← Back

This Data Processing Agreement ("DPA") forms part of the Terms of Service for Tout Compris and is entered into between the Customer (as identified below) and Macher B.V. It takes effect automatically — no signature or separate form is required — when the Customer accepts the Terms of Service or first uses the Service on behalf of a business.

This DPA is required under Article 28 of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and applies wherever the Processor processes personal data on behalf of the Controller in connection with the Service.

1. Definitions

• "Service" means the Tout Compris restaurant operations management application provided by the Processor.
• "Personal Data" has the meaning given in Article 4(1) GDPR.
• "Processing" has the meaning given in Article 4(2) GDPR.
• "Data Subject" means any identified or identifiable natural person whose Personal Data is processed under this DPA.
• "Sub-processor" means any third party engaged by the Processor to process Personal Data on its behalf.
• "Security Incident" means any confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of Personal Data.

2. Subject Matter and Duration

The Processor shall process Personal Data on behalf of the Controller for the purpose of providing the Service, for the duration of the Controller's active subscription to the Service, and for 30 days thereafter to allow data export.

This DPA remains in force for as long as the Processor processes Personal Data on behalf of the Controller.

3. Nature and Purpose of Processing

Item	Detail
Purpose	Restaurant operations management — staff scheduling, stock control, HACCP compliance, sales tracking, VAT reporting, and related functions
Nature	Storage, retrieval, display, export, and deletion of data entered by the Controller via the Service, or submitted by the Controller's guests through the Controller's online booking page
Duration	For the term of the Controller's subscription plus 30 days

4. Categories of Personal Data Processed

Category	Data types	Data subjects
Staff operational data	Names, roles, hourly rates, clock-in/out times, shift schedules, leave records, certification records, tip distribution records, PIN codes	Employees and contractors of the Controller
Guest and reservation data	Names, email addresses, telephone numbers, dietary requirements, allergy information, visit history, and online booking requests (requested date, time, party size, special requests)	Guests and customers of the Controller's restaurant
Online booking technical data	A salted, truncated SHA-256 hash of the guest's IP address, recorded with each booking made through the public booking page. It is used solely to rate-limit and detect abuse of that page. The originating IP address itself is not stored and cannot be recovered from the hash.	Visitors to the Controller's public booking page
Supplier contact data	Supplier names, contact names, email addresses, phone numbers	Supplier representatives

Special categories of personal data (Article 9 GDPR): allergy and dietary information entered by the Controller may constitute health data. The Controller is responsible for ensuring a lawful basis exists for processing such data.

5. Obligations of the Processor

The Processor shall:

1. Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to third countries, unless required to do so by EU or Member State law.
2. Ensure that persons authorised to process the Personal Data have committed themselves to confidentiality.
3. Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR.
4. Respect the conditions for engaging Sub-processors as set out in Clause 7 of this DPA.
5. Assist the Controller in responding to requests from Data Subjects exercising their rights under Chapter III GDPR.
6. Assist the Controller in ensuring compliance with its obligations under Articles 32–36 GDPR (security, breach notification, DPIAs).
7. At the choice of the Controller, delete or return all Personal Data to the Controller at the end of the provision of services, and delete existing copies unless EU or Member State law requires storage.
8. Make available to the Controller all information necessary to demonstrate compliance with this DPA.
9. Notify the Controller without undue delay — and within 72 hours where feasible — upon becoming aware of a Security Incident affecting the Controller's Personal Data.

6. Obligations of the Controller

The Controller shall:

1. Ensure that it has a lawful basis under GDPR for all Personal Data it enters into the Service.
2. Ensure that staff and guests are informed about the processing of their data, as required by Articles 13–14 GDPR.
3. Ensure that any special category data (including allergy/dietary information) is processed with appropriate consent or another Article 9 basis.
4. Not instruct the Processor to process Personal Data in a way that would violate applicable law.
5. Promptly inform the Processor of any changes to applicable data protection law that may affect the processing.

7. Sub-processors

The Controller provides general authorisation for the Processor to engage the following Sub-processors:

Sub-processor	Purpose	Location
Supabase Inc.	Database storage and authentication	EU — Ireland (AWS eu-west-1)
Sentry	Error monitoring (pseudonymised data only)	EU — Germany
PostHog Inc.	Usage analytics (pseudonymised data only)	EU Cloud
Anthropic PBC	AI Assistant processing and invoice OCR — only when Controller uses these features	United States (SCCs in place)
Stripe Inc.	Subscription billing — only when a paid subscription is active	United States (SCCs in place)
Resend Inc.	Delivery of (a) account emails — address confirmation and password reset, sent to every account holder; and (b) operational notification emails, only when the Controller enables them	EU — Ireland (eu-west-1 sending region); Resend Inc. is US-incorporated, SCCs in place
Netlify, Inc.	Hosting and content delivery of the application and these legal pages	United States, global CDN (SCCs in place)
Antagonist B.V.	Support mailbox hosting (info@toutcompris.nl)	EU — Netherlands

The Processor shall inform the Controller of any intended addition or replacement of Sub-processors by updating this list, giving the Controller the opportunity to object within 14 days. If the Controller objects and the parties cannot resolve the objection, the Controller may terminate the Service on 30 days' written notice.

The Processor shall impose data protection obligations on all Sub-processors equivalent to those in this DPA.

8. International Transfers

All Sub-processors listed in Clause 7 process Personal Data within the European Economic Area, with the exception of Anthropic PBC, Stripe Inc. and Netlify, Inc., which process Personal Data in the United States under Standard Contractual Clauses (SCCs) approved by the European Commission. Resend Inc. sends from an EU (Ireland) region, but is incorporated in the United States, so SCCs likewise cover any access from there.

Anthropic PBC receives data through three distinct features, which differ materially and are described separately here because the difference matters to the Controller:

1. Scan Invoice. The complete document submitted by the Controller is transmitted as an image or PDF and is read in full by the model. Although only a fixed set of extracted fields is returned to the Service, any Personal Data visible anywhere on that document — supplier contact names, telephone numbers, email addresses, bank details, handwritten notes and signatures — forms part of the transfer. The Controller determines which documents are submitted.
2. AI Assistant. The operational context assembled by the Service is aggregated: it contains no staff names, guest names, booking notes or wage figures. The question typed by the Controller's user is, however, transmitted verbatim, and the conversation is re-sent in full with each follow-up message for up to twenty messages. The Controller therefore determines what Personal Data, if any, this transfer contains. The Service displays a notice beside the input field advising users not to enter guest or staff names.
3. AI daily brief. Generated from aggregated operational figures only. It contains no free text entered by any user.

Anthropic's own data retention policies apply to all three. The Processor does not store the submitted invoice image or PDF itself, and does not store AI Assistant conversations. The data extracted from an invoice — supplier name, invoice number, date and line items — is stored, as a purchase order in the Controller's own account: that is the purpose of the feature.

Resend Inc. — all outbound email from the Service, sent from Resend's EU (Ireland, eu-west-1) infrastructure. This covers two distinct cases:

• Account emails — address confirmation at signup and password reset. These are sent to every account holder as a necessary part of operating the account, and do not depend on any setting. They contain the recipient's email address and a single-use link.
• Operational notifications — sent to the Controller's own account address, and only when the Controller has enabled them. These can include a guest's name and booking details, and, for staff-related notifications (leave and TOIL decisions, shift swaps, certificate expiry), the names of the staff members concerned.

Stripe Inc. — billing and subscription data, only while a paid subscription is active.

Netlify, Inc. — hosting and delivery of the application and these legal pages. Netlify receives the IP address and request metadata of every visitor as an unavoidable consequence of serving the page. No account content is transmitted to Netlify.

In addition, two content delivery networks outside the EEA receive the IP address of the Controller's user, but only at the moment a specific feature is used and never on ordinary use of the Service: cdn.jsdelivr.net when the barcode scanner is opened, and cdn.sheetjs.com when a spreadsheet (XLSX) import is run. These receive no account data, no Personal Data entered into the Service, and no request is made to them unless the feature is invoked.

Apart from the transfers described in this Clause, no transfers of Personal Data to third countries occur in the ordinary course of the Service.

Should any transfer outside the EEA become necessary, the Processor shall ensure appropriate safeguards are in place in accordance with Chapter V GDPR before any such transfer takes place.

9. Security Measures

The Processor implements the following technical and organisational security measures:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Encrypted storage at rest via Supabase (AES-256)
• Role-based access controls within the application limiting data access by staff role
• Database-level row isolation between different restaurant accounts
• API keys and credentials stored as server-side secrets, never in client-side code
• Regular security reviews of the application code

10. Data Subject Rights

The Processor shall assist the Controller in fulfilling its obligations to respond to Data Subject requests. Where a Data Subject contacts the Processor directly, the Processor shall refer the request to the Controller without undue delay.

The Controller remains responsible for responding to Data Subject requests within the timeframes required by GDPR (generally 30 days).

The Service provides a data export function (Settings → Data Backup) that the Controller may use to extract all data in a portable format to assist with data subject access requests.

11. Security Incidents

In the event of a confirmed Security Incident affecting Personal Data processed under this DPA, the Processor shall:

1. Notify the Controller without undue delay and within 72 hours of becoming aware
2. Provide available information about: the nature of the incident, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed
3. Cooperate with the Controller in any notification to supervisory authorities or affected Data Subjects

Notification under this clause does not constitute an admission of fault or liability by the Processor.

12. Audit Rights

The Controller may request, no more than once per year, written confirmation from the Processor of compliance with this DPA. The Processor shall provide a written response within 30 days.

Where the Controller requires a more extensive audit, this may be arranged by mutual agreement and at the Controller's cost, with reasonable notice and without disruption to the Processor's operations.

13. Term and Termination

This DPA enters into force when the Customer accepts the Terms of Service or first uses the Service on behalf of a business, and remains in force for as long as the Processor processes Personal Data on behalf of the Controller.

Upon termination of the Service subscription:

• The Controller may export all data using the built-in backup function within 30 days of termination
• After 30 days, the Processor shall permanently delete all Personal Data belonging to the Controller
• The Processor shall confirm deletion in writing upon request

14. Governing Law

This DPA is governed by the laws of the Netherlands and shall be interpreted in accordance with GDPR and applicable Dutch data protection law. Any disputes shall be subject to the exclusive jurisdiction of the competent courts of the Netherlands.

15. Order of Precedence

In the event of any conflict between this DPA and the Terms of Service, this DPA shall take precedence with respect to the processing of Personal Data.

16. Execution

This DPA is executed electronically. It takes effect automatically — without signature — when the Customer accepts the Terms of Service or first uses the Service on behalf of a business, and applies for as long as the Processor processes Personal Data on behalf of the Controller. A signed copy is available on request for Customers whose internal policies require one: contact info@toutcompris.nl.