Venview

Data Processing Agreement

Version: 2026-06-09-draft

DRAFT — pending legal review. Not yet a binding agreement; placeholders below are filled before this goes live.

This Data Processing Agreement (“DPA”) governs our processing of personal data on your behalf under the GDPR. You (the restaurant) are the Controller of your guests’ personal data; we are the Processor, processing it only to provide the Service on your documented instructions.

1. Scope & roles

We process guest personal data (names, contact details, reservation and order history, notes, and any dietary/allergy information) solely to operate the Service for you. You are responsible for having a lawful basis for the data you put into the Service.

2. Our obligations

Process personal data only on your documented instructions.
Keep it confidential and apply appropriate security (GDPR Art. 32) — encryption in transit and at rest, access controls, audit logging.
Assist you with data-subject requests (the Service provides export and erasure tools), breach notification, and DPIAs.
Delete or return personal data at the end of the Service, subject to legal retention.
Notify you without undue delay of any personal-data breach.

3. Sub-processors

You authorise us to engage the sub-processors listed in our Privacy Policy (cloud hosting, email, payments, and — for the AI email feature — the AI providers). We bind each to data-protection terms no less protective than this DPA and give notice of changes, so you can object.

4. International transfers

Where a sub-processor processes data outside the EEA, we rely on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, as described in the Privacy Policy.

5. Term

This DPA applies for as long as we process personal data on your behalf.

Full agreement with annexes (processing details, security measures, sub-processor list) is available on request and maintained alongside our compliance documentation.