Accord de traitement des données

1.1. This Data Processing Agreement (the “DPA”) forms part of the agreement between Vrodex, Obrechtstraat 55-D, 2517VM The Hague, the Netherlands (“Vrodex”), and the customer that uses the Vrodex Products (the “Customer”), as set out in the Terms of Service (the “Agreement”). Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given to them in the General Data Protection Regulation (EU) 2016/679 (the “GDPR”).

1.2. This DPA applies to the personal data that Vrodex processes on behalf of the Customer when providing the Products. For this personal data, the Customer is the controller and Vrodex is the processor.

1.3. This DPA does not apply to personal data for which Vrodex itself determines the purposes and means, such as the details of the Customer’s account, invoicing, support and the registration of phone numbers. Vrodex processes that data as a controller in accordance with its Privacy Policy, available at https://www.vrodex.com/privacy-policy.

2.1. Vrodex processes personal data only to provide the Products the Customer has subscribed to, such as the point-of-sale system, bookings, online ordering, payments, customer relationship management, staff planning and the phone assistant, and to provide the related support, maintenance and security.

2.2. The processing consists of collecting, storing, organising, consulting, transmitting, combining and deleting personal data, as far as needed for the Products. The processing lasts as long as the Agreement, plus the period needed to return and delete the data under article 12.

2.3. Depending on the Products used, the processing concerns the following categories of data subjects:

• Guests and customers of the Customer, including people who make a booking, place an order, make a payment or call or message the Customer
• Employees and other users who work with the Products on behalf of the Customer
• Suppliers and other business contacts of the Customer

2.4. Depending on the Products used, the processing concerns the following categories of personal data:

• Contact details, such as name, email address, phone number and address
• Booking and order details, such as date, time, number of guests, ordered items, notes and preferences
• Payment and transaction details, such as amounts, payment method and transaction references; full card numbers are handled by the payment provider and not by Vrodex
• Communication, such as emails, text and WhatsApp messages, and, when the phone assistant is used, call recordings, transcripts and summaries
• Employee details, such as name, role, login and PIN details, shifts, clock times and actions performed in the Products
• Technical details, such as IP address, device details and log data

2.5. The Products are not designed for special categories of personal data. Where the Customer chooses to record such data, for example allergies or dietary requirements in a booking note, the Customer is responsible for having a lawful basis for doing so and for limiting it to what is necessary.

3.1. Vrodex processes personal data only on the documented instructions of the Customer, unless it is required to do otherwise by Union or Member State law; in that case Vrodex informs the Customer before processing, unless that law prohibits this.

3.2. The Agreement, this DPA and the settings and actions of the Customer and its users in the Products together form the Customer’s instructions. Further instructions must be given in writing and must be technically feasible within the Products.

3.3. Vrodex informs the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.

4.1. Vrodex ensures that persons authorised to process the personal data, including its employees and contractors, have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they only have access to the personal data as far as their work requires.

5.1. Vrodex implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as referred to in article 32 GDPR. These include:

• Encryption of data in transit and at rest with our hosting providers
• Access to personal data limited to authorised personnel, with role-based access controls in the Products
• Separation of the data of different customers
• Regular backups and the ability to restore data
• Logging and monitoring to detect errors and security incidents
• Keeping software and infrastructure up to date

5.2. Vrodex may change these measures, provided that the overall level of security is not reduced.

6.1. The Customer gives Vrodex general written authorisation to engage sub-processors, such as providers of hosting and infrastructure, payment processing, error monitoring, analytics, and communication services such as email, text messages, telephony and speech technology. A current list of sub-processors, with their location and the services they provide, is available on request at privacy@vrodex.com.

6.2. Vrodex informs the Customer at least 14 days in advance, by email or by a message in the Products, before it adds or replaces a sub-processor. The Customer may object on reasonable grounds relating to data protection within that period. Vrodex then makes reasonable efforts to address the objection. If no solution is found, the Customer may terminate the Products affected by the change, without any further obligation, before the change takes effect.

6.3. Vrodex imposes on each sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA. Vrodex remains fully liable to the Customer for the performance of the obligations of its sub-processors.

7.1. Vrodex only transfers personal data to, or allows access from, countries outside the European Economic Area when the requirements of chapter V of the GDPR are met: on the basis of an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified companies, or on the basis of the standard contractual clauses approved by the European Commission, with additional measures where necessary.

8.1. Vrodex assists the Customer, taking into account the nature of the processing, in responding to requests from data subjects to exercise their rights. Where possible, the Products allow the Customer to do this itself, for example by viewing, exporting, correcting or deleting data. If Vrodex receives a request directly, it forwards the request to the Customer without undue delay and does not respond to it itself, unless the Customer instructs it to.

8.2. Vrodex also assists the Customer, as far as reasonably possible and taking into account the information available to it, in complying with its obligations regarding security, personal data breaches, data protection impact assessments and prior consultation with the supervisory authority.

9.1. Vrodex notifies the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach that affects the Customer’s personal data.

9.2. As far as available, the notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and limit its effects. Where not all information is available at once, Vrodex provides it in phases.

9.3. The Customer decides whether to notify the supervisory authority and data subjects. Vrodex does not do so on the Customer’s behalf, unless required by law.

10.1. Vrodex makes available to the Customer the information reasonably needed to demonstrate compliance with this DPA.

10.2. If that information is not sufficient, the Customer may have an audit carried out, at most once a year, by an independent auditor bound by confidentiality, with at least 30 days’ notice, during normal business hours and without unreasonably disrupting Vrodex’s operations. The costs of the audit are borne by the Customer, unless the audit shows that Vrodex has materially failed to comply with this DPA.

11.1. Vrodex does not keep personal data longer than needed to provide the Products, or than the Customer has set in the Products. For example, the Customer chooses how long recordings, transcripts and caller details of the phone assistant are kept, from 7 to 90 days, after which they are deleted automatically.

12.1. During the term of the Agreement, the Customer can export its data from the Products. After the Agreement ends, Vrodex deletes the personal data it processes on behalf of the Customer within 90 days, unless Union or Member State law requires Vrodex to keep it. At the Customer’s request, made before the Agreement ends, Vrodex provides a copy of the data in a common format.

12.2. Copies in backups are deleted in the normal backup cycle and are not used for any other purpose in the meantime.

13.1. The limitations of liability in the Agreement apply to this DPA, unless the law does not allow this.

14.1. This DPA applies for as long as Vrodex processes personal data on behalf of the Customer. Obligations that by their nature continue after the end, such as confidentiality and deletion, remain in force.

14.2. If this DPA and the Agreement conflict on the processing of personal data, this DPA prevails.

14.3. Vrodex may change this DPA, for example to comply with changes in the law. Vrodex informs the Customer of material changes in advance. Changes never reduce the level of protection of the personal data.

14.4. This DPA is governed by the same law as the Agreement, and disputes are settled as set out in the Agreement.

15.1. Questions about this DPA, requests for the list of sub-processors and notifications under this DPA can be sent to privacy@vrodex.com.