DATA PROCESSING AGREEMENT
Personal information processing agreement
This agreement applies when Gère ton resto processes personal information about a client restaurant’s guests on behalf of that restaurant (the “Client”). It forms part of the terms of service and is accepted with them. The French version prevails.
01
Roles of the parties
The Client operates the business and is responsible for its guests’ personal information within the meaning of the Act respecting the protection of personal information in the private sector.
Gère ton resto acts as a service provider and processes that information only on the Client’s behalf.
02
Purpose and information covered
Gère ton resto processes the information needed to provide the subscribed service, including:
- name, email, phone, language and notes of people who book;
- reservation history and guest records;
- order and invoice information, when the POS module is used.
03
Limited use
Gère ton resto uses this information only to provide the service to the Client and according to its instructions, as expressed through the service configuration. Gère ton resto does not use it for its own purposes, does not sell it and does not disclose it, except to the sub-processors listed below or where required by law.
04
Security measures
Gère ton resto takes reasonable measures to protect the confidentiality of the information, including:
- encrypted communications (HTTPS);
- isolation of each restaurant’s data through database access rules;
- privileged access keys kept server-side only;
- internal access limited to people who need it, bound by confidentiality;
- protection of public forms against abusive submissions.
05
Sub-processors
The Client authorizes Gère ton resto to use the following providers: Supabase (database hosting in Canada), Vercel (web hosting), Brevo (email delivery to the restaurant’s guests) and Stripe (payment of the Client’s subscription).
Gère ton resto imposes confidentiality and security obligations on these providers that are at least equivalent. Any addition or replacement is announced to the Client at least 30 days in advance; a Client who objects may terminate its subscription.
06
Communication outside Quebec
Some providers are located outside Quebec (notably Vercel and Brevo). On request, Gère ton resto provides the Client with the information needed for the privacy impact assessment the law requires before such communication.
07
Confidentiality incidents
Gère ton resto notifies the Client without delay, and no later than 72 hours after becoming aware of it, of any confidentiality incident affecting its information. Gère ton resto provides the available information to assess the risk of serious injury and helps the Client notify the Commission d’accès à l’information and the people concerned, where applicable.
08
Requests from individuals
If Gère ton resto receives an access, correction or deletion request from a restaurant guest, Gère ton resto forwards it to the Client. The service lets the Client view, correct and delete reservations and guest records; Gère ton resto helps as needed to respond within legal deadlines.
09
End of the agreement
When the subscription ends, the Client may request an export of its information. Gère ton resto then destroys it within the periods set out in the privacy policy, except information the law requires to be kept, which remains protected by this agreement until it is destroyed.
10
Verification
On reasonable request, Gère ton resto provides the Client with the information needed to demonstrate compliance with this agreement. Contact: resto360mtl@gmail.com.