What is processed
- Subject and duration: providing Eats All Over to the restaurant, while its account is active and until the data is deleted.
- Nature and purpose: receiving orders from the restaurant's website and tables, showing them to the kitchen and the staff, printing tickets, keeping table tabs, placing delivery addresses on the map, sending order emails and preparing reports.
- Data subjects: the diners who order from the restaurant.
- Personal data: name, phone, email, delivery address and its coordinates, order contents and notes, payment status and amounts with their Stripe ids, and anonymous diner ids at tables.
- Special categories: the allergies a diner declares (health data), used only to prepare the order safely.
Instructions
We process the data only to provide the service and on the restaurant's documented instructions: the Terms of Service, this agreement and the settings the restaurant chooses in the dashboard. If we believe an instruction breaks the law, we tell the restaurant.
Confidentiality
Only the people at All Over Apps who run the platform and need it can access the data, and they are bound to confidentiality.
Security
We apply the measures described in the Privacy Policy, among them:
- Encrypted connections (TLS) and diners' personal data encrypted at rest.
- Only hashes of tokens, sessions, links and PINs, and limited pairing and PIN attempts.
- Access to the data limited to the people who need it.
- Database backups, kept for 30 days.
Subprocessors
The restaurant authorizes these subprocessors, described in Providers who help us:
- OVHcloud (OVH US): servers, database and cache, in the United States.
- Cloudflare: domains, DNS, encrypted connections, protection and caching, restaurants' own domains, dish photos and database backups (R2), on its global network.
- Stripe: card payments in the restaurant's own account (Stripe Connect), in Ireland and the United States. Stripe is also an independent controller of the payment data.
- Amazon Web Services (Amazon SES): sending order emails, in the United States (Ohio).
- Sentry: error monitoring, without request contents, cookies or user details, in the United States.
- komoot (Photon): address suggestions, in Germany.
- OpenStreetMap Foundation (Nominatim): placing addresses on the map, in the United Kingdom.
- OpenFreeMap: map tiles in the dashboard's zone editor, requested by the staff's browser.
We bind them to data protection obligations equivalent to those in this agreement and remain responsible for them.
If we add or change a subprocessor, we tell restaurants with reasonable notice. The restaurant can object by writing to [email protected] and, if we cannot address its objection, it can close its account.
Help with requests
We help the restaurant answer its diners' requests (access, correction, erasure and the others), which it can pass on to us by writing to [email protected], and with data protection impact assessments when they are needed.
Personal data breaches
If a security breach affects the restaurant's personal data, we notify the restaurant without undue delay and within 72 hours of becoming aware of it, with what we know, its likely consequences and the measures taken.
Deletion
Diners' personal data is removed from orders 90 days after each order. When the restaurant closes its account, we delete its data within 30 days, and backups that still contain it disappear within another 30 days at most.
Information and audits
We make available to the restaurant the information needed to show that we meet this agreement, and we accept its reasonable audit requests, or those of an auditor it appoints, agreeing the date and scope in advance.
International transfers
The data is processed in the United States. For transfers from the European Economic Area, the United Kingdom or Switzerland, the European Commission's Standard Contractual Clauses (controller to processor) apply and are part of this agreement, together with the EU-US Data Privacy Framework where a provider is certified.