1xs websolutions · KvK 63192136
Data processing agreement
Arnhem · The Netherlands · info@1xs.nl
1. Parties, subject and duration
This agreement accompanies the business Reservations subscription. The restaurant identified in the order confirmation is the controller; 1xs websolutions, the Netherlands, Chamber of Commerce 63192136, info@1xs.nl, is the processor. The parties record restaurant name, address, contact, start date and document version on acceptance. Processing lasts for the service and the agreed completion period afterwards.
2. Processing and data subjects
Processing includes receiving, recording, organising, consulting, changing, sending booking messages and deleting data for reservations, table planning, guest management and feedback. Data subjects are guests, their contacts and restaurant staff where their data appears in these operations. Data includes names, contact details, dates/times, party sizes, table assignments, attendance and entered notes or feedback. Allergies and other health data are processed only where the restaurant has established a valid Article 9 GDPR exception and another applicable legal basis.
3. Instructions and confidentiality
1xs processes data only on documented restaurant instructions, including this agreement and lawful application settings. If processing is legally required, 1xs informs the restaurant beforehand unless prohibited by law. It immediately reports instructions it considers contrary to data protection law. Data is not used for its own advertising or sale. Necessary access is limited to authorised persons bound by confidentiality.
4. Security and assistance
1xs implements appropriate technical and organisational measures under Article 32 GDPR, proportionate to risks, nature and scope. Before production, the annex must detail access controls, transport and storage encryption where appropriate, updates, logs, backups, recovery tests and responsibilities. Unverified measures are not represented as existing guarantees. Taking account of processing and available information, 1xs assists with data-subject requests, security, breach notifications, DPIAs and prior consultation. Guest requests are forwarded to the restaurant without delay.
5. Personal data breaches
1xs reports a known personal data breach to the restaurant contact without undue delay. Where known, the notice gives the nature, affected data and persons, likely consequences, measures taken or proposed and a contact point. Missing information follows in phases. 1xs cooperates with investigation, mitigation and recovery and records its handling. The restaurant as controller decides on notifications to authorities and individuals, without prejudice to 1xs’s independent legal duties.
6. Subprocessors and transfers
The restaurant grants general written authorisation for subprocessors named in the final annex. Intended additions or replacements are notified in advance with a reasonable opportunity to object on substantiated grounds before use. The parties seek a suitable solution; absent a lawful solution, the relevant processing does not continue. 1xs imposes equivalent data protection duties and remains responsible to the restaurant for subprocessor compliance. Transfers outside the EEA require documented instructions, a valid transfer basis and necessary safeguards.
7. End of service, audits and precedence
At service end, 1xs deletes or returns personal data at the restaurant’s choice and deletes existing copies unless retention is legally required. Completion periods and backup handling must be agreed beforehand in the annex. Legally retained data is restricted to that purpose. 1xs provides information needed to demonstrate compliance and allows and contributes to audits, including inspections by the restaurant or its authorised auditor. Reasonable planning and confidentiality arrangements may not undermine this right. Processing provisions take precedence over general terms in a conflict; statutory data-subject rights remain unaffected.
Annex A — to be agreed before production
Restaurant details and authorised contact; systems and suppliers with legal name, task, country, contract and any transfer basis; actual security measures; retention and deletion periods per category; backup frequency, location and expiry; return procedure and timeframe; incident contacts and audit arrangements. Hosting, email and Stripe are assessed according to their roles. This open annex must be completed and accepted before real guest data is processed under this agreement.