posfactori

Data Processing Agreement

Last updated: 2026-10-16

This Data Processing Agreement ("DPA") is part of the Terms of Service between posfactori ("Processor") and the business using posfactori ("Controller"). It applies to personal data the Controller stores in or collects through posfactori, in line with Article 28 of the GDPR.

1. Subject matter and duration

The Processor hosts and operates posfactori for the Controller for as long as the Controller has an account, plus the deletion period in section 9.

2. Nature and purpose

Storing, organising, displaying, transmitting and deleting data so the Controller can take orders and payments, run its kitchen, deliveries, reservations, loyalty programme, staff rota and reports, and send the messages it chooses to send.

3. Categories of data subjects and data

  • Guests and customers: name, phone, email, delivery addresses, order history, loyalty points, reservations, reviews, birthday if the Controller collects it, marketing preferences.
  • Staff: name, email, phone, role, PIN (hashed), schedule, clock-in times, hourly rate.
  • No special categories of data are required by the service; the Controller should not enter them (for example health data in order notes).

4. Processor obligations

The Processor will:

  1. process the data only on the Controller's documented instructions — the configuration of the account and its use of the service are those instructions;
  2. ensure that its personnel are bound by confidentiality;
  3. apply the security measures in section 6;
  4. use sub-processors only as described in section 5;
  5. help the Controller respond to data-subject requests, mainly through the export, edit and delete functions of the service;
  6. help the Controller with security, breach notification and impact assessments, taking into account the information available to the Processor;
  7. notify the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Controller's data;
  8. delete or return the data at the end of the service (section 9);
  9. make available the information needed to demonstrate compliance and allow for reasonable audits, normally by providing documentation, once per year and at the Controller's cost.

5. Sub-processors

The Controller gives general authorisation to the sub-processors listed on the Sub-processors page. The Processor will announce new sub-processors on that page and by email to account owners at least 14 days in advance; the Controller may object on reasonable data-protection grounds and, if no solution is found, terminate the affected service. The Processor imposes data-protection obligations on each sub-processor equivalent to this DPA and remains responsible for them. Integrations the Controller switches on itself (payment providers, delivery marketplaces, accounting exports, the tax authority) receive data on the Controller's instruction and under the Controller's own agreement with them.

6. Security measures

  • Encryption in transit (TLS 1.2+, HSTS); servers in EU data centres; firewall exposing only SSH and the web ports.
  • Tenant isolation enforced in the database (row-level security) in addition to application checks; the application runs under a database role that cannot bypass it.
  • Passwords and PINs stored as salted hashes; throttling of sign-in, PIN and reset attempts; sessions revoked on password change or deactivation.
  • Role-based access inside each account, location restrictions for staff, audit log of sensitive actions.
  • Daily backups, kept up to 8 weeks, with a weekly automated restore test.
  • Dependency scanning and security reviews before releases; error monitoring.

7. International transfers

Data is hosted in the EU. Any transfer by a sub-processor outside the EU/EEA relies on an adequacy decision or the Standard Contractual Clauses.

8. Controller obligations

The Controller is responsible for having a lawful basis for the data it enters, informing its guests and staff, obtaining consent for marketing messages, and keeping its account credentials secure.

9. End of processing

After the account is closed, the Controller has 90 days to export its data. The Processor then deletes it, including from backups as they rotate (at most 8 further weeks), except where the law requires retention.

10. Contact

posfactori, — — [email protected].