Restaurant Data Processing Agreement

1. Roles

You (the restaurant) are the controller of the personal data of your customers and staff that you or your customers enter into Easy Fuud. Easy Fuud ("we") is your processor under Article 28 of the GDPR. This agreement applies for as long as we process that data for you, and continues after your subscription ends until the data is deleted or returned under clause 9.

2. What we process

• Purpose and nature: providing the Easy Fuud service — online ordering, table and kiosk ordering, POS, kitchen display, payments, receipts, reporting, and the integrations you switch on.
• Data subjects: your customers, your staff, and contacts you import.
• Personal data: names, phone numbers, email addresses, delivery addresses, order contents and notes, payment references (never full card numbers), staff names and till PINs, clock-in records, and marketing-consent flags.
• Special category data: none is required. Do not ask customers to put health information in order notes. Allergen information is about dishes, not people.

3. Your instructions

We process the data only on your documented instructions. Those instructions are these terms, the settings you choose in the dashboard, and any written request you send us. We do not process it for our own purposes, except where the law requires us to, in which case we will tell you first unless the law forbids it. If we think an instruction breaks data protection law, we will tell you.

4. Confidentiality

Everyone at Easy Fuud who can access your data is bound by confidentiality, and access is limited to people who need it to run or support the service.

5. Security

We apply the measures required by Article 32. These include encryption in transit, encryption at rest for payment credentials and authenticator secrets, hashed passwords, two-factor sign-in for restaurant and admin accounts, tenant isolation tested automatically on every release, audit logging, daily backups, and documented retention limits.

6. Sub-processors

You give us general authorisation to use the sub-processors listed below. Before adding or replacing one, we will tell you by email at least 30 days in advance. If you object on reasonable data-protection grounds and we cannot resolve it, you may cancel without penalty. Each sub-processor is bound by data protection terms at least as protective as these.

7. International transfers

We store your data on servers in the European Union. It leaves the EU only (a) to sub-processors listed above that operate outside it, under the EU-U.S. Data Privacy Framework where the provider is certified, or otherwise the European Commission's Standard Contractual Clauses; (b) to payment providers you choose; and (c) to you.

Restaurants outside the EU: where you are established outside the EU, transfers from us to you are governed by the Standard Contractual Clauses, Module 4 (processor to controller), which are incorporated into this agreement by reference. You remain responsible for complying with your own country's data protection law for your customers, including any registration with your local regulator.

8. Helping you

• Rights requests: customers can download or delete their own data at easyfuud.com/account/privacy. If a request reaches us that is about your data, we will pass it to you within 5 working days and help you answer it.
• Personal data breaches: we will tell you without undue delay, and within 48 hours of becoming aware of a breach affecting your data. We will include what we know and update you as we learn more, so you can meet your own 72-hour duty to notify the regulator.
• Impact assessments and consultation: we will give you the information you reasonably need for a DPIA or a consultation with a regulator.

9. When the service ends

You can export your data from the dashboard at any time (backups and reports). When your restaurant is deleted, it is removed permanently after 30 days, unless you ask us to restore it within that time. The exceptions are records the law requires us to keep, such as tax and VAT records for six years. Those are kept without customer contact details once the period in our Privacy Policy ends.

10. Audits

We will make available the information needed to show we comply with Article 28. That includes our monthly automated data protection review and security review reports, on request. We will also allow and contribute to an audit by you or an auditor you appoint, on 30 days' notice, at most once a year, unless a regulator requires one or a breach has occurred.

11. Contact

Data protection questions: privacy@easyfuud.com. If this agreement conflicts with the Platform Subscription Terms on a data protection point, this agreement wins.