Parties and scope
This agreement is between the restaurant that holds an account on the platform (the controller) and BookNDish, available on request (the processor). It forms part of our terms of service and applies whenever we process personal data on the restaurant’s behalf, under the GDPR, the UK GDPR or any other data protection law that applies. If this agreement and the terms of service disagree about personal data, this agreement wins.
What is processed
Subject matter and purpose: providing the platform, that is taking orders, bookings, payments and messages for the restaurant and keeping its records. Duration: as long as the restaurant’s account is open, and until deletion afterwards. Data subjects: the restaurant’s guests and its team members. Categories of data: names, phone numbers, email addresses, table or room numbers, orders, booking details, loyalty balances, payment references (never full card numbers) and the notes a guest chooses to add, which may include dietary or allergy information. The restaurant decides what it collects beyond that.
Our obligations
We process the data only on the restaurant’s documented instructions, which are these terms and the way the restaurant configures and uses the platform, unless the law requires otherwise, in which case we tell the restaurant first where the law allows. Everyone at our company with access to the data is bound by confidentiality. We help the restaurant answer guests who exercise their rights, carry out impact assessments and consult authorities, as far as the platform’s nature allows. We notify the restaurant of a personal data breach without undue delay after becoming aware of it, with the information it needs to meet its own duties.
Security
We apply the technical and organisational measures described on our security page, including encryption in transit, encryption of sensitive fields at rest, two-factor sign-in, role-based access, an audit log, rate limits, separate nightly backups and a tested restore procedure. We review them as the platform and the risks change, and we will not reduce the overall level of protection during the agreement.
Sub-processors
The restaurant authorises us to use the sub-processors below. Each is bound by written terms that give the data at least the protection this agreement does, and we remain responsible for them. We will announce a new or replaced sub-processor on this page and by email to account owners at least 30 days before it starts; the restaurant can object on reasonable data protection grounds, and if we cannot address the objection it may close its account and receive a refund of any prepaid period.
Render
Hosting of the application
- Where
- Frankfurt, Germany (European Union)
- Transfer safeguard
- Standard contractual clauses
Neon
Hosting of the database
- Where
- London, United Kingdom
- Transfer safeguard
- Adequacy decision
available on request
Storage of menu photos, branding images and database backups
- Where
- available on request
- Transfer safeguard
- Standard contractual clauses
Stripe
Card payments, payouts to restaurants and subscription billing
- Where
- the United States and the European Union
- Transfer safeguard
- EU-US Data Privacy Framework and standard contractual clauses
Konnect
Card and wallet payments for restaurants in Tunisia
- Where
- Tunisia
- Transfer safeguard
- Standard contractual clauses
available on request
Delivery of transactional email such as confirmations, receipts and password resets
- Where
- available on request
- Transfer safeguard
- Standard contractual clauses
available on request
Delivery of order and booking updates by text message and WhatsApp
- Where
- available on request
- Transfer safeguard
- Standard contractual clauses
Anthropic
The AI features (reading menus and supplier invoices, the owner’s assistant), only when the restaurant uses them
- Where
- the United States
- Transfer safeguard
- Standard contractual clauses
Sentry (Functional Software, Inc.)
Error tracking, with personal data removed before sending
- Where
- available on request
- Transfer safeguard
- EU-US Data Privacy Framework and standard contractual clauses
International transfers
Where a sub-processor processes personal data from the European Economic Area, the United Kingdom or Switzerland in a country without an adequacy decision, the transfer is covered by the European Commission’s standard contractual clauses (module three, processor to processor), with the UK addendum where it applies, and by an assessment of the destination country’s law. A copy of the relevant clauses is available on request.
Audits, deletion and return
We make available the information needed to show compliance with this agreement and allow for audits by the restaurant or an auditor it appoints, on reasonable notice, at most once a year unless a breach or an authority requires more, and in a way that protects other customers’ data. When the account is closed, the restaurant can export its data first; we then delete it within 30 days, and it leaves our backups within five weeks, unless the law requires us to keep it.
Contact and duration
Questions about this agreement, audit requests and breach reports go to the contact page. A restaurant that needs a signed copy, for example for its own records or a procurement process, can ask for one at that address. This agreement lasts as long as we process personal data for the restaurant.