Data Processing Agreement

Version 2026-11-02 · Updated 2026-11-02

_AI draft, not legal advice · part of the Platenook Terms of Service_

Covers UK GDPR Art 28, EU GDPR Art 28 (if ever needed), PIPEDA accountability for outsourced processing (Sch 1, 4.1.3), and US state "service provider" terms.

  1. Roles. The Restaurant is the controller of its guests' and staff's personal data. PixelRidge is the processor. PixelRidge is the controller only of owner account, billing and support data and its own security logs (see the PixelRidge privacy notice).
  2. Purpose and duration. To provide Platenook while the subscription runs, and for up to 30 days after, to return and delete the data.
  3. Data and people.
  • Guests: device code; orders (dishes, options, notes that may contain allergy details, table, time); first names; and, only when the Restaurant uses the feature: pickup name and phone, booking name, phone, occasion and note, event email, "Remember me" hash and visit counts, offer consent and contact, signed-in account (name, email).
  • Staff: name, role, PIN hash, shifts, actions.
  • No card data. No IP addresses in the database.
  1. Instructions. These Terms, the DPA and the Restaurant's Settings are the Restaurant's instructions. PixelRidge tells the Restaurant if an instruction seems unlawful.
  2. No own use. PixelRidge never sells guest data, never uses it to market PixelRidge, Platenook or anyone else, and never combines one restaurant's guests with another's. Only aggregated, non-identifiable statistics may be used to run and improve the service.
  3. People and support access. Everyone at PixelRidge with access is bound to confidentiality. Guest contact data is masked in the admin panel. Support opens a restaurant's guest data only after the owner grants access in the app, for a stated reason and a limited time. Every access is logged.
  4. Security (Art 32). Each restaurant's data is isolated by database rules tested before every release; encryption in transit (HTTPS) and at rest; admin 2FA and roles; hashed PINs and tokens; rate limits; an emergency lock; no IP addresses in the database (hosting security logs keep them for up to 7 days); backups held by the hosting provider.
  5. Sub-processors. The Restaurant authorises those on /legal/subprocessors. PixelRidge gives 30 days' notice of a new one; the Restaurant may object and leave without a fee. The same duties flow down; PixelRidge stays responsible for them.
  6. Transfers. Production data is hosted in India. Transfers out of the UK are protected by approved contract clauses. Any other transfer uses the UK IDTA or UK Addendum (EU: SCCs), with a transfer risk assessment.
  7. Breaches. PixelRidge tells the Restaurant without undue delay and within 24 hours of becoming aware, with the facts known, the steps taken and a draft guest message, and helps with notices to the ICO (72 h) or the OPC.
  8. Guest rights. The Restaurant has in-app tools (find, export, Delete my data). PixelRidge helps with any other request within 10 working days, and with DPIAs and consultations.
  9. Retention. Personal data at most 12 months, shorter where the retention table says so (e.g. booking phone, occasion and note the day after; notes 24 h after the visit closes). Anonymised sales numbers are kept 6 years for the Restaurant's tax records.
  10. End of service. Export on request, then deletion within 30 days. Backups roll off within 7 days after that. Data the law requires to be kept is retained only for that.
  11. Audit. PixelRidge gives the information needed to show compliance and allows one reasonable audit a year on 30 days' notice (at the Restaurant's cost unless a breach is found).
  12. US. PixelRidge is a "service provider"/"processor": no selling or sharing, no use outside this DPA, notice if it can no longer comply.
  13. Order of precedence. If this DPA and the Terms conflict on personal data, this DPA wins.