Effective date: the date of execution of the Order Form referencing Inservo’s Terms and Conditions.
Parties:
- Data Controller: the Client as defined in the Inservo Terms and Conditions.
- Data Processor: INSERVO Ltd., registered in England and Wales under company number 15241013, with registered office at 16 Beaufort Court, Admirals Way, London, E14 9XL, United Kingdom (“Inservo”).
This DPA is incorporated by reference into the Inservo Terms and Conditions and forms a binding agreement when the Client uses Inservo’s Services.
1. Definitions
Unless otherwise defined herein, capitalised terms shall have the same meanings as in the Inservo Terms and Conditions. In this DPA:
- “Data Protection Laws” means all applicable data protection and privacy laws including, without limitation:
- EU General Data Protection Regulation 2016/679 (“GDPR”)
- UK GDPR and Data Protection Act 2018
- California Consumer Privacy Act 2018 (“CCPA”)
- Dubai International Financial Centre Data Protection Law No. 5 of 2020 (“DIFC DPL”)
- Any laws implementing, replacing, or supplementing the above.
- “Personal Data” means any information relating to an identified or identifiable natural person.
- “Sub-Processor” means any third party engaged by Inservo to process Personal Data on behalf of the Controller.
2. Purpose and scope
2.1 This DPA governs Inservo’s processing of Personal Data on behalf of the Client for the purpose of providing the Platform and Services as described in the Inservo Terms and Conditions.
2.2 Each party will comply with its respective obligations under applicable Data Protection Laws when processing Personal Data.
3. Roles of the parties
- The Client is the Data Controller.
- Inservo is the Data Processor.
- Both parties acknowledge and agree to their respective obligations under applicable Data Protection Laws.
4. Details of processing
- Purpose of processing: to provide the Inservo Platform and Services, including reservations, messaging, user management, and integrations.
- Duration: for the term of the Agreement and 30 days after termination unless otherwise agreed in writing.
- Data subjects: restaurant staff, end customers (guests), users authorised by the Client.
- Categories of data: name, email, phone number, reservation details, communication logs, table preferences, analytics.
- Special categories: none intentionally processed.
- Processing operations: collection, storage, access, retrieval, use, transfer, deletion.
5. Obligations of the Data Processor (Inservo)
Inservo agrees to:
5.1 Act only on instructions: process Personal Data only on documented instructions from the Client, unless required to do so by law.
5.2 Confidentiality: ensure that personnel authorised to process Personal Data are subject to confidentiality obligations.
5.3 Security: implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including (where appropriate):
- Encryption of data in transit
- Access control and user authentication
- Backup and disaster recovery
- Data pseudonymisation or anonymisation where feasible
5.4 Sub-Processors:
- Inservo may use Sub-Processors for specific services (e.g., cloud hosting, analytics, communication delivery).
- A list of Sub-Processors is available upon request.
- Inservo shall ensure Sub-Processors are subject to written agreements with equivalent data protection obligations.
- Inservo shall notify the Client of changes to Sub-Processors and allow reasonable objection within 10 business days.
5.5 Data Subject rights: assist the Client with Data Subject access requests, rectification, erasure, objection, and data portability requests.
5.6 Data breach notification: notify the Client without undue delay (and in any event within 48 hours) upon becoming aware of a Personal Data Breach.
5.7 Data Protection Impact Assessment (DPIA): assist the Client in conducting DPIAs or prior consultations with authorities where required.
5.8 Return or deletion: at the Client’s choice, delete or return all Personal Data after termination of the Services, unless storage is required by law.
5.9 Audit rights: make available information necessary to demonstrate compliance and allow audits by the Client or a mutually agreed third party, subject to reasonable notice and confidentiality.
6. Obligations of the Data Controller (Client)
The Client agrees to:
6.1 Ensure it has the legal right and lawful basis (e.g. consent, contract) to collect and share Personal Data with Inservo.
6.2 Be responsible for the accuracy, quality, and legality of Personal Data provided to Inservo.
6.3 Not upload or cause Inservo to process special categories of data (e.g., health, religious, biometric) unless expressly agreed.
6.4 Respond to Data Subject rights requests received directly, except where Inservo is required to assist under Clause 5.5.
7. International data transfers
7.1 Inservo may transfer Personal Data outside the UK, EEA, or DIFC provided such transfers:
- Are to countries with adequate protection recognised by relevant authorities, or
- Are subject to safeguards such as:
- Standard Contractual Clauses (EU Commission or UK ICO-approved)
- DIFC Standard Clauses
- Binding Corporate Rules (if applicable)
7.2 Inservo shall, upon request, make available the relevant legal mechanism for any such transfer.
8. Data Processor under CCPA
Where the Client is subject to the CCPA:
8.1 Inservo acts as a “Service Provider” as defined in the CCPA.
8.2 Inservo shall not:
- Sell or share Personal Information.
- Retain, use, or disclose Personal Information for purposes outside the scope of the Agreement.
- Combine Personal Information across clients unless permitted by law.
9. Liability and indemnity
9.1 Each party shall be liable for breaches of this DPA or applicable Data Protection Laws in accordance with the limitation of liability clause set out in the Inservo Terms and Conditions.
9.2 Nothing in this DPA shall limit the rights of Data Subjects under applicable law.
10. Miscellaneous
10.1 Term: this DPA shall remain in effect for the duration of the Inservo Agreement and thereafter to the extent Inservo retains Personal Data.
10.2 Conflicts: in the event of a conflict between the Inservo Terms and this DPA, this DPA shall prevail solely with respect to the subject matter herein.
10.3 Governing law: this DPA shall be governed by the law set forth in the Inservo Terms and Conditions, unless otherwise required by applicable Data Protection Law.
Signed electronically by acceptance of Inservo’s Terms and Conditions.
For questions about this DPA or Inservo’s data handling practices, please contact info@inservo.co.uk.