Data Processing Agreement (DPA)

This is an English translation for convenience. The German version is legally binding.

Annex to the General Terms and Conditions for Businesses – Version 1.0, valid from 14 October 2026

Parties

Megaphone Software AG, UID number CHE-168.400.471, Rue des Sablons 6, 3960 Sierre, Switzerland (“tastee” or the “Processor”)

and

the undertaking that takes out a tastee subscription, as identified in its account (the “Business” or the “Controller”),

together the “Parties”.

1. Preamble and conclusion

1.1 The Parties are bound by the General Terms and Conditions for Businesses (the “Terms”). This Data Processing Agreement (“DPA”) forms an integral part of them.

1.2 Under the Terms, tastee processes personal data on behalf of the Business. tastee acts as processor within the meaning of Art. 9 of the Swiss Federal Act on Data Protection (FADP) and, where applicable, Art. 28 of the General Data Protection Regulation (GDPR). The Business is the controller and remains responsible at all times for the lawfulness of the processing under the Applicable Regulations.

1.3 The DPA is concluded online, at the same time as the Terms, when the Business accepts them on signing up. It does not need to be signed separately.

1.4 Capitalised terms are defined in Annex 1 or, failing a definition there, in the Terms.

2. Subject matter

2.1 The DPA applies to all processing of personal data that tastee carries out on behalf of the Business, from tastee’s first access to such data.

2.2 Annex 2 describes the processing entrusted: data subjects, categories of data, nature, purposes and retention period.

2.3 The DPA does not apply to processing that tastee carries out as controller, in particular the management of the App’s user accounts, the business relationship with the Business and invoicing. This processing is described in tastee’s Privacy policy.

3. Obligations of tastee

3.1 Instructions

3.1.1 tastee processes the personal data exclusively in accordance with the instructions of the Business, this DPA and the law. The instructions result from the Terms, the DPA and the settings made by the Business in the Backend; any further instructions must be given in writing.

3.1.2 If tastee considers that an instruction infringes the law, it shall inform the Business without delay. tastee is not obliged to systematically check the lawfulness of the processing decided on by the Business.

3.1.3 tastee applies the principles of data protection by design and by default. Performance of the DPA is included in the subscription price.

3.2 Confidentiality

3.2.1 tastee treats the personal data as strictly confidential and does not use it for any purposes of its own. It does not sell it and does not disclose it to any third parties, subject to the subprocessors (clause 4).

3.2.2 tastee restricts access to the personal data to the persons who need it and ensures that they are bound by confidentiality.

3.2.3 If tastee is legally obliged to disclose personal data to an authority, it shall limit the disclosure to what is strictly necessary and, to the extent permitted by law, inform the Business in advance.

3.3 Security

3.3.1 Before any processing, tastee takes appropriate technical and organisational measures to ensure the confidentiality, integrity, availability and traceability of the personal data.

3.3.2 These measures are described in Annex 4 (TOMs). tastee tests, assesses and updates them regularly. It may adapt them to technical developments, provided that the level of security is not reduced.

3.4 Record of processing activities

tastee keeps a record of the processing activities it carries out on behalf of its customers, containing at least the information set out in Annex 5.

3.5 Data security breach

In the event of a breach of the security of personal data, including at a subprocessor, tastee shall inform the Business without delay as soon as it becomes aware of it and proceed in accordance with Annex 6. It is the responsibility of the Business, as controller, to report the breach to the Federal Data Protection and Information Commissioner (FDPIC) and to inform the data subjects where required by law.

3.6 Assistance

tastee assists the Business to a reasonable extent in fulfilling its legal obligations, in particular with regard to security, notification of breaches, data protection impact assessments and responding to requests from data subjects.

3.7 Deletion and return

3.7.1 Upon termination of the Terms, at the request of the Business or where required by law, tastee shall, no later than within 30 days:

• securely delete the personal data, including all copies and backups and those held by its subprocessors, or, at the request of the Business, return it to the Business in a commonly used format;
• provide the Business with written confirmation of deletion on request.

3.7.2 During the term of the Terms, the Business may export its data using the functions provided in the Backend.

3.7.3 If tastee is legally obliged to retain certain data, it shall inform the Business accordingly, ensure the confidentiality and security of such data and process it exclusively for that purpose.

3.8 Contact

tastee’s contact person for all data protection matters can be reached at hi@tastee.app.

4. Subprocessors

4.1 The Business generally authorises tastee to engage the subprocessors listed in Annex 3.

4.2 The Business grants tastee general authorisation to engage further subprocessors or to replace existing ones, provided that the conditions of clause 4.3 are met. tastee keeps the current list up to date on the Subprocessors page.

4.3 For each subprocessor, tastee:

• ensures in advance that it provides sufficient guarantees and a level of data protection equivalent to the DPA;
• imposes on it, by written contract, the obligations under the DPA, in particular to process the data only for the purposes of the Service and to engage further subprocessors itself only subject to equivalent guarantees;
• provides the Business, on request, with the relevant information on these contracts;
• in the event of a disclosure abroad, puts in place the safeguards set out in clause 5.

4.4 tastee remains responsible towards the Business for compliance with the obligations it delegates to its subprocessors.

5. Disclosure abroad

5.1 tastee processes the personal data mainly in Switzerland.

5.2 For certain functions of the App (push notifications, text messages, emails), tastee engages subprocessors that process specific data in the European Union or in the USA (Annex 3).

5.3 Such disclosures are only made to countries which, according to a decision of the Federal Council, ensure an adequate level of data protection, or subject to appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses recognised by the FDPIC or the certification of the recipient under the Swiss-U.S. Data Privacy Framework.

6. Audit

6.1 On request, tastee provides the Business with the information necessary to demonstrate compliance with the DPA, in particular the current description of its TOMs.

6.2 If this information is not sufficient, the Business or an independent auditor appointed by it and bound by confidentiality may verify tastee’s compliance with the DPA. The Business shall:

• give at least 30 days’ written notice of the audit;
• limit itself to one audit per year, except in the event of a data security breach or at the request of an authority;
• carry it out during office hours, with as little disruption as possible to tastee’s activities and without access to data of other customers.

6.3 The costs of the audit are borne by the Business, unless the audit reveals a material breach of the DPA by tastee.

7. Rights of data subjects and requests from authorities

7.1 The Business responds to requests from data subjects (access, rectification, deletion, etc.) and from data protection authorities (the “Requests”).

7.2 tastee:

• forwards any Request it receives to the Business without delay;
• does not itself respond to a Request without the consent of the Business, unless legally obliged to do so;
• cooperates with the Business and provides it, in the Backend or on request, with the means to respond to Requests promptly and completely.

8. Obligations of the Business

The Business:

• warrants the lawfulness of the processing it entrusts to tastee, in particular the information provided to its Guests and employees and, where applicable, obtaining their consent;
• transmits to tastee only the personal data necessary for the Service and does not enter any sensitive personal data in it (e.g. health data in reservation comments) beyond what the Service provides for;
• protects its access to the Backend and informs tastee without delay of any irregularity or suspected breach.

9. Liability

9.1 Each Party is liable for compliance with its obligations under the DPA and the law. tastee is liable for the processing it carries out itself or through its subprocessors.

9.2 tastee’s liability is limited in accordance with clause 18 of the Terms, in particular by the exclusion of indirect damage and the limitation to the amount paid by the Business in the last 12 months. Cases in which the law mandatorily prohibits a limitation of liability remain reserved.

10. Term and termination

10.1 The DPA applies for the entire term of the Terms and ends automatically with them.

10.2 However, tastee’s obligations continue to apply for as long as it or a subprocessor holds personal data of the Business. The duty of confidentiality (clause 3.2) applies without time limit.

10.3 In the event of a serious breach of the DPA by tastee that is not remedied within 10 days of a written warning, the Business may terminate the Terms with immediate effect (clause 7.6 of the Terms).

11. Final provisions

11.1 Order of precedence: In the event of any conflict, the following order of precedence applies: (1) the Standard Contractual Clauses, where applicable; (2) the DPA; (3) the Terms.

11.2 Amendments: tastee may amend the DPA in accordance with the amendment procedure of the Terms (clause 7.7 of the Terms), in particular to take account of changes in the law. An amendment may not reduce the level of data protection.

11.3 Form: The written form includes electronic form, in particular email.

11.4 Severability: The invalidity of any provision shall not affect the validity of the remaining provisions. It shall be replaced by a valid provision that comes closest to its purpose.

11.5 Applicable law and jurisdiction: The DPA is subject to the same law and the same place of jurisdiction as the Terms.

Annex 1 – Definitions

• Personal data: any information relating to an identified or identifiable natural person within the meaning of the Applicable Regulations.
• Sensitive personal data: personal data within the meaning of Art. 5 let. c FADP, in particular data relating to health.
• Guests: the customers of the Business who use the App with or without an account.
• Data subject: any natural person whose personal data is processed.
• Applicable Regulations: the FADP, the Data Protection Ordinance (DPO) and, to the extent applicable, the GDPR.
• Processing: any handling of personal data, irrespective of the means used, in particular the collection, storage, retention, use, modification, disclosure, archiving, deletion or destruction of data.
• App, Backend, Modules, Service: have the meaning given in the Terms.

Annex 2 – Description of the processing

Data subjects

• Guests of the Business (with or without a tastee account)
• Employees of the Business with access to the Backend

Categories of data

• Identification and contact data: first name, surname, telephone number, email address
• Reservation data (book): date, time, number of persons, whether children are present, preferred area, comments
• Order data (order, pick up): content of the order, table number or pick-up code, status, date and time
• Payment data (pay): amount, tip, reference and status of the transaction. Card data is processed exclusively by the payment service provider; tastee has no access to it.
• Usage and access data: IP address, date and time of access, technical metadata, Backend access logs

Sensitive personal data

None, subject to information that a Guest provides of their own accord, for example an allergy mentioned in a reservation comment. Such information is processed exclusively so that the Business can take it into account.

Nature and frequency of the processing

Ongoing processing with every reservation, order or payment made by a Guest via the App and with every use of the Backend: collection, storage, hosting, display in the Backend, transmission to the Business, sending of confirmations and notifications, export and deletion.

Purposes

To enable the Business to receive and manage table reservations, orders at the table and for takeaway, and payments, to communicate with its Guests about their reservations and orders and to view its statistics.

Retention period

• Reservations and orders: no more than 24 months after the visit or order, or for a shorter period on the instructions of the Business; thereafter automatic deletion or anonymisation
• Access and activity logs: 12 months
• Upon termination of the Terms: deletion or return within 30 days (clause 3.7)
• Accounting records relating to payments are retained for 10 years in accordance with the legal obligations.

Annex 3 – Subprocessors

The current list is also published on our Subprocessors page.

SCC: Standard Contractual Clauses · DPF: Data Privacy Framework.

To accept payments, the Business also concludes its own contract with Worldline (clause 9.1 of the Terms). In that context, Worldline acts under its own responsibility and in accordance with its own terms.

Annex 4 – Technical and organisational measures (TOMs)

The detailed description can be found on our Technical and organisational measures page.

Technical measures

• Access control: two-factor authentication for access to the production systems; role-based access according to the principle of least privilege; access to servers and databases only for authorised persons, with strong passwords and 2FA.
• Encryption: data is encrypted in transit (TLS) and at rest (AES-256).
• Network and system security: firewall and intrusion detection system; protection against DDoS attacks; regular security updates.
• Logging and monitoring: automatic recording of access and relevant actions, reviewed regularly; automatic detection of suspicious activity with alerts; secure retention of logs for 12 months.
• Data backup: regular, tested backups, stored securely at several geographically separate locations.
• Vulnerability management: security review of new features and changes before they go live.

Organisational measures

• Internal, company-wide directive on data protection.
• Regular training of employees: data protection, password security, secure handling of information, recognition of phishing.
• Restriction of access according to defined and documented roles and responsibilities.
• Record of processing activities setting out the nature, purpose, categories of data and access rights.
• Subprocessors bound by a data processing agreement to comply with the same requirements as tastee.

Annex 5 – Content of the record of processing activities

• identity and contact details of tastee and of the Business;
• categories of processing carried out on behalf of the Business;
• categories of personal data processed, when and by whom;
• recipients, including abroad, and the safeguards for the disclosure;
• general description of the security measures (Annex 4).

Annex 6 – Data security breach

In the event of a breach of the security of personal data, tastee shall:

• inform the Business as soon as it becomes aware of the breach and provide it with a contact person;
• immediately initiate an investigation to determine the causes and circumstances;
• take all necessary measures to contain the breach and limit its consequences;
• provide the Business as soon as possible with a written report setting out:
• the nature of the breach, the categories and approximate number of data subjects and data concerned, and the time and duration of the breach;
• the possible consequences;
• the measures taken or planned to remedy it;
• secure the evidence and document all measures taken;
• cooperate fully in any investigation by the Business or an authority.