1. Parties and scope
This Data Processing Agreement ("DPA") is between the business that uses Afterbook, Aftermenu or Aftercash (the "Controller") and АФТЪРГРУП ЕООД (Aftergroup Ltd.), UIC 203675688, registered office: Sofia, Bulgaria, 251A Sveti Kiprian St., entrance 1, floor 1 (the "Processor"). It forms part of the agreement between them for those products and applies whenever the Processor processes personal data on the Controller's behalf. A signed copy is available on request at privacy@aftergroup.org.
2. Details of the processing
| Subject and purpose | Providing the products: reservations, guest lists, deposits, menus, notifications, staff access and financial reporting |
| Duration | For as long as the Controller uses the products, plus the return and deletion period below |
| Data subjects | The Controller's guests and customers, its staff and users, and its contacts |
| Categories of data | Names, phone numbers, email addresses, reservation and visit details, deposit and payment status (not full card numbers, which stay with Stripe), messages sent through the products, staff account details, and sales and financial data the Controller imports |
| Special categories | None intended. The Controller should not enter them. |
3. Processor obligations
The Processor:
- processes the personal data only on the Controller's documented instructions, which are given by this DPA, the main agreement and the Controller's use of the products, unless the law requires otherwise, in which case it informs the Controller unless the law forbids it;
- ensures that everyone authorised to process the data is bound by confidentiality;
- takes the technical and organisational measures in section 5;
- helps the Controller, taking into account the nature of the processing, to answer data subjects' requests and to meet its obligations on security, breach notification, impact assessments and consultation with the authority;
- tells the Controller if it believes an instruction breaks data protection law.
4. Sub-processors
The Controller authorises the Processor to use the sub-processors listed in the Privacy Policy. The Processor gives the Controller notice before adding or replacing a sub-processor, and the Controller may object on reasonable data protection grounds. Each sub-processor is bound by data protection obligations equivalent to this DPA, and the Processor remains responsible for it.
5. Security measures
- Encryption of all data in transit (HTTPS/TLS).
- Primary databases hosted in the European Union (Germany).
- Access only for authorised personnel, with individual accounts, on a need-to-know basis.
- Credentials and keys kept in a restricted secrets store, never in application code.
- Monitoring of servers and services.
6. Personal data breaches
The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the information it has about the breach, its likely consequences and the measures taken, so that the Controller can meet its own obligations.
7. International transfers
Where personal data is transferred outside the European Economic Area, the Processor ensures a valid transfer mechanism, such as the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.
8. Audits
The Processor makes available the information needed to show compliance with this DPA and allows reasonable audits by the Controller or an auditor it appoints, with reasonable notice, during business hours and subject to confidentiality.
9. End of the service
When the service ends, the Processor returns the Controller's personal data on request in a common format, and deletes it within 30 days, unless the law requires it to be kept.
10. Liability and precedence
Liability under this DPA follows the main agreement. If this DPA and the main agreement conflict on data protection, this DPA prevails.