Data Processing Agreement (Art. 28 GDPR)

1. Parties

Processor: [Pending: legal name] (tax ID [Pending: tax ID]), registered office [Pending: registered office], [Pending: registry data], email [Pending: contact email]. Privacy contact: [Pending: privacy contact / DPO].

Controller: the Customer holding the subscription, as identified in its account.

2. Subject matter, duration and nature of the processing

Subject matter: providing the Allunora service (website and ordering, floor, kitchen, reservations, loyalty, reviews, staff and time recording, inventory, analytics and AI).

Duration: the subscription term, plus the return and deletion period in clause 10.

Data subjects: customers and visitors of the restaurant's website, diners, people who book, loyalty members, the restaurant's employees and suppliers.

Data: identity and contact data, delivery addresses, orders and amounts, reservations, loyalty points, reviews, employment data (time records, shifts, absences, documents), messages to the assistant, technical browsing data (with consent) and, occasionally, allergy information the data subject chooses to give.

3. Processor obligations (Art. 28(3) GDPR)

• a) Process the data only on documented instructions from the controller (these terms and the configuration the Customer sets in the platform), including for international transfers, unless the law requires otherwise, in which case it informs the controller first.
• b) Ensure that persons authorised to process the data have committed to confidentiality or are under a statutory obligation of confidentiality.
• c) Take the security measures required by Art. 32 GDPR, described in Annex II.
• d) Respect the conditions for engaging other processors (clause 4).
• e) Assist the controller, by appropriate technical and organisational measures, in responding to requests to exercise data subject rights (access, rectification, erasure, objection, restriction, portability). The platform can export and anonymise one person's orders and reservations.
• f) Assist the controller with its obligations under Arts. 32 to 36 GDPR: security, breach notification, impact assessments and prior consultation.
• g) At the controller's choice, return or delete the data at the end of the service (clause 10).
• h) Make available to the controller the information needed to demonstrate compliance and allow for audits (clause 7).

4. Sub-processors

The controller gives Allunora a general authorisation to engage the sub-processors in the published list (/platform-legal/subprocessors).

Allunora gives at least 30 days' notice of any new or replacement sub-processor. The controller may object on reasonable grounds; if no solution is found, it may terminate without penalty.

Allunora imposes the same data protection obligations on each sub-processor by contract and remains liable for them.

5. International transfers

Some AI features are provided by Anthropic PBC (USA). Transfers rely on the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Allunora minimises the data sent to AI models.

6. Personal data breaches

Allunora notifies the controller without undue delay, and in any case within 48 hours of becoming aware, of any personal data breach, with the information available (nature, categories and approximate number of data subjects, likely consequences and measures taken), so that the controller can notify the authority within 72 hours where required.

7. Audits

The controller may request the documentation demonstrating compliance and, with reasonable notice and without affecting other customers or the security of the platform, carry out or commission an audit. Audit costs are borne by the controller unless a material breach is found.

8. Controller obligations

The controller warrants that it has a legal basis for the processing it entrusts, informs its customers and employees (the platform offers legal pages and a staff notice) and configures optional features (marketing, AI, WhatsApp) lawfully.

9. Retention periods

By default the platform applies these periods:

• AI prompt and output text (AI proxy logs): cleared after 30 days; only tokens and cost are kept.
• Public website assistant chats: deleted after 90 days. Staff copilot chats: 12 months.
• Notification template data: cleared after 90 days; send logs deleted after 24 months.
• Customer personal data on orders (pickup, delivery, WhatsApp, table, kitchen): anonymised after 24 months (amounts are kept for tax). Customer data on kitchen tickets: cleared 7 days after the ticket closes.
• Free-text fields that may contain health data (special requests, delivery instructions, notes, allergen alerts): cleared 30 days after the service day.
• Reservations: anonymised 12 months after the reservation date.
• Verification codes and links: deleted 7 days after expiry.
• Resolved support reports and their screenshots: deleted after 90 days.
• Audit logs: 3 years. First-party analytics: 13 months (the customer id is erased when the customer deletes their account).
• Staff leavers: national id, emergency contact, phone, photo and plate cleared on removal; time records, shifts, absences and documents deleted 4 years after the leave date.

10. Return and deletion at the end

When the subscription ends, the controller has 30 days to download a full export. Afterwards Allunora deletes the data (except where the law requires it to be kept) and issues a deletion certificate.

Annex II — Technical and organisational measures

Measures in place:

• Tenant isolation: the API gateway drops any identity header sent by the client and derives the venue from the session; every query filters by tenant and venue.
• Internal services, database, Redis and storage are not exposed to the Internet; internal routes are unreachable from outside.
• TLS encryption on every public domain.
• Passwords and PINs hashed with bcrypt; distinct session secrets per environment.
• Encryption (Fernet) of each venue's POS, mail and Stripe credentials.
• Verified signatures on Stripe webhooks.
• Explicit CORS origin list.
• Platform admin impersonation is read-only and logged.
• Expiring reset tokens (1 h) and per-email/IP send limits; uniform answers that prevent account enumeration.
• Self-service account export and deletion for customers.

Measures being implemented:

• Security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy).
• Login attempt limits and lockout; second factor (TOTP) for the platform admin.
• Log of personal-data access by the platform admin.
• Masking of personal data in logs and in AI copilot results.
• Verified daily backups and a breach response procedure.
• Automatic retention and anonymisation jobs per clause 9.