Data Processing Agreement
Last updated:
This agreement forms part of our Terms of Service. It applies whenever we process personal data on behalf of a restaurant customer, and sets out the terms required by Article 28 of the UK GDPR.
1. Parties and scope
ResRes is a trading name of ISENTA LIMITED, a company registered in England and Wales (company number 17534346). Registered office: 1a Silver Street, Wellingborough, England, NN8 1BQ. In this agreement "we" or "the Processor" means ISENTA LIMITED, and "you" or "the Controller" means the business that holds a ResRes account.
It applies to personal data about diners, guests and marketing contacts that we process to provide the service. It does not cover data we control ourselves, such as staff account, security and billing data, which is described in our Privacy Notice. If this agreement conflicts with the Terms of Service on data protection, this agreement prevails.
2. Details of the processing
- Subject matter and purpose: providing reservation, waitlist, guest record, payment-request, messaging and marketing tools to you.
- Duration: for as long as you use the service, plus the return and deletion period in section 10.
- Data subjects: your diners and guests, people on your waitlist or standby list, and your marketing contacts.
- Personal data: names, email addresses, phone numbers, booking details and history, notes, payment status and identifiers, consent and suppression records, and message delivery records.
- Special category data: notes you or your guests enter may reveal health information, such as allergies or accessibility needs. You decide whether to collect it and must have a lawful condition to do so.
3. Your instructions
We process personal data only on your documented instructions. Those instructions are this agreement, the Terms of Service and your configuration and use of the service. We will tell you if we believe an instruction breaks data protection law, unless the law prevents us from doing so. If the law requires us to process data in another way, we will tell you first unless it prohibits that.
4. Confidentiality
Everyone we authorise to process personal data is bound by confidentiality, whether by contract or by law.
5. Security
We use technical and organisational measures appropriate to the risk. These include authentication, access controls that separate each customer's data in the database, server-side controls over reservation and payment changes, encryption in transit, signed webhooks and audit logging. You are responsible for managing who on your team has access and for keeping their credentials secure.
6. Sub-processors
You give general authorisation for us to use sub-processors. The sub-processors we use today are listed below. We use reputable providers under their published terms, and have signed or accepted data processing terms with GatewayAPI, Amazon Web Services and Stripe. We remain responsible for their performance.
| Provider | Purpose | Personal data | Location |
|---|---|---|---|
| Cloud hosting and database provider | Application hosting, database, authentication and file storage | All service data: accounts, reservations, guest details and notes, audit and security logs | Database hosted in the EU (Paris, France); some support or technical processing may take place outside the UK |
| Transactional email provider | Transactional email (booking confirmations, changes, reminders, invitations) | Recipient name and email address, message content | May include processing outside the UK |
| Amazon Web Services (Amazon SES) | Marketing email delivery sent on a restaurant's instructions | Recipient name and email address, message content, delivery events | May include processing outside the UK |
| GatewayAPI (OnlineCity ApS, Denmark) | SMS delivery (reminders, waitlist and table-ready texts, booking and payment texts) | Recipient mobile number and message content | European Economic Area |
| Stripe | Card payments, deposits and card guarantees on the restaurant's own connected account; ResRes subscription billing | Payment amounts, status and identifiers; card details are collected directly by Stripe | May include processing outside the UK |
We will give account owners at least 14 days' written notice by email before adding or replacing a sub-processor, and update this list. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may end the affected service without penalty.
Stripe acts as an independent controller for its own compliance and fraud-prevention purposes, and our cloud hosting provider may use technical and service data as an independent controller for its own security, billing and product purposes, each under their own terms.
7. International transfers
Where personal data is transferred outside the UK, we make sure an appropriate safeguard is in place. This means UK adequacy regulations, or the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where required.
8. Helping you meet your obligations
- Data subject requests: the service lets you find, export and correct guest records, and we will erase records on your request. We will pass any request we receive directly to you without undue delay and will not respond ourselves unless you ask us to.
- Impact assessments and consultations: we will give you reasonable information to help with data protection impact assessments and any consultation with the Information Commissioner's Office.
9. Personal data breaches
We will notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data. We will tell you what we know about its nature, likely consequences and the measures taken, and update you as we learn more. This is intended to help you meet your own 72-hour duty to report to the regulator.
10. Return and deletion
You can export your guest data while your account is active. When the service ends, you may choose whether we return your personal data to you or delete it. We will do so on your written request, and if you make no choice we will delete or anonymise it within 90 days after your account ends, unless the law requires us to keep it. Copies held in backups are kept secure and beyond routine use until they expire under our providers' backup schedules.
11. Information and audits
We will make available the information necessary to show we comply with this agreement, answer reasonable written questions and share our providers' available security reports, subject to confidentiality. We will also allow and contribute to audits, including inspections, by you or an auditor you appoint, where that information is not enough, on reasonable notice (normally 30 days), during business hours, under confidentiality and in a way that does not disrupt the service or other customers. Audits are normally at your cost and no more than once a year, except after a personal data breach or where the regulator or the law requires.
12. Your responsibilities
You are responsible for having a lawful basis for the data you collect, for giving guests appropriate privacy information, for any marketing consent, and for the accuracy of the data and instructions you give us.
13. Liability, law and contact
Liability under this agreement is subject to the limitations in the Terms of Service, except where the law does not allow it. This agreement is governed by the law of England and Wales. Questions about it or about data protection can be sent to support@resres.com or by post to our registered office. See also our Support page.