Data Processing Agreement (DPA) — Template Draft
DRAFT — legal review required. Version 0.2-draft (0.2: Appendix 1 — Scaleway also delivers e-mail, D75; Zoner kept for mailboxes and as the fallback). English only until the lawyer's Czech version exists (TODO(owner), roadmap 9.1.1–9.1.2).
Status: draft v0.1 — for your review. Not legal advice. Have a lawyer review before using with paying tenants (§0.5 of the development plan).
This template defines the relationship between the Platform (data processor — you, the reservation platform operator) and the Tenant (data controller — the restaurant/business collecting their customers' reservation data).
1. Parties
- Controller:
{Tenant name},{tenant address/ICO}, contact:{email}(hereinafter "Tenant") - Processor:
{your legal entity name},{address}, contact:{email}(hereinafter "Platform") - Effective date:
{date} - Platform service details: reservation platform operated at
reservations.bruchma.cz, tenant account slug:{tenant-slug}.
2. Subject matter and duration
The Platform processes Personal Data on behalf of the Tenant for the purpose of operating an online reservation system (service: reservation request, confirmation, reminders, invoicing-support records). This DPA applies for the duration of the Tenant's account, plus the retention period defined in §6.
3. Nature and categories of data
| Category | Examples |
|---|---|
| Natural persons | End customers who make or are named on reservations |
| Data | Name, email address, phone number, party size, reservation date/time, special notes voluntarily provided, reservation history (incl. no-show status) |
| Special categories | None intended; Tenant agrees not to submit special-category data through the service |
4. Processing details
- Purposes: fulfilling bookings, sending confirmations/reminders/cancellation notices, operating the tenant dashboard, no-show tracking, fraud/abuse prevention.
- Processing operations: collection, storage, retrieval, transmission (email notifications), deletion/anonymization.
5. Obligations of the Platform (Processor)
1. Process Personal Data only on documented instructions from the Tenant, unless required by law (in which case the Platform informs the Tenant, where permitted).
2. Ensure persons authorized to process the data are bound by confidentiality.
3. Implement appropriate technical and organizational measures (access control, encryption in transit, RLS tenant isolation, audit logging).
4. Not engage a subcontractor without the Tenant's general authorization; if engaged, bind it to this DPA's obligations (permitted subcontractors list in Appendix 1).
5. Assist the Tenant in responding to data-subject requests (access, rectification, erasure, portability) and in fulfilling its obligations regarding security of processing.
6. On termination or expiry, at the Tenant's choice, delete or return all Personal Data, unless EU/CZ law requires retention.
7. Make available to the Tenant, on request and at reasonable frequency, information to demonstrate compliance.
6. Retention
- Reservation data is retained for a configurable period (
default: 24 months) after the last reservation, after which it is anonymized or deleted automatically by the Platform, unless the Tenant configures a longer period and bears responsibility for that retention. - The Tenant may request deletion of data at any time via the platform's GDPR tool.
7. Security incidents
1. The Platform will notify the Tenant without undue delay (and where feasible within 72 hours) after becoming aware of a personal data breach affecting the Tenant's data. Breach contact of the Platform: Martin Brůžek, martin.bruzek23@gmail.com, +420722523877; backup: Patrik Chmarský, patrik.chmarsky@seznam.cz, +420777855600.
2. The Platform will provide reasonable information on the nature and impact and assist the Tenant with its own notification duties toward the supervisory authority and data subjects where required.
3. The Platform maintains a documented incident process (see §11/§14 of the development plan).
8. Data transfers outside the EU/EEA
The Platform stores and processes data on servers within the EU (Roští.cz, CZ). No transfer of Tenant Personal Data outside the EU/EEA is intended. Should that change, the Platform will notify the Tenant and put in place an appropriate transfer safeguard (e.g. SCCs) before any such transfer.
9. Audit rights
Upon reasonable notice (not less than 14 days), and no more than once per calendar year, the Tenant may request documentation demonstrating the Platform's compliance with this DPA. On-site audits are possible only where required by law or with the Platform's written consent.
10. Liabilities
Each party's liability under this DPA is subject to the limitations set out in the Platform's Terms of Service. The Platform is liable for damage caused by processing only where it has not complied with GDPR obligations specifically addressed to processors.
11. Signature / Acceptance
By creating and using a Platform tenant account, the Tenant acknowledges and accepts the terms of this DPA. Where required, a signature is obtained:
- Tenant (Controller):
___Date:___ - Platform (Processor):
___Date:___
Appendix 1 — Permitted subcontractors
| Subcontractor | Service | Location |
|---|---|---|
| Roští.cz (s.r.o.), CZ | Hosting of the primary server (application, database, Redis) | CZ/EU |
| Scaleway SAS, Paris, FR — region fr-par | (1) Transactional e-mail delivery (Scaleway Transactional Email: every booking confirmation, reminder and cancellation e-mail, and the delivery events — bounces, complaints — that come back); (2) encrypted off-site backups (Object Storage) | FR/EU |
| netcup GmbH, Karlsruhe, DE | Standby server (a replica of the database, taking over only on failover) | DE/EU |
| ZONER a.s. (IČO 49437381), Brno, CZ | The operator's own mailboxes (e.g. info@, the bounce mailbox), and fallback e-mail delivery (SMTP) used only while Scaleway's is switched off | CZ/EU |
| Better Stack s.r.o. (CZ) — EU data region | Uptime and heartbeat monitoring, logs (redacted before sending: no guest e-mail addresses, phone numbers or booking tokens) and error reports | CZ/EU |
On transfers. Every subprocessor above stores data inside the EU, so no Chapter V transfer mechanism is required. For Scaleway this is a property of the _configuration_: both services run in the fr-par region, and moving either to a non-EU region would change this table and require a reissued DPA. Error reports go to Better Stack (EU) through the Sentry-compatible SDK; Sentry itself is not used (decision D31), so it is no longer listed.
DNS is hosted at deSEC (Berlin); it holds the domain's public records only and processes no personal data of the Tenant's guests, so it is not a subcontractor under this DPA.
Version: 0.2 (draft, 2026-10-19) — replace with final after review.