GDPR
Draft for review · Not in effect
This draft outlines the GDPR topics to document for Air POS and its restaurant customers. It is not a certification of compliance and does not replace a signed data processing agreement. The proposed descriptions below require confirmation against the platform’s actual contracts and practices.
Data protection roles
1.1Controller and processor roles
For restaurant-directed processing, the restaurant will typically determine the purposes and Air POS will process data on its behalf. Air POS may separately determine purposes for its own account administration or legal obligations. Confirm these roles for each activity and explain them in the relevant privacy notices.
1.2Data processing agreement
Before processing on a customer’s behalf, the parties need terms covering the scope and duration of processing, instructions, confidentiality, security, subprocessors, assistance, audits and the return or deletion of data. The agreement should specify the affected people and data categories. A general GDPR webpage is not a substitute for that agreement.
Safeguards and assistance
2.1Security and incident handling
Document controls appropriate to the risks, including access management, incident handling and recovery. Confirm the controls actually deployed before describing them as commitments. The incident process must enable timely escalation to the responsible controller and assessment of any notification duties.
2.2Requests from individuals
Provide a clear route for access, correction and other applicable requests. Where Air POS is a processor, coordinate with the restaurant responsible for deciding the request. The workflow should support applicable deadlines and proportionate identity checks without exposing another person’s data.
Suppliers and retention
3.1Subprocessors and transfers
Maintain an accurate record of suppliers and processing locations. Agree customer authorisation and notification arrangements for subprocessors. Where data is transferred internationally, confirm a valid mechanism and any necessary supplementary safeguards for the specific transfer.
3.2Retention and deletion
Agree what is retained, why and for how long, including backups. Document return or deletion at the end of service and any legal retention exceptions. Verify the available export and deletion processes before promising particular formats or completion times.
Customer responsibilities and documentation
4.1Responsibilities of restaurants
Restaurants should provide clear notices, establish appropriate lawful bases, limit collection and configure access for their staff. Consider additional requirements for sensitive information such as allergy notes. Enabling a software feature does not by itself establish a lawful basis for using it.
4.2Documentation and contact
The final page should link to the approved data processing agreement, subprocessor list and Privacy Policy, and provide a confirmed privacy contact. Until those materials are approved, contact Air POS through the contact page for questions about the draft.
Draft review notes
- Complete and approve a data processing agreement and its processing-details and security schedules.
- Confirm subprocessors, locations, authorisation and change-notice procedures, and international transfer assessments and safeguards.
- Document rights-request assistance, incident escalation, deletion/export procedures and the appropriate security controls.