Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between SMART ERP SYSTEMS TECHNOLOGY - L.L.C - S.P.C (“SmartPOS AI”, “we”) and the customer (“Customer”, “you”). It applies whenever we process personal data on your behalf through the Service (“Customer Personal Data”). It is designed to meet Article 28 of the EU General Data Protection Regulation (GDPR) and Article 30 of the Law on Personal Data Protection of Bosnia and Herzegovina.

You are the controller of Customer Personal Data, or a processor acting for your own client, in which case we act as your sub-processor. We are the processor. We process Customer Personal Data only to provide the Service as described in Annex 1.

• We process Customer Personal Data only on your documented instructions. Your instructions are the Terms of Service and this DPA, the way you use and configure the Service, and any other written instructions we agree with you.
• If we believe that an instruction infringes data protection law, we will tell you.
• If the law requires us to process Customer Personal Data in another way, we will inform you before we do so, unless the law prohibits it.
• You are responsible for having a legal basis for the processing and for informing the people concerned, such as your customers and staff.

Everyone at SmartPOS AI who can access Customer Personal Data is bound by confidentiality and may access it only as far as needed for their work, for example to provide support that you have asked for.

We apply the technical and organisational measures described in Annex 2 and keep them appropriate to the risk. We may improve them over time, but we will not lower the overall level of protection.

• You give us general authorisation to use sub-processors. The current list is on the sub-processors page.
• We inform you at least 30 days before we add or replace a sub-processor, by email to the account owner and on that page. You may object on reasonable data protection grounds within that period. If we cannot address your objection, you may stop using the affected part of the Service or terminate the contract.
• We bind each sub-processor by contract to data protection obligations that are at least as protective as this DPA, and we remain responsible for its work.

Taking into account the nature of the processing, we help you:

• respond to requests from people exercising their rights — the Backoffice lets you view, correct, export and delete customer records, and we help with anything it cannot do;
• meet your obligations on security, breach notification, data protection impact assessments and prior consultation with authorities.

If someone contacts us directly about Customer Personal Data, we forward the request to you and do not answer it ourselves unless you ask us to.

We notify you without undue delay after we become aware of a breach affecting Customer Personal Data. We tell you what we know, such as the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed, and we update you as we learn more.

You can export Customer Personal Data at any time. When you ask us to close your account, or at your written request at any other time, we delete Customer Personal Data within 30 days, unless the law requires us to keep it. Backup copies are overwritten within about 10 days after deletion.

We make available the information you need to demonstrate compliance with this DPA and answer reasonable security questionnaires. If that is not enough, you or an independent auditor bound by confidentiality may audit our compliance once a year, with at least 30 days’ notice, during business hours, at your own cost and without access to other customers’ data. Additional audits are possible if a competent authority requires them or after a personal data breach.

We host Customer Personal Data in Germany. Our staff may access it from the United Arab Emirates and from Bosnia and Herzegovina, and some sub-processors process it in the United States (see the sub-processors page).

• For Customer Personal Data subject to the GDPR, the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914) apply to transfers to us and are incorporated into this DPA by reference: Module Two where you are a controller and Module Three where you are a processor. You are the data exporter and we are the data importer. For Clause 9, option 2 (general authorisation, 30 days’ notice) applies. For Clause 17, the law of the EU Member State in which you are established applies, or Irish law if that law does not allow third-party beneficiary rights; for Clause 18, the courts of that Member State. Annexes 1 and 2 of this DPA complete Annexes I and II of the Clauses.
• For Customer Personal Data subject to the law of Bosnia and Herzegovina, transfers take place with the safeguards required by Articles 46 to 48 of the Law on Personal Data Protection.
• For onward transfers to sub-processors outside the EU/EEA, we use appropriate safeguards, such as the Standard Contractual Clauses.

Each party’s liability under this DPA is subject to the limitations in the Terms of Service, except where the law or the Standard Contractual Clauses do not allow this. If there is a conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms of Service in matters of personal data.

This DPA applies for as long as we process Customer Personal Data. It is governed by the law that governs the Terms of Service, except where Article 28 of the GDPR or the Standard Contractual Clauses require the law of an EU Member State.

• Subject matter and duration: providing the Service under the Terms of Service, for as long as the Customer uses it and until the data is deleted under section 8.
• Nature and purpose: hosting, storing, synchronising, displaying, analysing (including the AI features the Customer uses), exporting, backing up and deleting data, and sending the messages the Customer triggers, in order to run the Customer’s point of sale, back office, bookings, online orders, loyalty programme, staff management, reporting and integrations.
• People concerned: the Customer’s customers and guests; the Customer’s employees and other users; contacts at the Customer’s suppliers and business partners.
• Categories of data: names and contact details; purchase history, receipts, orders and loyalty data; bookings; staff records such as roles, shifts, sales and cash records and hashed PINs; payment references (never full card numbers); bank-statement lines if the Customer uses bank reconciliation; and other data the Customer chooses to enter.
• Special categories: the Service is not designed for special categories of data, such as health data. The Customer should not enter them unless this is necessary and lawful, in which case the Customer is responsible for the additional safeguards required.

• Access control: each business’s data is kept separate; role-based permissions and PINs for staff; two-factor authentication and audit logging for our administrator accounts; access by our staff only where needed.
• Encryption and hashing: TLS for all connections; passwords and PINs stored as one-way hashes.
• Monitoring and protection: firewall, rate limits, logging of requests and important actions, alerts on errors and suspicious activity, and the ability to revoke sessions and devices.
• Availability and resilience: database backups every two hours and every night, a copy on a separate server in Germany, an automatic restore test every day, and an offline mode for the point of sale.
• Hosting: servers of Hetzner Online GmbH in data centres in Germany.
• People: confidentiality obligations for everyone with access, and security fixes applied as part of regular releases.

The current list of sub-processors, with their purpose and location, is on the sub-processors page.