Skip to content
Bookings that fit.
CSGet Booklio free
MenuClose

Data processing agreement

  1. Parties and formation.

    This agreement is part of the Booklio terms of service and is concluded together with them at sign-up. The controller of guests’ personal data is the customer, that is the venue using Booklio. The processor is 601 s.r.o., Company ID 28503554, Povltavská 5/74, 171 00 Praha 7. The agreement meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).

  2. Subject, purpose and duration.

    The processor processes personal data on the controller’s behalf only to provide the Booklio service: taking and managing bookings, guest messages, feedback, invitations and stats according to the add-ons the controller turns on. It stores, sorts and shows the data to staff, sends it in messages and deletes it at the end. Processing lasts for the term of the contract and afterwards only as long as needed to return and delete the data under After termination.

  3. Which data and whose.

    Guests and people making a booking: name, email, phone, date and party size, booking note, assigned table, visit history, staff notes and blacklist entries, feedback and ratings, consent to invitations and payment details without the card number if the controller turns payments on. The controller’s staff: name, email and sign-in records. A guest may put health information in a note, such as an allergy; the processor only stores such information and shows it to staff.

  4. Controller’s instructions.

    The processor processes the data only on documented instructions from the controller, including transfers to third countries. The instructions are this agreement, settings and actions in the admin, and emails from the controller’s account address. If EU or Czech law requires other processing, the processor informs the controller beforehand unless that law prohibits it. If it believes an instruction infringes data protection law, it tells the controller immediately.

  5. Confidentiality and security.

    Only people who need the data to run the service and are bound by confidentiality have access to it. The processor takes the measures required by Article 32 GDPR, in particular: each venue has its own database stored in the European Union, connections are encrypted, the admin is protected by sign-in and role-based permissions, data is backed up regularly and access is limited to those who strictly need it.

  6. Sub-processors.

    The controller gives general authorisation to engage the sub-processors listed below. The processor imposes on them the same data protection obligations as this agreement and remains liable to the controller for their performance. It informs the controller by email at least 30 days before adding or replacing a sub-processor; the controller may object, and if the processor does not accommodate the objection, may terminate under the terms of service free of charge. Transfers outside the European Economic Area take place only with safeguards under Chapter V GDPR, in particular an adequacy decision of the European Commission or standard contractual clauses.

  7. Assisting the controller.

    The processor helps the controller handle guests’ requests for access, rectification, erasure, restriction, portability and objection: staff can do most of it in the admin, and the processor helps with the rest on request. Taking into account the nature of processing and the information available to it, it also assists with security, breach notification, impact assessments and prior consultation under Articles 32 to 36 GDPR.

  8. Personal data breaches.

    If the processor becomes aware of a breach affecting the controller’s personal data, it notifies the controller without undue delay, within 48 hours at the latest, by email to the account address. It describes what happened, which data and how many people are affected, the likely consequences and what it has done or proposes to do; anything not yet known follows as it is found out.

  9. After termination.

    Within 30 days after the contract ends, the controller may ask the processor to return the data in a machine-readable format. After that, or earlier on the controller’s instruction, the processor deletes the data including copies; it disappears from backups within a further 30 days at the latest. This does not apply to data that EU or Czech law requires to be kept.

  10. Audits.

    The processor makes available to the controller the information needed to demonstrate compliance with this agreement and allows audits, including inspections, by the controller or an auditor it appoints who is bound by confidentiality. The controller announces an audit at least 30 days ahead, at most once a year except when investigating a breach, and bears its costs.

  11. Other provisions.

    This agreement lasts as long as the processor processes the controller’s data. In case of conflict with the terms of service, this agreement prevails on data protection matters. Changes follow the terms’ article on changes to prices and terms.

  12. List of sub-processors.

    • Cloudflare: running the service, venue databases and backups, data stored in the EU
    • Resend: sending emails to guests and staff
    • BulkGate: sending text messages to guests, if the controller turns them on
    • Anthropic: drafts by Claude, such as replies to feedback, only when staff request them; receives only the text needed for the draft
    • Stripe: guest payments, if the controller turns them on
Get Booklio free