resend (emails to guests, e.g. “Your card”) and Anthropic (Claude on a commercial plan under Anthropic’s commercial terms, in which we analyse point-of-sale data and store the point-of-sale exports in a project; USA, transfer based on standard contractual clauses or the EU–US Data Privacy Framework, data not used for training). We announce changes to this list by email at least 30 days in advance; the controller may object and, if it disagrees, terminate the contract.

6. Controller’s obligations

• It has a legal basis for providing the data and has informed the data subjects (staff, guests) about the processing.
• It provides only data needed for the service.

7. Termination and deletion of data

After the service ends, we return or delete the data at the controller’s choice, within 90 days at the latest, unless the law requires further storage. In backups they are deleted when the backup period expires (89 days). Guest data from loyalty cards, feedback and the QR menu are also deleted continuously according to the periods in the Privacy Policy.