Data Processing Agreement

Informative translation. In case of doubt, the Spanish version prevails.

Article 28 of Regulation (EU) 2016/679 (GDPR) · Version 2026-10-01

1. Purpose

The Controller entrusts elpizzero with the processing of personal data necessary to provide the services of the platform: digital menu, receipt and management of orders, POS, bookings, notifications, invoicing and associated tools. elpizzero will process such data only on behalf of and in accordance with the documented instructions of the Controller.

2. Duration

This agreement is in force for as long as there is a service relationship between the parties. Upon its termination, clause 9 (return/erasure) will apply.

3. Nature, purpose and data processed

• Categories of data subjects: end customers of the restaurant and, where applicable, staff/users of the restaurant.
• Types of data: identification and contact data (name, telephone, email, delivery address), order and payment data (handled by the payment provider), and order history. Special categories are not processed intentionally.
• Purpose: exclusively the performance of the services contracted by the Controller.

4. Obligations of elpizzero (Processor)

1. To process the data only in accordance with the documented instructions of the Controller, including as regards international transfers, unless required by law. If, in its opinion, an instruction infringes the GDPR or another data protection rule, elpizzero will immediately inform the Controller (Art. 28.3 GDPR).
2. To ensure confidentiality and that the persons authorised undertake to observe it.
3. To apply appropriate technical and organisational measures (Art. 32 GDPR): encryption of sensitive credentials, role-based access control, isolation of data between restaurants, encrypted backups and activity logging.
4. To assist the Controller in responding to requests for the exercise of data subjects' rights (access, rectification, erasure, objection, portability, restriction).
5. To assist the Controller in complying with Arts. 32 to 36 (security, notification of breaches and impact assessments).
6. To notify the Controller without undue delay and, at the latest, within 48 hours after becoming aware of a security breach affecting its data, with the information necessary for the Controller to comply with its duty to notify the authority (72 h) and, where applicable, the data subjects.
7. To make available to the Controller the information necessary to demonstrate compliance and to allow reasonable audits.

5. Sub-processors

📣 Changes announced on 2 October 2026, in force from 18 October 2026: ipwho.is is no longer used (the approximate location of the IP is now calculated on our own server); email is provided by Hostinger, which is already listed as a sub-processor; and the OpenStreetMap services are also used for the maps on the order tracking page. In addition, section 4 sets down in writing your instruction for us to handle on your behalf the erasure requests from your customers received on the platform, retaining what the law requires to be kept. You may object by writing to privacidad@elpizzero.com before that date (art. 28.2 GDPR).

The Controller authorises elpizzero to use the following sub-processors to provide the service, elpizzero undertaking to impose on them equivalent data protection obligations:

• Hostinger — hosting and infrastructure (servers in the EU).
• Stripe — payment processing (when the restaurant activates it with its own keys).
• SMTP email provider — sending of notifications and communications.
• OpenAI (United States) — translation of the menu and of the notes that the customer writes in their order, and reading of menus and invoices; without name, telephone, email or address.
• Twilio (United States) — automated notification calls to the restaurant, when activated (restaurant's telephone).
• Telegram — order notifications to the restaurant, only if the Controller activates them; they carry only the number and amount of the order, no data of its customers (Telegram does not offer a processor agreement, so none is entrusted to it).
• hCaptcha · Intuition Machines (United States) — protection against bots on the public forms (IP and browser data).
• Address search and route calculation services based on OpenStreetMap (Nominatim, OSRM, openrouteservice) — delivery address.
• Reparto — last-mile logistics platform (api.elpizzero.es), only if the Controller activates the «Reparto» integration and provides its own token. From each home-delivery order it receives what is indispensable to carry out the delivery: delivery address and coordinates, contact telephone, amount to be collected and details of the order. It processes those data exclusively on behalf of the Controller and is subject to obligations equivalent to those of this agreement. Erasure: when the Controller orders the deletion of a customer's data, the instruction is automatically communicated to Reparto, which erases the address, coordinates, telephone, notes and details of the order, retaining only non-identifying operational data (status, dates and amounts).

The current list is available and will be updated in this document. elpizzero will report changes of sub-processors, giving the Controller the possibility to object.

Third-party tools that the Controller decides to activate on its menu with its own account (for example, the Meta pixel, which is only loaded if the customer accepts marketing cookies) are not sub-processors: that provider processes the data as a controller, jointly with the Controller, and not on behalf of elpizzero (Judgment of the Court of Justice of the EU of 29 July 2019, Fashion ID, Case C-40/17).

5 bis. Use of artificial intelligence

Some functions of the platform use artificial intelligence services (currently OpenAI, USA, with adequate transfer safeguards) for: scanning of menus (extracting categories and products from photos or PDFs of the restaurant), scanning of supplier invoices (accounting and inventory), translation of the menu and of texts into other languages, and inventory detection and generation of supporting content.

Only the necessary content is sent and data of end customers are not intentionally sent; occasionally, a translation could include free text written by the customer (e.g. an order note). The Controller authorises this processing by AI by accepting this agreement and undertakes not to enter unnecessary personal data in these functions. Each function that uses AI is identified as such in the panel, in accordance with the principles of transparency (including Regulation (EU) 2024/1689 on AI).

6. Obligations of the Controller (restaurant)

• To ensure the legal basis for the processing it entrusts and the information to data subjects.
• To have its own privacy policy and correct tax identification in its profile.
• Not to enter special categories of data into the platform without an adequate basis.

7. Location of the data and transfers

The data are hosted on servers located in the European Union. If any sub-processor were to involve an international transfer, it will be carried out with the safeguards of Chapter V of the GDPR (adequacy decision or standard contractual clauses).

8. Security breaches

In the event of a personal data breach, elpizzero will follow its response protocol and will notify the Controller in accordance with clause 4.6 so that the latter can comply with Art. 33 GDPR (notification to the supervisory authority within 72 h where applicable).

9. Return or erasure on termination

Upon termination of the service, and at the choice of the Controller, elpizzero will return or erase the personal data processed on its behalf, together with any existing copies, unless there is a legal obligation to retain them.

10. Liability and governing law

Each party is liable for the breach of its obligations in accordance with the GDPR and Organic Law 3/2018 (LOPDGDD). This agreement is governed by Spanish and EU law.

Acceptance of this agreement is recorded with date, version and IP address upon registration or upon accepting it from the panel. Last updated: 2026-10-01.