Data Processing Agreement

Article 1: Definitions and roles

1.1 This data processing agreement ("DPA") applies where VYRA Software Solutions B.V. ("Processor") processes personal data on behalf of the Customer ("Controller") in performing the Subscription.

1.2 The Controller determines the purposes and means of the processing; the Processor processes solely on behalf of and in accordance with the instructions of the Controller.

1.3 Terms from the GDPR (processing, personal data, data subject, etc.) have the meaning given to them in the GDPR.

Article 2: Subject matter and nature of the processing

2.1 The Processor processes personal data only insofar as necessary to provide the Platform and the service to the Customer.

2.2 The nature and purpose of the processing, the categories of data subjects and the types of personal data are described in Annex 1.

Article 3: Instructions

3.1 The Processor processes the personal data solely on the basis of written instructions from the Controller, including this DPA and the use of the Platform.

3.2 The Processor informs the Controller if, in its opinion, an instruction infringes the GDPR or other legislation.

Article 4: Confidentiality

4.1 The Processor ensures that persons with access to the personal data are bound by confidentiality.

Article 5: Security

5.1 The Processor takes appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

5.2 The measures are described in more detail in Annex 2.

Article 6: Sub-processors

6.1 The Controller grants the Processor general authorisation to engage sub-processors for the performance of the service. The current sub-processors are listed in Annex 3.

6.2 The Processor imposes the same obligations on every sub-processor as those in this DPA.

6.3 The Processor informs the Controller of changes in sub-processors. In doing so, the Processor always makes the choices that serve the interests of the platform and its customers, from a partnership in which both parties' interests are served.

Article 7: Rights of data subjects

7.1 The Processor assists the Controller, insofar as reasonably possible, in complying with requests from data subjects (access, rectification, erasure, etc.).

7.2 If the Processor receives a request directly from a data subject, it refers the data subject to the Controller and does not handle the request itself, unless agreed otherwise.

Article 8: Data breaches

8.1 The Processor informs the Controller without undue delay after becoming aware of a personal data breach.

8.2 In doing so, the Processor provides the information the Controller needs to meet its own notification obligations.

Article 9: Assistance

9.1 The Processor provides reasonable assistance with data protection impact assessments (DPIAs) and prior consultations, where applicable.

Article 10: Transfers outside the EEA

10.1 The Processor transfers personal data outside the EEA only under appropriate safeguards in accordance with the GDPR (such as the standard contractual clauses).

Article 11: Return and deletion

11.1 After the end of the service, the Processor deletes the personal data or returns it, at the Controller's option, unless a statutory retention obligation requires otherwise.

Article 12: Audits

12.1 On request, the Processor makes available the information necessary to demonstrate compliance with this DPA and cooperates with reasonable audits.

Article 13: Liability and applicable law

13.1 The liability arrangements in the Terms and Conditions apply to this DPA.

13.2 Dutch law applies.

Annex 1: Description of the processing

• Categories of data subjects: contact persons and employees of the Customer.
• Types of personal data: name of the contact person, e-mail address, name of the restaurant or business.
• Purpose: providing and managing the VYRA platform.
• Duration: the term of the Subscription.
• Note: VYRA Views does not ask for personal data; free-text answers a guest enters of their own accord are not actively processed and are deleted on request.

Annex 2: Security measures

• Encryption of data in transit and, where possible, at rest.
• Multi-factor authentication (MFA) on VYRA user accounts.
• Access control on a need-to-know basis.
• Logging and monitoring (including through Sentry).
• Backup and recovery policy.

Annex 3: Sub-processors

Note: Stripe is not a sub-processor: Stripe acts as an independent controller for payment data (see the Privacy Statement, Article 6a). Stripe's data processing terms (https://stripe.com/legal/dpa) and privacy policy (https://stripe.com/privacy) apply to processing by Stripe.