1. Parties and conclusion
1.1. This Data Processing Agreement ("DPA") is concluded between the Merchant (the "Controller") and SM-NEXA spółka z ograniczoną odpowiedzialnością (SM-NEXA sp. z o.o.) with its registered office in Warsaw, Poland, at ul. Kolejowa 9 lok. 121, 01-217 Warsaw, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0001245922, NIP (tax ID) 5273221990, REGON 544940265, share capital of PLN 5,000 ("TableMind", the "Processor") and forms an integral part of the TableMind Terms of Service (the "Terms"). The DPA is accepted together with the Terms; no separate signature is required.
1.2. The DPA implements Article 28(3) of Regulation (EU) 2016/679 ("GDPR") with respect to personal data that TableMind processes on behalf of the Controller in connection with the Services ("Guest Data"). Capitalised terms not defined here have the meaning given in the Terms; data-protection terms have the meaning given in the GDPR.
2. Description of processing
2.1. Subject matter and nature: hosting, storage, structuring, transmission, display and deletion of personal data within the Platform in order to provide the Services (digital menus, ordering, reservations, payments facilitation, CRM, loyalty, reviews, marketing tools, analytics).
2.2. Purpose: provision of the Services to the Controller pursuant to the Terms.
2.3. Duration: the term of the Terms, plus the return/deletion period in Section 9.
2.4. Categories of data subjects: Guests; the Controller’s personnel using the Platform; participants of the Controller’s loyalty and marketing programmes.
2.5. Categories of personal data: identification and contact data (e.g. name, email address, telephone number); order data (items, amounts, table number, order notes, delivery address); reservation data; payment status and transaction metadata (the Processor does not store full payment-card numbers – card data is collected directly by Stripe); loyalty and purchase-history data; reviews and feedback; technical data (device, IP address, logs).
2.6. Special categories of data are not intended to be processed. The parties acknowledge that order notes may incidentally contain information voluntarily provided by a Guest (e.g. allergy remarks); such information is processed solely to fulfil the given order and the Controller will not use the Platform to systematically collect special-category data.
3. Instructions of the Controller
3.1. The Processor processes Guest Data only on documented instructions from the Controller, which consist of: the Terms, this DPA, the configuration and settings selected by the Controller in the Platform, and other documented instructions agreed by the parties. Transfers to a third country take place only in accordance with Section 8.
3.2. The Processor will immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other applicable data-protection provisions, and may suspend execution of such instruction until it is confirmed or changed.
4. Obligations of the Processor
Confidentiality: persons authorised to process Guest Data are bound by confidentiality obligations (contractual or statutory) and are granted access on a need-to-know basis.
Security: the Processor implements appropriate technical and organisational measures required by Article 32 GDPR, taking into account the state of the art and the risks of the processing; the current measures are summarised in Schedule A.
Assistance: taking into account the nature of the processing, the Processor assists the Controller with appropriate technical and organisational measures in responding to data-subject requests (Chapter III GDPR) and, taking into account the information available to it, in ensuring compliance with Articles 32–36 GDPR (security, breach notification, data-protection impact assessments, prior consultation).
Personal data breaches: the Processor will notify the Controller without undue delay, and where feasible no later than 48 hours, after becoming aware of a personal data breach concerning Guest Data, providing the information reasonably available to it as required by Article 33(3) GDPR, and will cooperate in mitigating the breach. Notification of the supervisory authority and of data subjects remains the Controller’s responsibility.
Records and cooperation: the Processor keeps a record of categories of processing activities carried out on behalf of the Controller and cooperates with the competent supervisory authority upon request.
Data-subject requests received directly: if a Guest addresses a request to the Processor, the Processor will forward it to the Controller without undue delay, unless the parties agree otherwise or the law requires the Processor to respond.
5. Sub-processors
5.1. The Controller grants a general authorisation for the engagement of sub-processors. The current list of sub-processors is set out in Annex 2 (List of Sub-processors) published at table-mind.com/legal and forms part of this DPA.
5.2. The Processor will inform the Controller of intended additions or replacements of sub-processors at least 14 days in advance (by email or in-dashboard message). The Controller may object on reasonable, documented data-protection grounds within that period; if the parties do not find a solution, the Controller may terminate the part of the Services that cannot be provided without the new sub-processor, with a pro-rata refund of prepaid fees for that part.
5.3. The Processor imposes on each sub-processor, by way of contract, data-protection obligations materially equivalent to those in this DPA and remains fully liable to the Controller for the performance of the sub-processor’s obligations.
6. Audits
6.1. The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller (not being a competitor of the Processor).
6.2. Unless a supervisory authority requires otherwise or a personal data breach has occurred, audits: (a) may be carried out no more than once in any 12-month period; (b) require at least 30 days’ prior notice; (c) take place during business hours without disrupting the Processor’s operations; (d) are subject to confidentiality; and (e) are carried out at the Controller’s cost. The Processor may first satisfy an audit request by providing current independent reports, certifications or documentation of its security measures.
7. Security schedule
Schedule A – technical and organisational measures (summary): encryption of data in transit (TLS); encryption or equivalent protection of data at rest; logical separation of customer environments; role-based access control, unique accounts and the principle of least privilege; multi-factor authentication for administrative access; logging and monitoring of production systems; regular backups with tested restoration; vulnerability management and updates; secure software-development practices and code review; personnel confidentiality commitments and data-protection training; incident-response procedure; business-continuity arrangements with the hosting provider. [Adjust this list to the actual measures in place before publication.]
8. International transfers
8.1. Guest Data is hosted within the European Economic Area [confirm hosting region before publication]. The Processor may transfer Guest Data outside the EEA only in compliance with Chapter V GDPR, in particular on the basis of an adequacy decision (including the EU–US Data Privacy Framework, where the recipient is certified) or the European Commission’s Standard Contractual Clauses, with supplementary measures where required.
9. Return and deletion
9.1. Upon termination of the Terms, the Processor will, at the Controller’s choice communicated within 30 days, return Guest Data in a commonly used, machine-readable format and/or delete it, and will delete existing copies within 90 days of termination, unless European Union or Polish law requires further storage. Data in encrypted backups is deleted in accordance with the backup rotation cycle, no later than [90] days after the deletion described above, and is not restored to production except for restoration required by law.
10. Liability and final provisions
10.1. The liability of each party under this DPA is subject to the limitations and exclusions set out in the Terms, to the extent permitted by law; those limitations do not affect data subjects’ rights or claims under Article 82 GDPR.
10.2. This DPA is governed by Polish law. In the event of a conflict between the DPA and the Terms with respect to processing of Guest Data, the DPA prevails. The DPA terminates automatically upon completion of the obligations in Section 9.
Annex 2 – processors
The Processor uses the following sub-processors to provide the Services:
| Purpose of processing | Location | Transfer safeguard |
|---|---|---|
| Payment processing, payouts, fraud prevention and merchant onboarding (KYC) | EEA / USA | EU–US Data Privacy Framework; Standard Contractual Clauses |
| Cloud infrastructure, storage and backups | [EEA region] | [n/a if EEA; SCC/DPF if outside EEA] |
| Delivery of transactional and marketing emails | ||
| Delivery of SMS notifications and campaigns | ||
| Service monitoring, diagnostics and product analytics |