GDPR · Art. 28
Data processing agreement
Part of the Terms of service and accepted with them. This is a translation: the Spanish version prevails.
1. Parties and subject
The Customer (the restaurant using FastBite) is the controller of its guests' and staff's data. BRASATECH DIGITAL SOLUTIONS S.L., tax ID B09767898, is the processor: it handles that data only to provide FastBite to the Customer.
2. Nature, purpose and duration
Hosting, recording, consulting, organising and keeping the data needed for the menu and orders, point of sale, kitchen, takeaway, invoicing and sending VERI*FACTU records to the Spanish Tax Agency. The processing lasts as long as the service contract.
3. Data subjects and data
| Data subjects | Data |
|---|---|
| Restaurant guests | Orders, table, name to collect an order, details for a full invoice (name, tax ID and address), payment references (never card details) |
| Restaurant staff | Username, name, role and irreversibly hashed password; orders and tickets they handle |
The service is not designed to handle special categories of data. Allergen information describes dishes, not people.
4. The processor's obligations
- Process the data only on the Customer's documented instructions, which are these terms and what the Customer configures in the service, unless the law requires otherwise; we will tell the Customer first where the law allows.
- Ensure that people authorised to process the data are bound to confidentiality.
- Apply the Art. 32 GDPR security measures described in section 6.
- Use sub-processors only as set out in section 5.
- Help the Customer answer data subjects' requests. If a data subject contacts us, we will refer them to the Customer and let the Customer know.
- Help the Customer meet its obligations on security, breach notification, impact assessments and prior consultation, given the information available to us.
- Notify the Customer without undue delay, and where possible within 48 hours, of any personal data breach we become aware of, with the information it needs to report it.
- When the service ends, let the Customer export its data for 30 days and then delete it, unless the law requires it to be kept (for example invoices and billing records).
- Make available the information needed to show compliance with this agreement and allow reasonable audits, with prior notice and without access to other customers' data.
5. Sub-processors
The Customer gives general authorisation to use sub-processors. The current ones are:
| Sub-processor | Service | Location |
|---|---|---|
| Google Ireland Ltd. (Google Cloud, Firebase) | Hosting of the application, database and files | European Union (Madrid) |
| Microsoft Ireland Operations Ltd. (Microsoft 365) | Service email | European Union |
We will announce any addition or replacement at least 30 days in advance; the Customer may object on reasonable grounds and, if no solution is found, end the contract. Each sub-processor is bound by the same obligations as this agreement. Stripe and the Tax Agency are not sub-processors: Stripe handles payments as a controller in its own right, and the Tax Agency receives records under the Customer's legal obligation.
6. Security measures
- Encryption of communications (HTTPS) and of data stored by the hosting provider.
- Each restaurant's data kept in its own database schema.
- Passwords stored with irreversible hashing; role-based access control.
- Backups, and export by the Customer.
- Up-to-date software and logging of relevant activity to detect and resolve incidents.
7. International transfers
Data is hosted in the European Union. Any access from outside the European Economic Area will have the safeguards of Chapter V of the GDPR.
8. The Customer's obligations
The Customer guarantees that it processes the data lawfully, that it informs data subjects (it can use the privacy page FastBite provides for each location) and that its instructions comply with the law.