Data Processing Agreement (DPA)
Last updated: 30 October 2026
DRAFT / SUMMARY – replace all placeholders in [SQUARE BRACKETS] and have this reviewed by a lawyer before use. For EU restaurants, a version based on the European Commission's Standard Contractual Clauses for processors (Implementing Decision (EU) 2021/915) may be used instead.
This agreement under Art. 28 GDPR, Art. 28 UK GDPR and Art. 9 of the Swiss FADP forms part of the Terms of Service for Restaurants.
Controller: the restaurant using the Mesamia restaurant software ("Restaurant"). Processor: Mesamia [RECHTSFORM], [STRASSE NR], [PLZ ORT], [LAND] ("Mesamia").
1. Subject matter and duration
1.1 Mesamia operates the restaurant software for the Restaurant (inbox, table plan/floor plan, guest book, auto-accept rules, no-show protection, guest statuses) and in doing so processes personal data on the Restaurant's behalf.
1.2 The duration is the term of the contract for the restaurant software.
1.3 This agreement does not cover processing for which Mesamia is itself the controller (guest accounts, guest apps and website, passing on requests, billing the Restaurant). The Restaurant is the controller for its own guest book notes and for using guest data in its business.
2. Types of data, data subjects, purpose
| Data subjects | The Restaurant's guests; the Restaurant's staff (users of the software) |
| Categories of data | Name, phone number, email, booking data (date, time, party size, children, high chair, dog, note, status), visit history at the Restaurant, guest status and perks, guest book notes, no-show fee status; staff login and role data |
| Special categories | Allergy information (health data) – only with the guest's explicit consent, visible only for the booking concerned, deleted 30 days after the visit |
| Purpose | Receiving and handling table requests, table and guest management, no-show protection, guest statuses, CSV export |
3. Instructions
Mesamia processes the data only on the Restaurant's documented instructions. These instructions are this agreement, the Terms of Service and the Restaurant's settings and actions in the software. If Mesamia is legally required to process data otherwise, it will inform the Restaurant beforehand where permitted. If Mesamia considers an instruction unlawful, it will inform the Restaurant.
4. Mesamia's obligations
Mesamia will:
- bind everyone with access to confidentiality;
- implement appropriate technical and organisational measures (Annex 1);
- assist the Restaurant with data subject requests (access, rectification, erasure, export), data protection impact assessments and notifications to supervisory authorities;
- report personal data breaches without undue delay, where possible within [48] hours of becoming aware;
- at the end of the contract, delete or return the data at the Restaurant's choice (CSV export for [30] days after the contract ends), unless retention is required by law;
- provide the information needed to demonstrate compliance and allow audits with reasonable notice, generally no more than once a year and at the Restaurant's cost unless there is a specific reason. Current certifications or reports should be relied on first.
5. Restaurant's obligations
The Restaurant is responsible for the lawfulness of the processing and for informing its guests, in particular for its own guest book notes. It uses allergy information only for the booking concerned.
6. Sub-processors
6.1 The Restaurant gives general authorisation for the use of sub-processors. They are currently:
| Sub-processor | Service | Location |
|---|---|---|
| Supabase [check contracting entity] | Database, authentication, hosting, backend functions | Provider in the USA; data in the EU (Frankfurt) or Switzerland (Zurich) [CHOOSE REGION] |
| Vercel [check contracting entity] | Web application hosting | Provider in the USA; EU region |
| Twilio [check contracting entity] | Sending SMS | USA |
| Resend [check contracting entity] | Sending email | USA |
| Expo [check contracting entity] | Push notifications | USA |
| Sentry [check contracting entity] | Error tracking | USA [CHECK EU DATA REGION] |
| PostHog [check contracting entity] | Product analytics [ONLY INCLUDE IF USED IN THE RESTAURANT SOFTWARE] | EU (Frankfurt) |
6.2 Stripe is not Mesamia's sub-processor under this agreement: the Restaurant has its own contract with Stripe for its Stripe account and is the merchant for no-show fees.
6.3 Mesamia will inform the Restaurant at least [30] days before adding or replacing a sub-processor (for example by email or in the software). The Restaurant may object on reasonable data protection grounds; if no agreement can be reached, it may terminate the contract.
6.4 Mesamia contractually binds sub-processors to an equivalent level of protection.
7. Transfers to third countries
Transfers to countries without adequate data protection only take place with appropriate safeguards, in particular the European Commission's Standard Contractual Clauses (with adaptations for Switzerland or the UK International Data Transfer Addendum) or, where the recipient is certified, the EU-US Data Privacy Framework, its UK Extension or the Swiss-US Data Privacy Framework.
8. Liability and final provisions
Liability is governed by the Terms of Service for Restaurants unless mandatory data protection law provides otherwise. In case of conflict on data protection matters, this agreement takes precedence over the Terms of Service. Governing law and jurisdiction follow the Terms of Service, unless Art. 28 GDPR requires the law of an EU member state [CHECK].
Annex 1 – Technical and organisational measures (summary)
- Encrypted transmission (TLS) and encryption of stored data at the hosting provider;
- Access control at database level (row-level security): restaurants see only their own data; allergy information only for the booking concerned;
- Role and permission concept for restaurant staff and Mesamia personnel; need-to-know access;
- No storage of full card details at Mesamia (only at Stripe);
- Logging of booking status changes;
- Automatic deletion of allergy information 30 days after the visit;
- Regular backups at the hosting provider; [ADD RECOVERY OBJECTIVES];
- Error monitoring and incident process; [ADD FURTHER MEASURES].