Data Processing Agreement

This agreement covers the personal data of your guests that we process for you while you use Portano. Annex A writes down which data that is, what we process it for and for how long.

You are the controller. You decide which data you ask your guests for, what you use it for, which campaigns you send and how long you want to keep it, within what the law allows. You make sure you have a basis for that and that your guests know what happens to their data.

We are the processor. We process the data to deliver the service set out in the Terms and Conditions, and for nothing else. We do not sell it, we do not use it for our own advertising, and we do not use your guest list to serve other restaurants.

The guest list is yours. If you stop using Portano, that list goes with you. Article 12 of this agreement describes how that works.

You deliver yourself, with your own people, or you do not deliver. We supply no couriers and we do not dispatch drivers. We process a guest’s delivery address so you can bring the order to them, and so the delivery zones and rates you set yourself work. To make those zones work, we turn the postcode and house number into a street, a town and coordinates through the address lookup service of the Kadaster, the Dutch land registry. Beyond that, the delivery address goes to no one outside the parties in Annex B.

The guest buys the food from you. The agreement about the order runs between the guest and your restaurant, not between the guest and us. We supply the software the order comes in through.

For the visitors to our own site and for anyone who requests a demo from us, we are the controller ourselves. That processing falls outside this agreement. What we do there is set out in the Privacy Policy.

The accounts of the people who work at your restaurant fall outside this agreement. For their name, their email address and what they do in the portal, we are the controller ourselves. What we do with that is set out in our Privacy Policy.

We process the personal data only on your written instruction. That instruction consists of this agreement, the Terms and Conditions and the settings you choose in the portal. If you switch a feature on or off, that is an instruction to us.

If you want something that falls outside it, we agree that in writing. An email to your fixed contact person is enough.

If we have to process data because the law requires it of us, we let you know beforehand, unless that law forbids it for important reasons of public interest.

If we think an instruction conflicts with the GDPR or with another law on personal data, we say so to you immediately. We may suspend that instruction until you withdraw it or adjust it.

We do not decide ourselves which data you ask your guests for and what you use it for. If we do so anyway, we are the controller for that processing ourselves, with everything that comes with it.

Everyone at Portano who can reach the personal data is bound to confidentiality. That applies to us and to everyone we bring in.

We give access only to those who need the data to do their work, and no longer than they need it for.

The confidentiality continues to apply after this agreement has ended.

We take appropriate technical and organisational measures to secure the personal data, as article 32 GDPR requires. Annex C writes down which ones those are today.

These are the measures, in short.

• Only people who need that access to do their work have access to data. If someone from Portano looks in on your restaurant through the portal, we record who did so, when and for which restaurant. Administrative access to the server and to the database itself is held by our own team, and that access is not separately logged.
• All traffic between your browser, your app and our servers is encrypted along the way.
• Card details never reach us. The guest pays on our payment partner’s own payment page. We do not see or keep card numbers.
• Guests sign in with a one-time code. We keep no guest passwords.
• Tokens that grant access are stored hashed, and so cannot be read.
• Account numbers for payouts are shown masked.
• The data sits on rented servers in the European Union. All restaurants sit in one database, in which your restaurant’s data carries an identifier of its own. The application makes sure a request reaches only the data of its own restaurant.
• Every night we make a backup copy of the database.

Portano holds no security certificate. We are not ISO or SOC certified, no external audit has been carried out and no penetration test has been done. We write down what we do, not what a certification mark has established. The end of Annex C also says what is not there.

The measures can change as the technology or the risk changes. We do not replace a measure with something that protects less.

On your side you look after security: who in your restaurant gets access to the portal, that you withdraw an account when someone leaves, and that guests cannot read along on the kitchen screen.

You give us general written permission to bring in sub-processors. Annex B sets them out, with what we use them for and where they process the data. If you also want the trading name and the place of establishment of one of them, ask and you will get them.

A sub-processor receives data only for the function it has been brought in for, and only if that function is switched on for your restaurant. If you send no text messages, the SMS service receives nothing about your guests.

We impose the same obligations on every sub-processor in writing as we have here towards you. We remain responsible towards you for what a sub-processor does.

If we want to add or replace a sub-processor, we let you know at least thirty days beforehand, with the name and what it is brought in for.

If you object to that on reasonable grounds, let us know within those thirty days. We look for a solution together first. If we do not reach one, you may terminate the agreement for the service concerned as of the day the change takes effect. That is what your objection gives you.

The database with your guests’ data sits on rented servers in the European Union.

If a sub-processor processes data outside the European Economic Area, that happens only on the basis of an adequacy decision of the European Commission, or on the basis of the standard contractual clauses of the European Commission, with the additional measures that are needed alongside them.

If such a basis falls away, we stop the transfer or we arrange another valid basis. We let you know what we do.

A guest can come to you invoking their rights under the GDPR: access, rectification, erasure, restriction, portability and objection. You answer such a request. We help you with it.

Two things a guest can do themselves today, without you or us having to do anything. They can download everything we hold about them in one file. And they can delete their own account. That strips their name, email address, phone number, address and the delivery note from their earlier orders. The free text they typed for the kitchen and the text of a review stay. If you ask us to erase those too, we do it by hand.

If a request reaches us instead of you, we do not answer it ourselves. We pass it on to you, through your fixed contact person, and we let the guest know that we have done so. Only if you instruct us to do so do we handle it on your behalf.

If you pass a request on to us, we do what is needed to carry it out. What cannot be done with a button in the portal, we do by hand. We deliver what you need in time, so you can answer within the period of article 12(3) GDPR, which is within one month of receiving the request.

We charge nothing extra for this help. What you pay for the service is set out in article 7 of the Terms and Conditions.

If you have to carry out a data protection impact assessment, a DPIA under article 35 GDPR, we give you the information about our processing that you need for it. Think of what we process, where it sits, who can reach it and how it is secured.

If you then have to consult the Autoriteit Persoonsgegevens, the Dutch supervisory authority, beforehand under article 36 GDPR, we help with that too, with the information we hold.

That help is about our processing. You make the assessment itself, and you decide what you do with the outcome.

If we discover a personal data breach that affects the personal data we process for you, we report it to you without undue delay, and in any case within 48 hours of becoming aware of it.

We report it to the email address and the phone number you have given us. In the event of a breach we call, outside office hours as well.

That report contains what article 33(3) GDPR requires.

• what happened and what kind of breach it is
• which categories of data subjects it concerns and roughly how many guests
• which categories of personal data it concerns and roughly how much data
• what the likely consequences are
• what we have done and what we propose in order to limit the consequences
• who you can turn to for more information

If we do not know everything at that moment, we send what we have and add to it as soon as we know more. We do not wait to report until the picture is complete.

You assess whether the breach has to be reported to the Autoriteit Persoonsgegevens and whether you have to inform your guests. You make that report. We do not report on your behalf and we do not approach your guests, unless you instruct us to.

We record every breach: what happened, what consequences it had and what we did about it. We share that record with you, so you can support your own report.

We give you the information you need to show that we comply with article 28 GDPR. Ask your fixed contact person for it.

You may have an audit carried out once a year on what we process for you. You announce it in writing at least thirty days beforehand. If the supervisory authority asks for it, or there has been a personal data breach, it may happen more often and with shorter notice.

You carry out the audit yourself, or you have it carried out by an auditor you appoint. An inspection falls under that. Whoever carries out the audit is bound to confidentiality. They get to see what concerns your processing. Data of other restaurants stays out of view, and so does our source code.

We agree a moment together at which the audit does not disturb our service. You bear the costs of the audit and of the expert yourself.

If the audit shows that we have to improve something, we do it at our own expense, and we let you know when it is done.

When the agreement ends, you choose what happens to the personal data: we return it, we erase it, or we return it and erase it afterwards. If you let us know nothing, we deliver the export first and erase afterwards. If you choose erasure straight away, we do that within fourteen days. The export comes in a common file format that you can read into other software. The guest list is yours and goes with you.

You can ask for that export up to thirty days after the end of the agreement. We deliver it within fourteen days of your request.

After that we erase the personal data from our systems. Backup copies in which it still appears disappear as soon as those copies are overwritten in their own rhythm. For as long as they are still there, they stay secured and we use them for nothing other than repairing a failure.

What the law obliges us to keep, we keep for as long as that obligation lasts. That is mainly the records around invoices and payments. We use that data only for that purpose.

If you ask for it, we confirm in writing that the data has been erased.

For liability between us, what is set out in the Terms and Conditions applies.

What article 82 GDPR gives a data subject cannot be limited or excluded by either of us. If a guest suffers damage through processing that conflicts with the GDPR, what that article lays down applies towards that guest, and not what we have agreed between ourselves.

If one of us has compensated a guest’s damage or paid a fine that the other caused, they may recover it from the other in proportion to each party’s share in the damage. That is the right of recourse in article 82(5) GDPR.

This agreement starts at the moment the Terms and Conditions start, and runs for as long as we process personal data for you.

The subscription starts for one year per location. After that it continues by the month. You can then cancel monthly, with one month’s notice to the end of a calendar month. If the Terms and Conditions end, this agreement ends at the same moment.

This agreement cannot be terminated separately from the Terms and Conditions, except in the case of article 6.5 of this agreement.

Provisions that by their nature continue keep applying after the end. Those are in any case the confidentiality in article 4 and the erasure in article 12 of this agreement.

If the law changes, if a ruling of the supervisory authority changes or if our service changes, we may adjust this agreement so that it stays correct.

We let you know about a change at least thirty days beforehand. If that change materially worsens your position, you may cancel within those thirty days as of the day the change takes effect.

If it concerns only a sub-processor, the change runs through article 6 of this agreement.

The version that applies is on our site, with the date on which it was last updated.

This agreement is governed by Dutch law.

If there is a dispute, report it to us first. We would rather solve it ourselves, and quickly. If we do not reach a solution together, we put it to the competent court in the Netherlands.

If a provision of this agreement turns out to be invalid, the rest simply continues to apply. We then replace that provision with a valid one that stays as close as possible to the intention.