Skip to content
tavolify
Start free

Data Processing Agreement

Version 2, in force since November 10, 2026

This agreement is concluded between the Customer using Tavolify (the "Controller") and LOKI SOFTWARE TECHNOLOGIES SP. Z O.O., ul. Jurajska 4, lok. U05, 02-699 Warszawa, PL, tax number (NIP) 7011288037, KRS 0001207843 (the "Processor"), as an attachment to the Tavolify Terms of Service. It is concluded when the Terms of Service are accepted.

1. Subject and duration

  1. The Controller entrusts the Processor with processing personal data to the extent needed to provide the Tavolify service described in the Terms of Service.
  2. The agreement lasts as long as the service is provided and for the time needed to return or delete the data (section 9).

2. Nature and purpose of processing

The Processor stores, organises, makes available and deletes data in Tavolify only to provide the service: sales, table and online orders, the kitchen display, reports, customer records, sending digital receipts and notifications, and technical support.

3. Types of data and categories of people

  • The Controller's guests and customers: name, phone number, email address, delivery address, order history, notes (for example allergies), marketing consents, invoice details.
  • The Controller's staff: name, email address, role, a hash of the PIN, working time, actions in the system.
  • The Controller does not entrust special categories of data, except allergy information it enters itself; it is responsible for the legal basis of processing it.

4. Processor's obligations

The Processor:

  1. processes the data only on documented instructions from the Controller — in particular, using the system's features and panel settings counts as an instruction;
  2. ensures that people authorised to process the data have committed themselves to confidentiality;
  3. applies the security measures of Article 32 GDPR, in particular: encrypted connections (HTTPS), separation of each customer's data, role-based access control, an audit log, daily backups kept for 14 days;
  4. helps the Controller respond to data subjects' requests (for example the customer export and erasure in the panel);
  5. helps the Controller meet its obligations under Articles 32–36 GDPR, taking into account the nature of the processing;
  6. makes available to the Controller the information needed to show compliance with Article 28 GDPR.

5. Sub-processors

  1. The Controller gives the Processor general authorisation to use the sub-processors listed in Annex 1.
  2. The Processor informs the Controller by email or in the panel at least 14 days before adding or replacing a sub-processor. The Controller may object; in that case it may end the service agreement.
  3. The Processor imposes on sub-processors the same data protection obligations as in this agreement.

6. Personal data breaches

The Processor notifies the Controller of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it, with the information it has, so the Controller can meet its obligations under Articles 33 and 34 GDPR.

7. Transfers outside the EEA

The Processor transfers data outside the European Economic Area only with the safeguards of Chapter V GDPR (for example the standard contractual clauses approved by the European Commission). The Processor's servers are located in Turkey.

8. Audits

Once a year, with at least 14 days' notice, the Controller may carry out an audit or ask for information about the processing. An audit must not disrupt the Processor's business or breach the confidentiality of other customers' data.

9. End of processing

  1. Before the agreement ends, the Controller can export its data from the panel.
  2. After the agreement ends, the Processor deletes the Controller's data without undue delay, and from backups as they are overwritten (backups are kept for 14 days), unless the law requires keeping it longer.

10. Liability and final provisions

  1. The parties' liability follows the GDPR and the Terms of Service.
  2. Anything not covered here is governed by the Terms of Service, the GDPR and Polish law.

Annex 1 — sub-processors

Sub-processor Purpose Country
Own managed server of the Processor data storage, servers Turkey
Own mail server of the Processor sending digital receipts and notifications Turkey
Fakturownia invoices and delivery to KSeF Poland
Anthropic (only when AI features are on) reading menus from photos, summaries United States
OpenStreetMap Nominatim (only when address search is used) finding addresses and delivery zones United Kingdom (OpenStreetMap Foundation)
Stripe (only when the subscription is paid by card or BLIK) payment processing Ireland (EU)