Lokanda Data Processing Agreement

This Data Processing Agreement (the "DPA") is made between the Client, meaning a business running a food service venue, as data controller (the "Controller") and Michał Fox, trading under the brand "Lokanda", based in Kraków, email: hello@lokanda.pl, as processor ("Lokanda", the "Operator", "we", "us").

The DPA is entered into by accepting the Terms of Service when opening an account in the Panel. It forms part of the Agreement and applies for as long as the Agreement lasts, including during the Trial, and, after it ends, until the data is deleted under section 12.

This DPA is made under Article 28 of Regulation (EU) 2016/679 (GDPR).

Capitalised terms have the meaning given in the Terms or in the GDPR. On personal data this DPA prevails over the Terms.

We process data only to give the Controller the Panel for running a venue: reservations and guest cards, Guest pages, Service messages, staff schedules, bills, supplies, reports and the activity log.

Processing covers storing, organising, making data available to the Controller in the Panel, sending Service messages, calculating summaries, making copies at the Controller's request, and deleting.

Processing lasts for the term of the Agreement and the period described in section 12.

Processing concerns the following people and data:

The Panel does not require special categories of data (Article 9 GDPR) or data on criminal convictions (Article 10 GDPR) and does not separate them out. Free-text fields may however contain them if a guest or the venue's staff enter them, for example an allergy in reservation remarks or the reason for a time-off request.

The Controller is responsible for such entries and their legal basis. We store them only as part of the entry and do not process them in any other way.

We process data only on the Controller's documented instructions, including with regard to transfers to a third country, unless the obligation comes from Union or Member State law. In that case we inform the Controller before processing, unless the law prohibits it.

Instructions are the Agreement, the settings and actions of Users in the Panel, and Tickets.

If we believe an instruction infringes the GDPR or other data protection law, we tell the Controller without delay and hold the instruction until it is clarified.

We do not process the data for our own purposes, do not sell it, do not combine the data of different venues and do not use it for marketing.

The Operator:

1. gives access to the data only to authorised people bound by confidentiality;
2. applies the security measures in section 6;
3. helps the Controller to meet the rights of data subjects, and passes on without delay any request that reaches us directly;
4. helps the Controller to meet its obligations under Articles 32 to 36 GDPR, in particular by providing the description of processing needed for an impact assessment;
5. reports a personal data breach to the Controller without undue delay after becoming aware of it, describing its nature, the categories and approximate number of people, the likely consequences and the measures taken;
6. keeps a record of categories of processing activities (Article 30(2) GDPR).

The Controller deletes and corrects reservations, staff, shifts and suppliers itself in the Panel. We delete guest cards and activity log entries on the Controller's instruction given in a Ticket.

The Controller may check that we comply with this DPA. It gives reasonable notice of an audit and runs it mainly through questions and documents, and on site after agreeing a date, in a way that does not reveal other venues' data. We make available the information needed to demonstrate compliance with Article 28 GDPR. The Controller bears the cost of the audit.

We apply technical and organisational measures suited to the risk, in particular:

1. encrypted connections to the Website and the Panel (HTTPS);
2. User passwords stored only as a salted bcrypt hash;
3. a session in a cookie not readable by page scripts, valid for 30 days, which can be ended on each device;
4. limits on attempts to sign in, register and book online;
5. roles in the Panel (owner, manager, staff) and permissions granted to Users;
6. separation of each venue's data, with access only for that venue's Users;
7. an activity log visible to the venue;
8. administrative access limited to authorised people.

We may change the measures to equally or more effective ones.

The Controller gives general authorisation for sub-processors in the following categories:

We give the Controller the current list of providers on request.

We announce a planned change of sub-processor or a new category by email and in the Panel at least 14 days in advance. The Controller may raise a reasoned objection during that time. If we find no solution, the Controller may terminate the Agreement with effect on the day of the change and gets a refund of the part of the Subscription for the unused time.

A sub-processor has data protection obligations no weaker than in this DPA. We are liable to the Controller for its actions as for our own.

We send Service messages on the Controller's behalf, only about a guest's reservation: confirmation, change, reminder and cancellation.

We send guests no marketing and do not use their data for any other purpose.

If a sub-processor processes data outside the European Economic Area, we base the transfer on a European Commission adequacy decision or on standard contractual clauses. On request we tell the Controller the place and basis of the transfer.

Access to the Panel from a third country by the Controller and its Users is the Controller's decision.

The Controller is responsible for the lawfulness of processing, in particular for:

1. the legal basis for processing the data of guests, staff and suppliers, including health information entered in free-text fields;
2. informing those people. The text shown at the reservation form is a template that the Controller checks and, where needed, completes;
3. the retention period of data in the Panel and deleting it during that time;
4. meeting the rights of data subjects;
5. who has access to the Panel and with what permissions.

The Controller does not enter data into the Panel that is not needed to run the venue.

We are liable for damage caused by processing contrary to this DPA or to obligations the GDPR places directly on processors, under Article 82 GDPR.

Between the Parties the limits of liability in the Terms apply to the extent the law allows.

For 30 days after the Agreement ends the Controller may view the data in the Panel and request a copy under the Terms. Then, within 30 days, we delete all entrusted data, including at sub-processors.

At the Controller's request we delete the data earlier or provide it in CSV format and then delete it. We confirm deletion in Documentary form.

We keep for longer only data that the law requires us to keep, and we tell the Controller so.

This DPA is governed by Polish law. Disputes are decided by the court competent under the Terms.

This DPA is available in Polish and English. If they differ, the Polish version prevails.

This DPA is effective from 6 November 2026.