Data Processing Agreement
Last updated · [draft — pending legal review]
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Voodi ("Voodi", "processor") and the merchant using the Service ("Merchant", "controller"). It applies whenever Voodi processes personal data on the Merchant's behalf, including under the EU and UK General Data Protection Regulation and similar laws.
1. Roles and scope
The Merchant is the controller of the personal data of its customers and staff that is processed through the Service. Voodi processes that data as a processor, only to provide the Service. Voodi's processing of merchant account data for its own purposes is covered by the Privacy Policy, not this DPA.
2. Subject matter, nature, and duration
Voodi hosts storefronts, receives and routes orders and feedback, sends notifications, produces analytics, and provides AI-assisted features, for as long as the Merchant uses the Service and until the data is deleted under section 9.
3. Data subjects and categories of data
Data subjects: the Merchant's customers (diners) and team members. Categories: names, phone numbers, email addresses, delivery addresses, table numbers, order contents and notes, feedback ratings and comments, optional contact details, and technical data such as IP addresses. The Service is not designed for special categories of personal data, and the Merchant should not collect them through it.
4. Voodi's obligations
Voodi will process personal data only on the Merchant's documented instructions, which are the Terms, this DPA, and the Merchant's configuration of the Service; ensure that people authorized to process it are bound by confidentiality; and maintain appropriate technical and organisational measures, including encryption in transit, access controls, tenant isolation, logging, and backups.
5. Subprocessors
The Merchant gives general authorization for Voodi to use the subprocessors listed in the Privacy Policy. Voodi will give notice of new subprocessors before they start processing, giving the Merchant the opportunity to object, and will impose data protection obligations on each subprocessor that are no less protective than this DPA.
6. International transfers
Where personal data is transferred outside the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, Voodi will ensure an appropriate safeguard is in place, such as the European Commission's Standard Contractual Clauses.
7. Assistance
Taking into account the nature of the processing, Voodi will help the Merchant respond to data subject requests, carry out data protection impact assessments, and meet its security obligations. Voodi will forward to the Merchant any request it receives directly from the Merchant's customers.
8. Personal data breaches
Voodi will notify the Merchant without undue delay after becoming aware of a personal data breach affecting the Merchant's data, and will provide the information the Merchant reasonably needs to meet its own notification obligations.
9. Deletion and return
The Merchant can export its data from the dashboard at any time. After the Merchant's account is closed, Voodi will delete the Merchant's personal data within a reasonable period, unless the law requires Voodi to retain it.
10. Audits
Voodi will make available the information reasonably necessary to demonstrate compliance with this DPA and will allow for audits by the Merchant or an auditor it mandates, on reasonable notice, no more than once a year unless a supervisory authority requires otherwise.
11. Merchant's responsibilities
The Merchant is responsible for having a lawful basis for the processing, for giving its customers the required privacy notices, and for any analytics or advertising tags it adds to its storefront. The Merchant's instructions to Voodi must comply with applicable law.
12. Contact
Questions about this DPA, or need a countersigned copy? Reach us at hello@voodi.ai.