1. Scope and parties
This Data Processing Agreement ("DPA") forms an integral part of the Terms of Service and takes effect between the business subscribing to Qungry ("Customer", data controller) and Ae Telecom ("Qungry", data processor) on the date the Terms of Service are accepted.
The DPA applies to personal data Qungry processes on the Customer's behalf when providing the Service. If there is a conflict between the Terms of Service and this DPA regarding personal data, the DPA prevails.
2. Details of the processing
- Subject and purpose: Providing, supporting and securing the restaurant management software (till, orders, delivery, QR menu, ordering site, reservations, reporting, mobile apps and integrations).
- Duration: For the term of the Terms of Service and, after they end, for the retention period in clause 11 of the Terms of Service.
- Data subjects: The Customer's guests and customers, staff (waiters, cashiers, couriers, managers), suppliers and other business contacts.
- Categories of data: Full name, phone, email, delivery address, order contents and notes, order and payment records (excluding card data), loyalty points and coupon use, reservation details, ratings and reviews, staff details (name, role, hashed PIN, work records, till transactions, tip and service charge distribution), courier location data (latitude, longitude, accuracy and time; only the latest location, while the courier is carrying an order), device and session records.
- Special category data: The Service is not designed to process special category data. A guest's allergy or dietary information written in order notes may count as health data; the Customer ensures such information is entered only as far as needed to prepare the order.
3. Qungry's obligations
Qungry:
- processes personal data only on the Customer's documented instructions. The Terms of Service, this DPA and the settings the Customer makes in the Service (e.g. connecting an integration) count as instructions. If it believes an instruction breaches data protection law, it informs the Customer.
- ensures that staff who access the data are bound by confidentiality, and limits access to the people and extent the task requires. A restaurant's account is accessed for support only at the Customer's request or where needed for security or fixing errors.
- applies the technical and organisational security measures set out in Annex 1.
- does not use the data for its own purposes, sell it or process it for advertising.
- reasonably assists the Customer in responding to data subjects' requests (access, rectification, erasure, portability, etc.) and forwards requests it receives directly to the Customer without delay.
- assists the Customer with data protection impact assessments and consultations with supervisory authorities, taking into account the nature of the processing and the information available to it.
4. Sub-processors
- The Customer gives general authorisation for Qungry to use the service providers listed on the Sub-processors page.
- Qungry updates the list and notifies the Customer by email or in the panel at least 30 days before adding or replacing a sub-processor. The Customer may object within this period on reasonable data protection grounds. If the parties cannot find a solution, the Customer may terminate the affected Service and the fee for the unused period is refunded.
- Qungry enters into written agreements with sub-processors providing essentially the same protection as the obligations in this DPA, and remains liable to the Customer for the sub-processors' obligations.
- Services connected by the Customer: Delivery platforms (Uber Eats, Just Eat, Deliveroo), payment and card terminal providers (Stripe, SumUp) and similar services the Customer connects with its own account are not Qungry's sub-processors. The relationship with them is governed by the Customer's own agreement; Qungry only sends data to or receives data from these services on the Customer's instructions.
5. International transfers
Personal data is hosted in France; backups are kept in the Netherlands. Where data is transferred outside the European Economic Area or the United Kingdom to a country without an adequacy decision, Qungry relies on appropriate safeguards such as the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum (IDTA / Addendum), and takes additional measures where needed.
Qungry's support and development team is based in Türkiye; the team's access to data on the servers counts as a transfer under this clause and is subject to the same safeguards.
6. Personal data breaches
When Qungry becomes aware of a personal data breach affecting the Customer's data, it informs the Customer without undue delay and within 48 hours at the latest. The notice includes, as the information becomes available, the nature of the breach, the categories of data and approximate number of people affected, the likely consequences, the measures taken or proposed, and a contact person. Qungry takes the measures needed to mitigate the effects of the breach and helps the Customer meet its obligation to notify the authority and the people affected.
7. Return and deletion of data at the end of the agreement
When the Terms of Service end, Qungry exports the data in a commonly used format (e.g. CSV / JSON) at the Customer's request within the retention period, and deletes the data at the end of that period. Copies in backups are deleted within the normal backup cycle. Data the law requires to be kept is kept only for that obligation and for its duration.
8. Information and audits
Qungry provides information demonstrating compliance with this DPA at the Customer's written request. Where this information is not sufficient, the Customer may carry out an audit itself or through an independent auditor, provided it gives at least 30 days' notice, does so no more than once a year, during working hours and under confidentiality. Audit costs are borne by the Customer unless a material breach by Qungry is found.
9. Customer obligations
The Customer confirms that it collects the data on a lawful legal basis, that it has given the data subjects (guests, staff) the required information (e.g. by publishing a privacy policy on its ordering site), and that its instructions to Qungry comply with the law.
If the courier app is used, it is the Customer's responsibility to determine the legal basis for location tracking, inform couriers in advance and meet obligations arising from employment law (e.g. obtaining the approval of employee representatives in countries where this is required).
10. Liability and term
Liability under this DPA is subject to the liability provisions of the Terms of Service, except for liabilities that the law does not allow to be limited. The DPA remains in force for as long as Qungry processes personal data on the Customer's behalf.
Annex 1 — Technical and organisational security measures
- Encryption: HTTPS/TLS on all connections; API keys, payment provider keys and saved card tokens encrypted in the database; passwords and PIN codes one-way hashed.
- Data separation: Each restaurant's data is kept in a separate database.
- Access control: Role and permission-based access; per-branch permissions; till and waiter devices recognised by a registration key; session time limits.
- Payment data: Card numbers are never processed or stored on Qungry's servers; payments are taken through the provider's secure page or terminal.
- Abuse protection: Rate limiting on sign-in and public forms, cross-site request forgery (CSRF) protection, signature verification on platform notifications.
- Backup and continuity: Daily automatic backups; backups are kept encrypted for 30 days in Backblaze's Amsterdam (Netherlands) data centre; offline operation at the till against internet outages.
- Monitoring: Logging and monitoring of errors and security events; personal data is kept out of error logs as far as possible.
- Staff: Confidentiality undertakings, the principle of least privilege, access removed when a role ends.
- Development: Regular application of security updates and testing of changes.