Data Processing Agreement

1. Roles of the Parties

For the purposes of the UK General Data Protection Regulation (“UK GDPR”):

• You act as the Data Controller.
• Easy Eatery acts as the Data Processor.
• Third-party payment processors (such as Stripe) act as independent Data Controllers in relation to payment data processed through their systems.

Nothing in this DPA relieves you of your obligations as Data Controller under UK GDPR.

2. Subject Matter and Duration

This DPA applies for the duration of your subscription to the Service and any post-termination data retention period specified in the Terms.

Processing relates to personal data submitted to or collected through your website and related platform functionality.

3. Nature and Purpose of Processing

Easy Eatery processes personal data solely for the purpose of providing the Service, including:

• Hosting and operating your website
• Managing bookings
• Enabling gift voucher functionality
• Maintaining customer address book functionality
• Sending transactional communications (such as booking confirmations and voucher delivery emails)
• Providing customer support

Easy Eatery does not send marketing communications to data subjects on your behalf.

4. Categories of Data Subjects

Data subjects may include:

• Your customers
• Website visitors
• Voucher purchasers
• Your authorised staff users

5. Categories of Personal Data

Personal data processed may include:

• Name
• Email address
• Telephone number
• Booking details
• Voucher purchase information
• IP address
• Browser and device information

Payment card information is processed solely by your payment processor and is not stored or controlled by Easy Eatery.

6. Processor Obligations

Easy Eatery shall:

• Process personal data only on your documented instructions (including these Terms and this DPA)
• Ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations
• Implement appropriate technical and organisational measures to protect personal data
• Assist you, where reasonably possible, in responding to data subject rights requests
• Notify you without undue delay upon becoming aware of a personal data breach affecting your data
• Inform you if, in our opinion, an instruction infringes applicable data protection law
• Delete or return personal data in accordance with Section 11

7. Technical and Organisational Measures

Easy Eatery implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

These measures include:

• Hosting all production systems and customer data within the United Kingdom using infrastructure provided by Krystal Hosting Ltd.
• Protecting all communications between users and the Service using HTTPS/TLS encryption.
• Restricting access to production systems, databases and hosting infrastructure to authorised personnel only. At present, production hosting, cPanel and production database access are limited solely to the Easy Eatery platform owner.
• Using role-based access controls within the Service to ensure users can only access data appropriate to their role.
• Storing user passwords using the a well-known one-way cryptographic hashing algorithm. Passwords are never stored in plain text.
• Performing automated daily backups, retained for 30 days to support disaster recovery and business continuity.
• Recording authentication events, including login attempts and IP addresses, to assist with security monitoring and auditing. Accounts are temporarily locked after five unsuccessful login attempts and require email verification before access can be restored.
• Applying operating system and server security updates through the managed hosting environment provided by Krystal, together with ongoing maintenance of the Easy Eatery application.
• Maintaining separate production and development environments. Production data is only copied to the development environment with the explicit permission of the relevant Customer for the purpose of investigating or resolving a reported issue, and is deleted once that work has been completed.
• Using Bunny.net solely for the delivery of static media assets. Bunny.net does not process or store customer personal data.
• Using OpenAI's API to analyse customer feedback where enabled. Only the customer feedback text required for analysis is transmitted. OpenAI API data is not used to train OpenAI models.
• Retaining operational and error logs only as long as necessary to support the security, operation and ongoing improvement of the Service.

Easy Eatery periodically reviews its technical and organisational measures and will continue to implement appropriate safeguards to maintain the confidentiality, integrity and availability of personal data processed on behalf of Customers.

8. Sub-Processors

Easy Eatery may engage carefully selected sub-processors to assist in providing the Service. All sub-processors are subject to contractual obligations requiring them to implement appropriate technical and organisational measures to protect personal data in accordance with applicable data protection laws.

Current sub-processors include:

• Krystal – UK-based cloud hosting and infrastructure (London data centres)
• Bunny.net – Content delivery network (CDN) and static asset delivery
• Postmark – Transactional email delivery.
• OpenAI - AI-powered analysis and summarisation of customer feedback. Where practicable, feedback is anonymised before being transmitted, and only the feedback text required for analysis is processed.

Payment processing for subscriptions is provided directly by Stripe, which acts as an independent data controller for payment information and is not a sub-processor of Easy Eatery.

Easy Eatery maintains an up-to-date list of sub-processors and will notify Customers of any material changes where required by applicable data protection law.

9. International Data Transfers

Where personal data is transferred outside the United Kingdom, Easy Eatery will ensure that such transfers are made in accordance with applicable UK data protection laws and are subject to appropriate safeguards.

Easy Eatery may use service providers located outside the United Kingdom, including OpenAI for the analysis of customer feedback and Postmark for transactional email delivery. Where these providers process personal data outside the United Kingdom, transfers will be protected using an appropriate lawful transfer mechanism, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, an applicable adequacy regulation, or another legally recognised safeguard.

Where feasible, Easy Eatery removes direct identifiers from customer feedback before it is transmitted to OpenAI for analysis, and only the feedback text necessary to perform the requested analysis is processed.

10. Data Subject Rights

You are responsible for responding to data subject requests under UK GDPR.

Easy Eatery will provide reasonable assistance, where technically feasible, to help you fulfil such obligations.

11. Data Retention and Deletion

Upon termination or expiry of your subscription:

• Personal data will be retained for up to six (6) months.
• You may request data export during this period.
• After six (6) months, personal data may be permanently deleted.

Easy Eatery is not responsible for retaining backup copies beyond this retention period.

12. Personal Data Breach Notification

In the event of a personal data breach affecting your data, Easy Eatery will notify you without undue delay after becoming aware of the breach and provide reasonable information to assist you in meeting your regulatory obligations.

13. Liability

Liability arising under this DPA is subject to the limitations of liability set out in the Easy Eatery Terms of Service.