Data processing addendum

This data processing addendum ("DPA") forms part of the DrinksQR terms of service. It sets out how we process personal data on behalf of venues, as required by Article 28(3) of the UK GDPR.

1. Parties and roles

The venue that uses DrinksQR is the controller. SimplySIM Solutions Ltd, trading as DrinksQR (company number 16302568, registered office 4 Gallowsfield Walk, Market Drayton, England, TF9 3FP, ICO registration ZB960469), is the processor. Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR. If this DPA and the terms conflict on data protection, this DPA prevails.

2. Subject matter and duration

The subject matter is the processing of personal data needed to provide DrinksQR to the venue: taking customer orders from table QR codes, showing them on the bar screen, recording which staff member handled them, reporting on them in the back office, and keeping the venue's optional mailing list of customers who consented to its marketing. Processing lasts for as long as the venue uses DrinksQR, including any free trial, and then until the data is deleted under section 12.

3. Nature and purpose

We collect, store, organise, display, transmit, aggregate and delete personal data, only so that the venue can receive and fulfil orders, run its bar screen, see its reports and keep its mailing list with a record of consent. We do not send the venue's marketing emails. We do not use this data for our own purposes, for marketing, or to build profiles of customers.

4. Types of personal data

• Order data: table, items and options, any notes, an optional first name, total, language, timestamps and order status.
• Staff data: a name, a colour, a PIN held only as a bcrypt hash, and which staff member moved each order on.
• Mailing list data (optional): the email address of a customer who ticks the box to receive the venue's news and offers, the consent record (wording shown, language, date and time, source, and a keyed hash of the IP address), the subscription status, any unsubscribe date and method, and a history of these consent events.
• Technical data: IP addresses of people placing orders, held only as a keyed hash for up to 24 hours to rate-limit orders and prevent abuse.

The service is not designed for special category data. The venue should not ask customers to enter health or other special category data in order notes.

5. Categories of data subjects

• The venue's customers who place orders.
• The venue's customers who choose to join its mailing list.
• The venue's staff who use the bar screen.

6. Instructions

We process personal data only on the venue's documented instructions, including with regard to international transfers. The terms, this DPA and the venue's use and settings of the service are the venue's complete instructions. If the law requires us to process data in another way, we will tell the venue before doing so, unless the law prohibits that. We will tell the venue promptly if we believe an instruction breaks data protection law.

7. Confidentiality

Everyone we authorise to process the data is bound by a duty of confidentiality, whether by contract or by law, and only has access to the extent needed to provide, support or secure the service.

8. Security

We take appropriate technical and organisational measures under Article 32 of the UK GDPR. They currently include:

• HTTPS for all traffic, with strict transport security and other security headers;
• passwords and PINs stored only as bcrypt hashes, and email links stored only as one-way hashes;
• IP addresses held only as keyed hashes, never in readable form: for rate limiting they are removed after 24 hours, and a consent record keeps only the keyed hash as evidence;
• each mailing-list contact has a personal unsubscribe link derived with a secret key, and only a hash of it is stored;
• customer names and order notes removed automatically 24 hours after an order was last updated;
• access control: each venue account can only see its own venues, staff PINs only open the bar screen, and sign-ins expire after 12 hours;
• CSRF protection and rate limiting on sign-in, sign-up and ordering, and unguessable table codes.

We may update these measures over time, as long as the overall level of security is not reduced.

9. Sub-processors

The venue gives general authorisation for us to use sub-processors. Our current sub-processor is:

We will give the venue at least 30 days' notice by email before adding or replacing a sub-processor. The venue may object on reasonable data protection grounds within that period; we will then work with the venue in good faith to resolve it. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible to the venue for their performance.

10. Helping the venue

• Data subject rights. Taking into account the nature of the processing, we will help the venue, by appropriate technical and organisational measures, to respond to requests from data subjects to exercise their rights. If a customer or staff member contacts us directly, we will pass the request to the venue and will not respond ourselves unless the venue asks us to.
• Other obligations. We will help the venue meet its obligations on security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the information available to us.

11. Personal data breaches

We will notify the venue without undue delay after becoming aware of a personal data breach affecting its data. We will give the venue the information it reasonably needs to meet its own obligations, including the nature of the breach, the likely consequences and the measures taken or proposed, and will update it as more information becomes available.

12. Deletion or return at the end

When the venue's use of DrinksQR ends, we will delete the venue's personal data within 30 days, unless UK law requires us to keep it. Before then, the venue can ask us for a copy of its data in a common format. Separately, customer names and order notes are always removed 24 hours after an order was last updated.

13. Information and audits

We will make available to the venue all information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, and will allow for and contribute to audits, including inspections, by the venue or an auditor it appoints. Audits must be on reasonable notice, during normal business hours, and subject to confidentiality, and must not compromise the security of other venues' data.

14. International transfers

The service and its data are hosted in the United Kingdom. We will not transfer the venue's personal data outside the UK unless the transfer is covered by UK adequacy regulations or by appropriate safeguards under the UK GDPR, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Access by our hosting provider's staff from the European Economic Area is covered by the UK's adequacy regulations for the EEA.

15. Liability and changes

Each party's liability under this DPA is subject to the limitations and exclusions in the terms, except where the law does not allow that. We may update this DPA to reflect changes in the law or in the service; we will notify venues of material changes by email at least 30 days in advance. Questions about this DPA: hello@drinksqr.com.