Data Processing Agreement (DPA) & GDPR status
What is this? The data processing agreement (DPA) governs the processing of personal data on your behalf. For the legal overview, see Legally compliant menu & labelling. You will find the status in the GDPR section of the order centre.
Checking the status
A status indicator shows whether your DPA is confirmed or whether something is missing (warning). If the confirmed agreement is missing, order operations may be restricted – see Subscription, term & lock screens.
Services we use on your behalf
Services we use for your ordering business are our sub-processors. They work on the basis of your DPA with us – you do not need a separate contract with these services. You only need your own contracts for services you use yourself outside the platform. Services marked * are only used when the respective function is set up or used.
| Service provider | Registered office | Purpose | Third country / safeguard |
|---|---|---|---|
| IONOS SE | Montabaur, Germany | Hosting, data storage, e-mail dispatch | no third country |
| seven communications GmbH & Co. KG | Kiel, Germany | SMS and automated voice call for confirmation codes | no third country |
| Google Ireland Ltd. (Firebase Cloud Messaging) * | Dublin, Ireland | Push notifications about new orders to your team’s devices | USA possible (Google LLC): EU-US Data Privacy Framework; alternatively EU Standard Contractual Clauses |
| OpenAI Ireland Ltd. * | Dublin, Ireland | AI functions, e.g. menu photo scan, logo suggestion, chat assistance | USA possible (OpenAI OpCo, LLC): EU Standard Contractual Clauses |
| Meta Platforms Ireland Ltd. (WhatsApp Business Platform) * | Dublin, Ireland | Order notifications to your guests via WhatsApp | USA possible: EU Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. * | Dublin, Ireland | Online payment during ordering | USA possible: EU Standard Contractual Clauses |
PayPal (Europe) S.à r.l. et Cie, S.C.A. is independently responsible for the payment itself and is therefore not a sub-processor.
If a new sub-processor is added, we update this list. Development and maintenance of the platform are being moved to an isolated environment without access to personal data; until then, technical access restrictions protect the data folders.
Confirm the DPA so that your operation runs in compliance with data protection law.
Next step: Access (Art. 15), erasure & anonymisation