This Data Processing Agreement ("DPA") forms part of the Terms of Use between MHD Inc. Ltd ("Brevona", the processor) and the business that uses Brevona (the "Customer", the controller). It applies when Brevona processes personal data of the Customer's guests on the Customer's behalf. It is accepted together with the Terms of Use; no signature is needed.
1. Subject and duration
- Subject: hosting and processing the guest data the Customer collects through Brevona (menus, orders, tables, loyalty programmes and wallet passes).
- Duration: for as long as the Customer uses Brevona, and until the data is deleted under section 9.
2. Nature and purpose
Storing, displaying, transmitting and deleting guest data so that the Customer can take and manage orders, run a loyalty programme, issue wallet passes and see reports.
3. Data and data subjects
- Data subjects: the Customer's guests and loyalty members.
- Personal data: names, phone numbers and email addresses guests give; order contents, table, notes and times; loyalty membership numbers, stamps, points, visits and rewards; wallet pass identifiers.
- Special category data: none is required. The Customer should not ask guests for health or other special category data in order notes or loyalty fields.
4. The Customer's instructions
Brevona processes guest data only on the Customer's documented instructions, which are these terms and the Customer's use of the features of Brevona. If Brevona believes an instruction breaks data protection law, it will tell the Customer. Brevona may process data otherwise only where the law requires it, and will tell the Customer first unless the law forbids that.
5. Confidentiality
Everyone at Brevona who can access guest data is bound by confidentiality and accesses it only as needed to provide and support the service.
6. Security
Brevona keeps appropriate technical and organisational measures, including: encrypted connections (HTTPS); hashed passwords; access controls that limit each account to its own stores and roles; restricted administrative access to servers; backups; and monitoring of errors and misuse.
7. Sub-processors
The Customer authorises Brevona to use the sub-processors listed in our Privacy Policy (section 4). Brevona has written terms with each of them giving at least the same protection as this DPA, and remains responsible for them. Brevona will update that list at least 14 days before adding or replacing a sub-processor; the Customer may object on reasonable data protection grounds, and if no solution is found, may end the affected service and receive a refund of prepaid fees for it.
8. Helping the Customer
- Guests' rights: the Customer can view, correct and delete guest data in Brevona, and ask us for an export. If a guest contacts Brevona directly, Brevona will pass the request to the Customer.
- Breaches: Brevona will notify the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting guest data, with the information the Customer needs to meet its own obligations.
- Assessments: Brevona will give reasonable help with data protection impact assessments and consultations with authorities about the service.
9. Deletion
When the Customer deletes guest data, or deletes its account, Brevona deletes the data as described in the Privacy Policy (within 90 days of account deletion, and from backups as they are overwritten), unless the law requires it to be kept. The Customer can ask for an export first.
10. International transfers
Where guest data is transferred outside the UK or the European Economic Area, Brevona relies on adequacy decisions or on the standard contractual clauses (with the UK addendum), which are incorporated by reference.
11. Audits
Brevona will make available the information reasonably needed to show compliance with this DPA, and answer the Customer's reasonable written questions about its security. Audits beyond that are by agreement, at the Customer's cost, with reasonable notice and confidentiality.
12. Liability and order of precedence
Liability under this DPA is subject to the limits in the Terms of Use, except where the law does not allow them. If this DPA and the Terms of Use conflict on the processing of guest data, this DPA applies.
13. Contact
Data protection questions: support@brevona.com.