Data Processing Agreement for Partners

Informative translation. In case of doubt, the Spanish version prevails.

Article 28 of Regulation (EU) 2016/679 (GDPR) · Addendum to the Data Processing Agreement · Version 1.0 · 2026-10-26

1. Parties and roles

Data controller: each restaurant that subscribes to the elpizzero service through the Partner and owns its account and its customers' data.

Data processor: elpizzero, under the Data Processing Agreement accepted by each restaurant.

Sub-processor: the Partner (agency, distributor, consultancy or provider) that accepts this addendum when signing up for the Partner programme or accessing its dashboard.

The Partner processes that data on behalf of elpizzero and, through elpizzero, on behalf of each restaurant. elpizzero imposes on the Partner the same data protection obligations that apply to it in relation to the restaurant (Article 28.4 of the GDPR) and grants access only to the restaurants under the Partner's management.

2. Purpose and duration

The purpose is to enable the Partner to add, configure and support its restaurants within the platform: menus, orders, POS, kitchen displays, bookings and venue configuration.

This addendum remains in force for as long as the Partner participates in the programme and, for each restaurant, while that restaurant is under its management. The confidentiality obligations survive termination.

3. Data and data subjects

Data subjects: restaurants' end customers and restaurant staff and users.

Data: identification and contact details (name, telephone number, email address and delivery address), orders, bookings and history, and restaurant account data. Tax data and VERI*FACTU settings only where the restaurant account holder gives the Partner express permission through the dashboard.

Processing operations: viewing, recording, amending and configuring data within the platform. The Partner may not delete a restaurant's account or remove it from the system.

4. Instructions and prohibition on use for own purposes

The Partner processes the data solely to provide the elpizzero service to that restaurant and in accordance with these instructions. If it believes that an instruction infringes applicable legislation, it must notify elpizzero immediately.

The use of data for the Partner's own purposes or those of third parties is prohibited: it may not copy the data to its own databases, send marketing communications to restaurants' customers or disclose the data to any person. If the Partner provides the restaurant with any of its own additional services involving personal data, it acts as the restaurant's direct processor under its own agreement with the restaurant.

The Partner may not engage another sub-processor without elpizzero's prior written authorisation.

5. Confidentiality and security

The Partner keeps the data confidential and ensures that members of its team who access the dashboard are bound by confidentiality obligations and can access only what they need.

It implements appropriate technical and organisational measures (Article 32 of the GDPR): individual, non-transferable accounts, secure passwords, protected devices and immediate withdrawal of access from anyone who ceases to work for it. Every access to a restaurant's dashboard is logged.

6. Personal data breaches

The Partner notifies elpizzero, without undue delay and no later than 48 hours after becoming aware of it, of any security breach affecting that data, providing the information available, so that elpizzero and the restaurant can fulfil their notification obligations.

7. Rights of data subjects

If a data subject contacts the Partner to exercise their rights, the Partner refers the request to elpizzero and the restaurant within a maximum of 5 days and assists them in responding.

8. Return and deletion

When a restaurant is no longer under the Partner's management or the Partner leaves the programme, elpizzero withdraws its access. Within 15 days, the Partner deletes any copy of that data held outside the platform and, if requested, certifies this in writing. The data remains in the restaurant's account, which belongs to the restaurant.

9. Audit

The Partner makes available to elpizzero and the restaurant all information necessary to demonstrate compliance with this addendum and permits reasonable audits and inspections conducted by them or by an auditor appointed by them.

10. Liability and governing law

Each party is liable for its own breaches in accordance with the GDPR and Organic Law 3/2018. If the Partner breaches this addendum, elpizzero may withdraw its access immediately and suspend its Partner account. This addendum is governed by Spanish and European Union law.

Data protection enquiries: privacidad@elpizzero.com.