Data Processing Agreement

01Parties and scope

This agreement is between the restaurant that holds a ComidaQR account (the Controller) and Aniworld Technologies, S.L., Carrer de Mallorca, 401, Bajos, 08013 Barcelona (the Processor). It forms part of our Terms of Service and applies to personal data the Processor handles on the Controller's behalf. If the two conflict on data protection, this agreement prevails.

02Subject matter, duration and purpose

The Processor processes personal data to provide ComidaQR to the Controller: hosting menus, taking orders and bookings, running kitchen and staff screens, processing diner payments through Stripe, and the related support. Processing lasts as long as the Controller's account, plus the deletion period described in section 8.

03Data subjects and categories of data

• Diners: table session and order contents, notes added to orders; reservation name, email, optional phone and notes; optional receipt email for card payments; QR scan records where the diner consented.
• Staff: name, email, role and the actions they take in the dashboard, including IP address and user agent in audit logs.

The service is not designed for special categories of data. If a diner writes health information, such as an allergy, in a free-text note, the Controller decides whether to ask for it.

04Processor obligations

• Process personal data only on the Controller's documented instructions, which are these terms and the Controller's use of the service, unless the law requires otherwise; in that case we inform the Controller first unless the law forbids it.
• Make sure everyone authorised to process the data is bound by confidentiality.
• Apply the security measures in section 7.
• Help the Controller answer data subject requests, using the export and deletion tools in the dashboard and by email.
• Help the Controller with security, breach notification, impact assessments and prior consultation, taking into account the information available to us.
• Notify the Controller without undue delay after becoming aware of a personal data breach affecting its data.
• Make available the information needed to show compliance with Article 28 and allow and contribute to audits, including inspections, by the Controller or an auditor it mandates, on reasonable notice.

05Subprocessors

The Controller gives general authorisation for the subprocessors in our Subprocessor Register. We will inform the Controller of any intended addition or replacement before it takes effect, so the Controller can object. If the Controller objects on reasonable data protection grounds and we cannot accommodate it, the Controller may terminate the affected service. We impose the same data protection obligations on each subprocessor by contract and remain fully liable for their performance.

06International transfers

Some subprocessors, including our hosting provider, are in the United States. Transfers outside the EEA are made under the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.

07Security measures

• Encryption of data in transit (HTTPS) and of backups.
• Role-based access control for restaurant staff and our own team.
• Audit logs of security-relevant actions.
• Weekly encrypted backups, kept for 90 days.
• Secure, HTTP-only session cookies.

08Return and deletion

The Controller can export its data at any time. When the Controller deletes its account, deletion is scheduled for 30 days later and then the personal data is permanently deleted, except what Union or Member State law requires us to keep. Backups roll off within 90 days.

09Liability and signature

Liability under this agreement follows the Terms of Service. This agreement applies automatically when you accept the Terms of Service. If you need a signed copy for your records, email legal@comidaqr.com with your restaurant name and billing entity.