Data Processing Agreement (DPA)

The controller is the restaurant using Tavelo. The processor is Luis Angel Romero Castillo, an individual trading under the name "Tavelo", Bremgartnerstrasse 118, 8953 Dietikon, Switzerland, support@tavelo.ch ("Tavelo").

This DPA does not cover data for which Tavelo itself is responsible: restaurant and staff accounts, billing restaurants, security and abuse prevention, support and legal obligations (see https://tavelo.ch/privacy).

The subject matter is the provision of the Tavelo software under the trial agreement or the Terms. This DPA applies as long as Tavelo processes guest data for the restaurant, including the export and deletion period after the contract ends.

Storing, displaying, transmitting and analysing data in order to route orders to kitchen and bar, manage tables and reservations, receive online orders (pickup and delivery), present them for acceptance and show the guest their status on a status page, send reservation emails, verify email addresses with one-time codes, run loyalty programmes and rewards, issue and update Apple and Google Wallet cards, deliver offers to guests who consented, provide analytics and — where enabled — translate menu texts and order notes and operate the AI reservation assistant.

Sensitive personal data is not intended. In free-text fields guests may mention e.g. allergies; the restaurant does not ask for health data through Tavelo.

Tavelo processes guest data only on the restaurant's documented instructions. Instructions are this DPA, the Terms or the trial agreement, the restaurant's settings in the dashboard and its actions in Tavelo. If Tavelo considers an instruction to infringe data protection law, Tavelo informs the restaurant.

Persons at Tavelo with access to guest data are bound to confidentiality.

Tavelo takes measures appropriate to the risk, currently in particular:

• encrypted connections (HTTPS/TLS);
• separation by restaurant and role, enforced in the database (row level security);
• credentials of external services only on the server;
• one-time codes only hashed, with expiry and attempt limits;
• unguessable random codes for guest links;
• least-privilege roles for staff;
• browser security headers;
• backups at the hosting provider and documented recovery procedures.

Tavelo may adapt measures as long as the level of protection is not reduced. No system is perfectly secure; Tavelo does not guarantee absolute security.

The restaurant authorises the subprocessors listed at https://tavelo.ch/subprocessors.

Tavelo informs the restaurant by email at least 30 days before engaging or replacing a subprocessor. The restaurant may object on legitimate data protection grounds; if no solution is found, it may terminate the contract.

Tavelo contractually binds subprocessors to equivalent data protection and remains responsible for them towards the restaurant.

Some subprocessors process data outside Switzerland and the EEA, in particular in the United States. Tavelo discloses data only to countries with adequate data protection or on the basis of appropriate safeguards, in particular the EU standard contractual clauses with the adaptations required for Switzerland or certification under the Swiss-U.S. Data Privacy Framework. Details per provider: https://tavelo.ch/subprocessors

Tavelo reasonably assists the restaurant with requests for access, rectification, erasure, receipt, objection and withdrawal. Requests reaching Tavelo directly that concern the restaurant's guest data are forwarded to the restaurant without undue delay. Tavelo applies a withdrawal of marketing consent immediately; guests can also withdraw themselves on their rewards page.

Tavelo notifies the restaurant of a data security breach affecting the restaurant's guest data as soon as possible after becoming aware of it, with the information available (nature of the breach, categories and approximate number concerned, likely consequences, measures taken), and assists the restaurant with its own notification duties (to the FDPIC "as soon as possible" under Art. 24 FADP; under Art. 33 GDPR within 72 hours to the supervisory authority, where applicable).

After the contract ends, the restaurant may request an export of its guest data within 30 days. Tavelo then deletes or anonymises the restaurant's guest data unless a statutory retention obligation applies. Backups are overwritten in the hosting provider's backup cycle.

Tavelo currently performs export and deletion manually on request; there is not yet a self-service function for all data. Independently of this, one-time code requests are deleted automatically after 30 days.

Tavelo provides the restaurant with the information needed to demonstrate compliance with this DPA (e.g. this DPA, the subprocessor list and a description of the measures). On-site audits are possible with reasonable notice, at the restaurant's cost and at most once a year, unless there is a specific reason.

This DPA ends when the trial agreement or the contract under the Terms ends; the obligations regarding export, deletion and confidentiality continue. Liability follows the main contract. In case of conflict on data protection matters, this DPA prevails.

Swiss law applies; place of jurisdiction is Zurich, Switzerland, to the extent permitted by law. Where the GDPR applies mandatorily, its requirements prevail. The German version is controlling.