This Data Processing Agreement (DPA) forms part of the Terms & Conditions between S25 Studio Pty Ltd (ABN 30 683 814 904), trading as Foogital (Foogital, the Processor) and the business using Foogital (the Customer, the Controller). It applies when Foogital processes Personal Data on the Customer’s behalf. If the DPA and the Terms conflict, the DPA prevails on data protection.

1. Definitions

Data Protection Laws means the laws that apply to the processing, including the Privacy Act 1988 (Cth), the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection. Personal Data, processing, controller, processor, data subject and personal data breach have the meanings given in the GDPR. Customer Personal Data means Personal Data Foogital processes for the Customer under the Terms.

2. Roles and instructions

  • The Customer is the controller of Customer Personal Data and Foogital is its processor. The Customer is responsible for having a lawful basis for the processing, for the notices it gives its guests (including its website’s privacy policy), and for the instructions it gives.
  • Foogital processes Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s configuration of the Services are those instructions. Foogital will tell the Customer if it believes an instruction breaches Data Protection Laws.

3. Details of the processing

  • Subject matter and duration: providing the Services for the term of the Terms, and until deletion under section 10.
  • Nature and purpose: hosting the Customer’s website; receiving, storing and displaying bookings, contact messages and orders; sending emails to guests and to the Customer; measuring website visits where the visitor consents; and providing support.
  • Data subjects: the Customer’s guests, website visitors, people who contact the Customer, and the Customer’s staff.
  • Categories of Personal Data: names, email addresses, phone numbers, booking details (date, time, party size, notes), message contents, order details, and, for consenting visitors, pseudonymous identifiers, pages viewed, device and approximate location.
  • Special categories: none are required. Guests may volunteer dietary or health information in booking notes; the Customer should not ask for more than it needs.

4. Foogital’s obligations

  • Ensure everyone authorised to process Customer Personal Data is bound by confidentiality.
  • Implement the technical and organisational measures in section 7.
  • Assist the Customer, taking into account the nature of the processing, with data subject requests, security, breach notification, data protection impact assessments and consultation with regulators. Much of this is available directly in the dashboard.
  • Make available the information reasonably needed to demonstrate compliance with this DPA, and allow audits as set out in section 9.

5. Sub-processors

The Customer authorises Foogital to engage the following sub-processors:

  • Vercel Inc. — hosting and content delivery (global edge network; United States).
  • Supabase Inc. — database and file storage (Platform database: Tokyo, Japan; Company database: Sydney, Australia).
  • Stripe, Inc. / Stripe Payments Australia — payment processing, where the Customer uses payment features (United States and other regions).
  • Resend (Plus Five Five, Inc.) — transactional email (United States).
  • PostHog Inc. — website statistics for consenting visitors of restaurant websites (European Union).
  • Google LLC — Places API (business and address lookup), Maps, Cloud Translation and the Gemini API on a paid plan, under which inputs are not used to train Google’s models (United States and other regions).

Foogital imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance. Foogital will give at least 30 days’ notice of a new sub-processor by updating this DPA and notifying the Customer in the dashboard. The Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees for them.

6. International transfers

Customer Personal Data may be transferred to the countries listed in section 5. Where a transfer of Personal Data subject to the GDPR, UK GDPR or Swiss law is made to a country without an adequacy decision, the parties agree that the European Commission’s Standard Contractual Clauses (Module 2: controller to processor, and Module 3 for onward transfers to sub-processors), together with the UK Addendum and the Swiss amendments where relevant, are incorporated by reference, with Foogital as data importer. [Docking clause, governing law and supervisory authority elections to be completed.]

7. Security measures

  • Encryption of data in transit (TLS) and at rest.
  • Logical separation of each customer’s data, enforced by row-level security in the database.
  • Access to production systems limited to authorised personnel, with two-factor authentication and least privilege.
  • Support access to a customer’s dashboard only to help that customer, signed and time-limited.
  • Regular backups, and monitoring for errors and abuse.
  • Visitor statistics loaded only after consent through the restaurant website’s cookie banner, and only on the restaurant’s own domain.

8. Personal data breaches

Foogital will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available to help the Customer meet its own obligations to notify regulators and data subjects. Foogital will take reasonable steps to contain and remedy the breach.

9. Audits

On reasonable written request, no more than once a year (or after a breach), Foogital will answer the Customer’s reasonable security questionnaires and provide available summaries of third-party certifications of its sub-processors. Where that is not enough to demonstrate compliance, the Customer may conduct an audit at its own cost, on 30 days’ notice, during business hours, subject to confidentiality and without access to other customers’ data.

10. Deletion and return

While its account is open, the Customer can delete Customer Personal Data in the dashboard or ask Foogital for a copy of it. When the Terms end, Foogital deletes Customer Personal Data within 90 days (and from backups within a further 35 days), unless the law requires it to be kept.

11. Liability

Each party’s liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not allow it.

12. Contact

Data protection questions: hey@foogital.com.