Data processing agreement
Last updated: 14 November 2026
This agreement under article 28 of the GDPR is part of the Terms for businesses. It applies between the business that uses EncoreTable (the “controller”) and PA Global Services, KvK 99963701 (the “processor”).
1. Subject and duration
The processor processes personal data to provide EncoreTable to the controller, for as long as the subscription lasts.
2. Nature and purpose
Hosting and storage; showing the menu; collecting feedback; running the loyalty programme (stamps, gifts, prepaid bundles); confirming requests at the register; sending messages to guests who agreed to receive them; metrics.
3. Data and data subjects
Guests: name, email address, phone number, birthday (day and month), language, dietary preferences (which may include health-related information such as allergies, only if the guest chooses to provide it), consent for offers, visits, stamps, gifts, prepaid bundles, receipt totals, feedback and contact requests.
Staff of the controller: names and personal codes of waiters, names and email addresses of dashboard users.
4. Obligations of the processor
Process data only on documented instructions of the controller, which are given through these terms and the settings of the dashboard.
Ensure that everyone with access to the data is bound by confidentiality.
Take appropriate security measures, including encrypted connections, hashed passwords, access per user with optional two-step verification, separation between businesses and data storage in the EU.
Help the controller to answer requests of data subjects and, where needed, with a data protection impact assessment.
Report a personal data breach to the controller without undue delay, and in any case within 48 hours after discovering it.
At the end of the agreement, return the data (export) or delete it within 30 days, unless the law requires otherwise.
Provide the information needed to demonstrate compliance and allow an audit once a year, announced at least 30 days in advance, at the controller’s expense.
5. Sub-processors
The controller gives general permission to use sub-processors. Current sub-processors: Vercel Inc. (hosting, EU region Frankfurt), Neon Inc. (database, EU region Frankfurt), Resend (email delivery, only if the controller uses email messages) and Google (Google Wallet, only if a guest uses it).
The processor announces new sub-processors at least 30 days in advance. If the controller objects on reasonable grounds, it may end the subscription.
Transfers outside the EU are covered by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
6. Liability
The liability provisions of the Terms for businesses apply.