# Data Processing Agreement

Last updated: 3 August 2026

## 1. Parties and scope

This agreement is between the venue using GoRunny (the **Controller**) and **Avant Systems, trading as GoRunny** (the **Processor**). It is entered into under Article 28(3) GDPR and forms part of the [Terms of Service](https://www.gorunny.com/terms). It applies whenever we process personal data on your behalf.

Version 2026-08-03, effective 3 August 2026.

Where we determine our own purposes — for example securing the platform, billing you, or product analytics on our own infrastructure — we act as an independent controller for that processing, and our [Privacy Policy](https://www.gorunny.com/privacy) applies instead.

## 2. Subject matter, duration, nature and purpose

- **Subject matter:** providing the GoRunny QR ordering, payment-routing, fiscalization and loyalty platform.
- **Duration:** for as long as your subscription is active, plus the deletion window in clause 9.
- **Nature and purpose:** collection, storage, structuring, retrieval, transmission to systems you connect (POS, payment provider, fiscal provider) and erasure, all for the purpose of operating the service you subscribe to.

## 3. Categories of data subject and personal data

**Data subjects:** your guests, your loyalty members, and your staff users.

**Categories of personal data:**

- Guests: table session and device identifiers, order contents, timestamps, amounts, tips, payment confirmation references.
- Loyalty members: name, email address and/or phone number, visit and order history at your venue, stamps, rewards and redemptions.
- Staff users: name, email address, role, and authentication and device-trust records.
- Free-text order notes, which may contain whatever a guest types.

**Special categories.** We do not ask for special-category data. Dietary and allergen preferences a guest chooses to enter may reveal health information. Instruct your staff not to record health data in free-text notes, and treat any that appears as special-category data under Article 9.

**Children.** The platform is not directed at children and we do not knowingly process their data beyond what an order requires.

## 4. Our obligations as processor

- We process personal data only on your documented instructions, including on international transfers, unless EU or member-state law requires otherwise — in which case we will tell you before processing, unless that law forbids it. Your use of the platform and its settings constitutes your documented instructions.
- We will tell you if, in our opinion, an instruction infringes the GDPR.
- Everyone we authorise to process the data is bound by confidentiality.
- We implement the technical and organisational measures in clause 5 (Article 32).
- We will not sell personal data, and we will not use your guests' data for our own marketing.

## 5. Security measures (Article 32)

- Encryption in transit (TLS) for all guest, staff and API traffic; HSTS enforced.
- Encryption at rest for stored integration credentials and provider secrets.
- Role-based access control, per-venue tenant isolation enforced in the application and on realtime channels, and individual staff accounts with a trusted-device layer.
- Rate limiting and abuse protection on guest-facing and authentication endpoints.
- Card data is never stored by us: payment details are captured directly by our payment provider.
- Encrypted backups with a documented restore procedure that is periodically tested.
- Automated retention jobs that purge guest telemetry and dormant identifiers on schedule.
- Logging and error monitoring, and an audit trail on orders, refunds and fiscal records.

## 6. Sub-processors

You give general written authorisation for us to engage the sub-processors below. We impose data-protection obligations on each that are no less protective than this agreement, and we remain fully liable to you for their performance.

| Sub-processor | Purpose | Location / transfer basis |
| --- | --- | --- |
| Stripe | Card payment processing and subscription billing. | Stripe Payments Europe Ltd (Ireland); Stripe, Inc. (USA) — Standard Contractual Clauses. |
| Google (Firebase Cloud Messaging, Google Sign-In) | Push notifications to guest and staff devices, and Google sign-in where a user chooses it. | Google Ireland Ltd; Google LLC (USA) — Standard Contractual Clauses / EU–US Data Privacy Framework. |
| fiskaly | RKSV fiscal receipt signing for venues in Austria. | fiskaly GmbH, Austria — EU. |
| Cloudflare | Content delivery, TLS termination and DDoS protection for gorunny.com. | Cloudflare, Inc. (USA), with EU edge processing — Standard Contractual Clauses. |
| Mailjet | Transactional and, where consented, marketing email delivery. | Mailjet SAS, France — EU. |
| Sentry | Application error monitoring. Configured to scrub request bodies and personal identifiers. | Functional Software, Inc. (USA) — Standard Contractual Clauses. |
| The venue's point-of-sale provider | Sending order and invoice data to the till, where the venue has connected one (ready2order, Lightspeed, gastronovi, helloCash, SumUp). | Determined by the venue's own provider agreement — EU providers unless the venue chooses otherwise. |
| The venue's payment provider | Processing guest payments where the venue selects a provider other than Stripe (Mollie, SumUp, Unzer). | Determined by the venue's own provider agreement — EU providers unless the venue chooses otherwise. |

**Changes.** We will give you at least 30 days' notice before adding or replacing a sub-processor. If you have a reasonable data-protection objection, tell us within those 30 days and we will work with you on an alternative; if we cannot find one, you may terminate the affected part of the service and we will refund the unused portion of any prepaid fees.

## 7. International transfers

Personal data is hosted in the European Union. Some sub-processors above are US-based or may transfer data outside the EEA; where they do, transfers are covered by the EU Standard Contractual Clauses, an adequacy decision, or the EU–US Data Privacy Framework where the recipient is certified, together with supplementary measures where needed.

## 8. Assistance to you

- **Data subject requests.** The platform gives you self-service tools to find, export and erase the records of a guest or loyalty member. If a data subject contacts us directly about your venue, we will not respond substantively — we will refer them to you and tell you promptly.
- **Breach notification.** We will notify you without undue delay and in any event within **48 hours** of becoming aware of a personal data breach affecting your data, with the information you need for your own Article 33 notification.
- We will provide reasonable assistance with data protection impact assessments and prior consultations under Articles 35 and 36.

## 9. Deletion and return

On termination you may export your data for 30 days (see clause 9 of the [Terms](https://www.gorunny.com/terms)). After that window we delete or irreversibly anonymise personal data processed on your behalf, including from backups on their normal rotation cycle. We retain what EU or member-state law requires us to keep — in particular fiscal and payment records, retained for the statutory period (7 years in Austria) — and that retained data stays subject to this agreement.

## 10. Audit

On reasonable written request, no more than once a year (unless a breach or a supervisory authority requires otherwise), we will provide the information needed to demonstrate compliance with Article 28. Where documentation is not enough, we will permit an audit by you or an independent auditor you appoint who is not our competitor, on at least 30 days' notice, during business hours, without unreasonable disruption, and subject to confidentiality. You bear the cost unless the audit reveals material non-compliance.

## 11. Liability and precedence

Liability under this agreement is subject to the limits in clause 11 of the [Terms of Service](https://www.gorunny.com/terms). If this agreement conflicts with the Terms on the processing of personal data, this agreement prevails.

## 12. Signing this agreement

Accepting the Terms of Service in the dashboard accepts this agreement too, and we record the version and timestamp of your acceptance. If your organisation needs a countersigned copy for its records, email [privacy@gorunny.com](mailto:privacy@gorunny.com) and we will provide one.

Source: https://www.gorunny.com/dpa