Data Processing Agreement

When your restaurant uses Dinelytics, your guests' personal data (names, emails, feedback) is collected on your behalf. Under the GDPR, you (the restaurant) are the data controller of that guest data, and Dinelytics (Francesco Vitale, P.IVA IT06178100878) is the data processor. This page describes the terms on which we process it (GDPR Art. 28). It forms part of, and is governed by, our Terms of Service.

We process guest personal data only to provide the Dinelytics service to you, for as long as your subscription is active. When your subscription ends we hold the data for 30 days — so that an accidental cancellation, or a change of mind, does not cost you your guest list — and then delete it automatically along with your account. If you want your guest list before that, ask and we will export it for you; if you want it deleted sooner than 30 days, ask and we will do that instead.

Collecting guest ratings and optional comments, inviting guests to post publicly on Google and routing unhappy feedback privately to you first, storing an opt-in guest contact list, summarizing feedback into your weekly report, and sending you alerts and reports.

Data subjects: your guests. Personal data: star rating, optional free-text comment, optional name and email, marketing consent state, and a keyed (hashed) IP for abuse prevention.

• Process guest data only on your documented instructions.
• Ensure people authorized to process it are bound by confidentiality.
• Apply appropriate technical and organizational security measures.
• Assist you in responding to guests' data-subject requests.
• Notify you without undue delay after becoming aware of a personal data breach.
• Delete or return guest data on termination and delete existing copies.
• Make available information needed to demonstrate compliance and allow audits.

We use the following sub-processors, each under their own GDPR-compliant terms:

We will inform you of any intended changes to this list, giving you the opportunity to object.

Where a sub-processor is outside the EU/EEA, transfers are covered by appropriate safeguards under Chapter V of the GDPR, principally the EU Standard Contractual Clauses.

Many restaurants are happy with these standard terms as-is. If your organization needs a countersigned DPA, email info@vitalesystems.com and we'll send one for signature.