Data processing agreement
Agreement template for processing by Zackisch on instructions under Article 28 GDPR. The annexes define the assignment and must be completed with the actual operational and provider details.
1. Parties and subject matter
The controller is [restaurant’s full name/entity, address, representative and privacy contact]. The processor is Selim Eser, trading as Zackisch, Musterstraße 1, 12345 Musterstadt, Germany; privacy contact: [email protected]. This agreement supplements the merchant agreement for personal data processed solely on the restaurant’s behalf. Zackisch’s independent purposes, including its own contract administration, are outside these instructions and require separate assessment.
2. Nature, purpose and duration
Processing includes collection, storage, provision, reconciliation, correction, export and erasure of order and operational data for technical QR ordering, fulfilment workflows, payment-status allocation, POS acknowledgements and commissioned support. It lasts for the merchant agreement plus the agreed return and erasure period: [period]. Processing starts only once this agreement and its completed annexes have been validly incorporated.
3. Documented instructions
The restaurant determines permitted purposes and issues documented instructions through [authorised persons and channel]. Zackisch processes entrusted data only accordingly, including transfers outside the EEA. Legally compelled departures are notified beforehand where legally permitted. If Zackisch considers an instruction contrary to data protection law, it informs the restaurant without delay and suspends the affected processing pending clarification. Instructions and changes are documented traceably.
4. Confidentiality and access
Zackisch uses only authorised persons bound by confidentiality commitments or statutory duties. Access is limited to necessary tasks, permissions are reviewed regularly and removed when no longer needed. Remote and privileged support access must be described in the security annex. Confidentiality continues after the assignment ends.
5. Technical and organisational measures
The parties agree on the completed measures in Annex B as the appropriate protection level under Article 32 GDPR. Zackisch reviews their effectiveness regularly and after material changes. Changes must not reduce the agreed protection level; material changes are documented and communicated to the restaurant for review. Blank evidence fields are not assurances that a measure has been implemented, certified or successfully tested.
6. Subprocessors and third countries
The restaurant authorises the subprocessors individually identified in Annex C. New or replacement subprocessors are announced beforehand with tasks, data locations and safeguards; objection period: [period]. For a substantiated data protection objection, the parties agree on a suitable alternative or termination of the affected service. Subprocessors are bound by equivalent protection duties; Zackisch remains responsible for their performance. Third-country transfers additionally require an applicable basis under Chapter V GDPR.
7. Individual rights and assistance
Zackisch promptly forwards requests concerning entrusted data to the restaurant and assists with search, access, correction, restriction, portability and erasure. A substantive response on the restaurant’s behalf requires instructions or a legal obligation. Taking account of the processing and available information, Zackisch also assists with security assessments, data protection impact assessments and required consultations. Contacts and response process: [complete].
8. Personal data breaches
Zackisch notifies the restaurant without undue delay after becoming aware of a breach affecting entrusted data. As available, the notice includes nature and scope, affected categories, approximate numbers, possible consequences, measures and a contact; missing information follows in stages. Reporting channel and available deputy: [complete]. The restaurant decides on its own notifications to authorities and individuals. The controller’s statutory 72-hour period is not a waiting period for Zackisch.
9. Evidence and audits
Zackisch provides information needed to demonstrate compliance with Article 28 GDPR and allows audits, including inspections, by the restaurant or its appointed auditor. Practical coordination protects operations and other customers’ data but must not exclude effective oversight. Regular intervals, secure evidence delivery and urgent-case procedures: [complete]. Supervisory authorities’ powers remain unaffected.
10. Return, erasure and backups
At the end of processing, Zackisch returns or erases entrusted data and copies at the restaurant’s choice, unless law requires retention. Choice, export format, period and erasure confirmation: [specify]. Legally retained records are restricted to the permitted purpose. Annex B must describe backup rotation, restricted residual copies and reapplication of prior erasures after recovery. A backup does not authorise renewed operational use of erased data.
Annex A · Data and individuals
Individuals: guests, operators and authorised staff; for commissioned support, also requesters. Data: order items and options, table/pickup, amounts, timestamps, order and payment references, optional confirmation email, fulfilment and POS status, authorised user identifiers and necessary support content. Special-category personal data is not intended as a regular part of the service. [Complete any further commissioned data types and operations, sources, recipients and category-specific periods.]
Annex B · Security and recovery evidence
For each measure record its owner, actual configuration, review date and evidence: tenant and role checks [evidence]; session expiry and revocation [evidence]; privileged sign-in and multifactor protection [evidence]; transport/storage encryption and key management [evidence]; upload and attachment protection [evidence]; log redaction and access review [evidence]; update and vulnerability process [evidence]; personnel confidentiality and training [evidence]; backup destination, interval, retention, encryption and authorised persons [details]; actually tested restore, tolerable data loss and recovery time [evidence]; erasure journal, legal holds and reapplication after recovery [evidence]. Attach provider attestations with scope and date rather than presenting them as blanket Zackisch certification.
Annex C · Subprocessor register
Entries to complete: Cloudflare: web delivery [contracting entity, address, actual services, locations, data categories, agreement/safeguard evidence]; Convex: backend and storage [same details]; email provider: message delivery [same details]; other commissioned providers [entries]. Record authorisation date and revision for each entry. Classify Stripe by activity: independently controlled payment services must not be treated without assessment as mere restaurant subprocessing. [Map the actual Stripe roles and agreements.]
Agreement and version
Version: template 2026-11-05. Annexes A, B and C form part of this agreement. [Complete the final version, date, authorised representatives and documented electronic or written acceptance.] Amendments must be agreed traceably. Publication of this template alone is neither contract formation nor evidence of a security assessment.