Azayn

Scan2Eat Data Processing Agreement

Last updated: 17 October 2026

This agreement under Art. 28 GDPR is part of the Terms of Service. The parties are the business that uses Scan2Eat (the "Controller") and the provider named in our Legal information ("Azayn", the "Processor").

1. Subject, duration, nature and purpose

1.1 Azayn processes personal data on behalf of the Controller to provide the Service: ordering from a table or room, order handling, user administration, and the optional inventory, payment-interface and QR display device features.

1.2 It runs for the term of the Terms of Service plus the deletion period in the Retention and Deletion Policy.

1.3 Annex I describes the processing, and Annex II the security measures.

2. Instructions

2.1 Azayn processes personal data only on the Controller's documented instructions: the Terms, this agreement, the settings the Controller's users make in the Service, and further written instructions. The exception is where EU or Member State law requires otherwise, in which case Azayn tells the Controller beforehand where it may.

2.2 Azayn tells the Controller if it believes an instruction breaks data protection law.

3. Confidentiality

People authorised to process the data are bound to confidentiality, and have access only where they need it.

4. Security (Art. 32)

Azayn applies the measures in Annex II. It may update them as long as the overall level of protection does not fall.

5. Sub-processors

5.1 The Controller gives general authorisation for the sub-processors on the Sub-processors page.

5.2 Azayn tells the Controller by email and in the app at least 30 days before it adds or replaces a sub-processor. The Controller may object on reasonable data protection grounds within 14 days. If the parties cannot resolve the objection, the Controller may end the affected service from the date of the change, without penalty.

5.3 Azayn gives each sub-processor data protection obligations no less protective than this agreement and remains responsible for them as the law provides.

6. Transfers outside the EEA

Processing takes place mainly in the EU. Where a sub-processor processes personal data outside the EEA, Azayn ensures a valid transfer mechanism under Art. 44 ff. GDPR: an adequacy decision, certification under the EU-US Data Privacy Framework, or the Standard Contractual Clauses (EU 2021/914), Module Three (processor to processor) or Module Two (controller to processor), incorporated by reference, with supplementary measures where needed. For Controllers in the United Kingdom, Switzerland or other places with their own transfer rules, the parties will agree the applicable addendum on request.

7. Assistance

7.1 Requests from data subjects. Azayn passes on to the Controller, without undue delay, any request it receives, and gives the Controller tools (search, export and deletion functions) and reasonable help to answer requests. Guests are anonymous, so the Controller must supply identifying details (table, time, items) to find their data.

7.2 Azayn helps the Controller, with the information available to it, with security, breach notification, data protection impact assessments and prior consultation (Arts. 32 to 36).

8. Personal data breaches

Azayn tells the Controller without undue delay, and in any case within 48 hours, after becoming aware of a breach that affects the Controller's personal data. It gives the information it has (nature, categories and approximate numbers, likely consequences, measures taken) and adds to it as more becomes known. Notices go to the administrator's email address on the account.

9. Deletion and return

When the contract ends, or earlier on request, Azayn makes the data available for export and then deletes it as the Retention and Deletion Policy describes (14-day cancellation period, the business's database is dropped, backups age out within 30 days), unless the law requires it to be kept. On request Azayn confirms the deletion in text form.

10. Audits

Azayn gives the Controller the information needed to show compliance, including current security documentation. It allows and contributes to audits by the Controller or an independent auditor bound to confidentiality, once per 12 months with 30 days' notice, in business hours and without disrupting operations. Additional audits are possible where a supervisory authority requires one or after a breach. The Controller bears the cost of audits beyond reasonable support.

11. The Controller's duties

The Controller makes sure it has a legal basis for the processing, gives guests the notices required (the Privacy Policy has a short guest notice), does not ask guests to submit special-category data unless the law allows it, and sets retention in line with its legal duties, such as tax law.

12. Liability

Liability under this agreement follows the limits in the Terms of Service, as far as Art. 82 GDPR and other mandatory law allow.

13. Final provisions

Governing law and courts are those of the Terms of Service, subject to mandatory law and the Standard Contractual Clauses. If this agreement and the Terms conflict on personal data, this agreement prevails, and the Standard Contractual Clauses prevail over both where they apply.

Annex I: Description of the processing

  • Controller: the business, as named at signup.
  • Processor: the provider named in our Legal information.
  • Data subjects: guests of the Controller (anonymous, with automatically generated nicknames), and the Controller's administrators, managers, staff and kitchen users.
  • Categories of data, guests: automatically generated nickname, session identifiers, table or room identifier, order contents and notes, timestamps, and IP address and browser data for security.
  • Categories of data, staff and administrators: name, email address, role, a hashed password, assignments, audit-log entries and social sign-in identifiers.
  • Categories of data, venue: menu, prices, tables and rooms, device identifiers, and, if used, suppliers and stock.
  • Special categories: not intended. A guest could type health information, such as an allergy, in a free-text note. The guest app tells guests not to, notes are cleared after 30 days, and the Controller is responsible for a valid basis under Art. 9(2) GDPR if it encourages or requires such entries.
  • Nature of processing: hosting, storage, transmission, display to staff and kitchen, printing of kitchen tickets through the user's browser, backup and deletion.
  • Purpose: providing the Service under the Terms.
  • Frequency: continuous.
  • Retention: as the Retention and Deletion Policy sets out.
  • Location: the EU (Hetzner, Germany or Finland).

Annex II: Technical and organisational measures

  • Access and sign-in: role-based access (Admin, Manager, Staff, Kitchen), hashed passwords, sign-in with Google or Microsoft through OAuth, httpOnly session cookies scoped to the business, rate limiting on sign-in and other sensitive endpoints.
  • Separation of businesses: a separate database for each business, and guest sessions limited to their table session.
  • Encryption: TLS for traffic in transit, and backups encrypted before they are stored in object storage.
  • Devices: unique credentials for each QR display device, signed firmware, and short-lived QR tokens validated by the server.
  • Logging and audit: an audit log of order, bill, user-role, price and settings changes, and security logs with IP addresses kept for up to 30 days.
  • Availability: stateless application servers, scheduled backups to Hetzner Object Storage, and a documented recovery procedure.
  • Vulnerabilities and incidents: dependency scanning and patching, an incident response procedure, and the breach notice in section 8.
  • Organisation: confidentiality obligations, least-privilege access to production systems, vetting of sub-processors, and data minimisation by default (no analytics or trackers in the guest app, and short retention for IP addresses and notes).
  • Deletion: automated retention jobs, deletion of the business's database on termination, and backups that age out within 30 days.