Data Processing Agreement
Last updated: 14.08.2026
This Data Processing Agreement (hereinafter: "DPA"), drawn up pursuant to Art. 28 of Regulation (EU) 2016/679 (GDPR), governs the processing of personal data of end guests who make bookings through the Planivo Table service, and supplements the Terms of Service. For the purposes of this DPA, the restaurant customer acts as Controller and OINOS Korlátolt Felelősségű Társaság (OINOS Kft., registered office 1068 Budapest, Dózsa György út 86. B. ép. 3. em. 1., VAT number 24316268-2-42) acts as Processor.
In the event of a legal dispute, the Hungarian-language version of this document shall prevail.
1. Roles of the parties
The Controller (the restaurant customer) determines the purposes and means of processing the data of its own end guests. The Processor (OINOS Kft., provider of the Planivo Table service) processes such data solely on behalf of and on documented instructions from the Controller, to the extent necessary to deliver the service.
2. Subject matter and purpose of processing
Subject matter: personal data of end guests collected through the public booking form and the management dashboard (first and last name, phone number, email address if provided, booking date and time, number of guests, occasion and optional notes, technical data connected with submitting the booking). Purpose: managing bookings on behalf of the Controller, sending related transactional communications (confirmation, reminders, changes), preventing system abuse. Duration: for the entire duration of the contractual relationship between Controller and Processor.
3. Documented instructions
The Processor processes data solely on the basis of documented instructions from the Controller, as resulting from the service configuration (e.g. fields collected in the booking form, the text of the per-tenant privacy notice set by the Controller) and from these Terms. If the Processor considers that an instruction infringes the GDPR or other applicable law, it shall immediately inform the Controller.
4. Confidentiality
The Processor ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access to the data is limited to what is strictly necessary to deliver the service.
5. Security measures
The Processor implements technical and organisational measures appropriate under Art. 32 GDPR, including: encryption of communications (HTTPS), authentication-based access control, logical separation of data between different Controllers (multi-tenant architecture with database row-level access control), regular backups, monitoring and logging of access for security purposes.
6. Sub-processors
The Controller authorises the use of the following sub-processors, necessary to deliver the service: • Supabase (Supabase Inc., USA) — database, authentication, server functions. Data stored within the European Union (Frankfurt, Germany). • Vercel (Vercel Inc., USA) — application hosting. • Resend (Resend Inc., USA) — sending of transactional emails to end guests. The Processor will inform the Controller of any changes involving the addition or replacement of sub-processors, giving the Controller the opportunity to object on legitimate data protection grounds.
7. International data transfers
Where processing involves a transfer of data outside the European Economic Area, such transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission, or another transfer mechanism recognised as adequate under the GDPR.
8. Assistance to the Controller
The Processor assists the Controller, taking into account the nature of the processing and the information available to it, in ensuring compliance with the obligations set out in Articles 32-36 GDPR (security of processing, breach notification, impact assessment, prior consultation), and in responding to requests for the exercise of data subject rights, where such requests are addressed to the Processor rather than directly to the Controller.
9. Personal data breach notification
The Processor shall notify the Controller, without undue delay and in any event within 48 hours of becoming aware of it, of any personal data breach, providing the information necessary to enable the Controller to comply with its notification obligations under Articles 33-34 GDPR.
10. Deletion or return of data
At the end of the contractual relationship between Controller and Processor, and after expiry of the 90-day retention period applicable in the event of account blocking for non-payment, the Processor permanently deletes the data processed on behalf of the Controller, unless applicable law requires a longer retention period (e.g. accounting and tax obligations).
11. Audits and information
The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations set out in this DPA, and allows for and contributes to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, with reasonable prior notice and with due regard to the confidentiality of other Controllers hosted on the same multi-tenant infrastructure.